New Mac Ransomware Is Even More Sinister Than It Appears (wired.com) 49
An anonymous reader quotes a report from Wired: The threat of ransomware may seem ubiquitous, but there haven't been too many strains tailored specifically to infect Apple's Mac computers since the first full-fledged Mac ransomware surfaced only four years ago. So when Dinesh Devadoss, a malware researcher at the firm K7 Lab, published findings on Tuesday about a new example of Mac ransomware, that fact alone was significant. It turns out, though, that the malware, which researchers are now calling ThiefQuest, gets more interesting from there. In addition to ransomware, ThiefQuest has a whole other set of spyware capabilities that allow it to exfiltrate files from an infected computer, search the system for passwords and cryptocurrency wallet data, and run a robust keylogger to grab passwords, credit card numbers, or other financial information as a user types it in. The spyware component also lurks persistently as a backdoor on infected devices, meaning it sticks around even after a computer reboots, and could be used as a launchpad for additional, or "second stage," attacks. Given that ransomware is so rare on Macs to begin with, this one-two punch is especially noteworthy.
Though ThiefQuest is packed with menacing features, it's unlikely to infect your Mac anytime soon unless you download pirated, unvetted software. Thomas Reed, director of Mac and mobile platforms at the security firm Malwarebytes, found that ThiefQuest is being distributed on torrent sites bundled with name-brand software, like the security application Little Snitch, DJ software Mixed In Key, and music production platform Ableton. K7's Devadoss notes that the malware itself is designed to look like a "Google Software Update program." So far, though, the researchers say that it doesn't seem to have a significant number of downloads, and no one has paid a ransom to the Bitcoin address the attackers provide. [...] Given that the malware is being distributed through torrents, seems to focus on stealing money, and still has some kinks, the researchers say it was likely created by criminal hackers rather than nation state spies looking to conduct espionage.
Though ThiefQuest is packed with menacing features, it's unlikely to infect your Mac anytime soon unless you download pirated, unvetted software. Thomas Reed, director of Mac and mobile platforms at the security firm Malwarebytes, found that ThiefQuest is being distributed on torrent sites bundled with name-brand software, like the security application Little Snitch, DJ software Mixed In Key, and music production platform Ableton. K7's Devadoss notes that the malware itself is designed to look like a "Google Software Update program." So far, though, the researchers say that it doesn't seem to have a significant number of downloads, and no one has paid a ransom to the Bitcoin address the attackers provide. [...] Given that the malware is being distributed through torrents, seems to focus on stealing money, and still has some kinks, the researchers say it was likely created by criminal hackers rather than nation state spies looking to conduct espionage.
Today is backup day (Score:5, Interesting)
Today sounds like a good day to test my backups.
Maybe you'll want to test yours today. (And Time Machine on the same disk wiped by ransomware or disk failure is not a backup).
Good backups are:
Automated
Off-site
Pull, not push (a machine can't overwrite the backup of itself)
Rotated (you have backups from multiple times)
Tested!
The majority of small businesses who think they have backups running actually don't. They haven't tested in years, so don't know it stopped working 9 months ago.
Re: (Score:2)
Re: (Score:2)
Read-only account or snapshot / copy yes (Score:4, Interesting)
You bring up a good point. The remote account and/or mechanism should be able to read, not write.
There are various ways to set up a read-only account. .authorized_keys, you can use setcap cap_dac_read_search+ep for SELinux to enforce read-only, you can use rsyncd and tunnel, etc. You can use read-only snapshots by LVM, etc. Lots and lots of ways to do it on Linux.
On Linux, you can use rrsync -ro in the
On Windows you'd typically have a backup operators AD group.
What a lot of people do is the local machine is backed up to a local network drive (NAS) every day or even four times a day. It may be encrypted at that stage. The remote backup pulls from NAS each night or each week. The remote only has access to NAS, not to each workstation. Of course read access to the NAS.
That gives you both very frequent backups that are local and remote backups without any remote access workstations.
If your backup routine puts encrypted backups on the NAS, that handles the confidentiality risk of remote access - the remote can only access encrypted data.
If the remote only gets an encrypted copy and doesn't have the key, you can help differential backups go quicker with an appropriately chosen cipher mode and the rsync algorithm, or just encrypt each file separately.
Re: (Score:2)
Tip from someone who very nearly lost his (Time Machine) backup because it was encrypted and the key was only kept on the backup source machine:
you need somewhere safe (outside the source machine, and accessbile when the source machine is disabled) to keep the encryption key. I.e. not a USB thumb drive that can get corrupted.
Re: (Score:2)
Good point. We do backups because "one is none, two is one" and that certainly applies to the key.
And two doesn't mean one thing twice. Two copies of identical USB thumb drives is ONE way of storing the the key. Thumb drives plus a printed copy in the fire safe is two.
If you're going to print it, it's helpful to use a passphrase rather than a randomly generated key. The actual bits of the real key are derived from the passphrase.
Re: Today is backup day (Score:2, Insightful)
And have more than one person testing. One of my companies had one guy doing backups. He signed off on the check off form like clockwork that everything was running and tested. We even had alert emails setup for any fails.
The alerts went only to him. He deleted them every day.
You can imagine what happened next.
Re: (Score:2)
He got a promotion and a raise?
Re: Today is backup day (Score:1)
Lololololol, if this was a government or defense contractor job then he would have. But not at this place :-)
Re: (Score:2)
Tested for sure. Most companies that get hit by ransomware have all of their rotated backups encrypted by the ransomware already by the time it gets triggered.
Re: (Score:2)
Good backups are both off-site and on-site.
On site, you have better control and availability. Off site will protect you against physical losses (ex: a fire).
If you only have off-site backup you are at the mercy of your backup provider. For example it may decide to wipe your data because you forgot to pay the bill. And data recovery may take days and be expensive. Also, having both on-site and off-site satisfy the rule of three: three copies, one of them at a different location.
Re: (Score:2)
That's also a way to satisfy another security criterion, as I discuss in the second half of this post:
https://slashdot.org/comments.... [slashdot.org]
Re: (Score:1)
"Automated" and "pull, not push" sounds self-contradictory. Can you provide an example? Thanks!
Re: (Score:2)
backup-server # crontab -l
01 01 * * * /use/local/bin/pull-backups
I think there is something implicit in your question or thinking that I'm missing. You can schedule a job on the backup server the same way you would schedule a job on your desktop. What am I missing?
Re: Today is backup day (Score:2)
The majority of small businesses who think they have backups running actually don't. They haven't tested in years, so don't know it stopped working 9 months ago.
Isn't that the truth!
I always tell people: it's not the backup that's important; it's the restore!
One thing that most people don't know about Time Machine: If you have identified more than one drive for backups, TM will automatically rotate backups to those drives. And if you make one of those drives be in an external USB enclosure, and only connect it weekly or monthly, TM will do a backup to it automatically when it is connected, and that can form a persistent backup probably good enough for most home use
Re: (Score:2)
For remote pull on a home machine, a VPS or an AWS Lambda may be options. I'm sure some service providers like Backblaze provide a pull-based client / configuration, but I don't know which ones. We used to when I owned a company similar to Backblaze, but more advanced and smaller. (We made it so you could boot a snapshot of your backup as a VM in our cloud).
Re: (Score:2)
If you have one computer (i.e. a home user), how do you test your backup? You can, of course, do the rest on the list, but the last is a bit of a challenge. Of course, everybody on slashdot has 20 computers, so that's not much of a problem for them, but a normal user tends to have only one.
VM, restore file, $15 garage sale comp., old driv (Score:2)
That's a good question. I'd be curious to hear other people's answers.
Off the top of my head, one can test restoring a random file or directory (after making a new backup of the good copy). Check that permissions are right. That's not the same as restoring the entire system, but it's a lot better than nothing.
I bought a computer at a garage sale for $15 one time. Having a spare around is handy from time to time. I can let my little kid use the slow one. I could test restores on it.
One could save an old ha
Torrented software (Score:2)
Ignoring the face that It’s probably cheaper to pay the $50 ransom than to buy a legitimate copy of the software, don’t run software on your machines that you don’t know the origin of. The primary transmission vector for this trojan is simple ignorance. On the positive side, this shines a light on the risks of using pirated software.
Re: (Score:2)
Ignoring the face that It’s probably cheaper to pay the $50 ransom than to buy a legitimate copy of the software
Actually, a legitimate copy is cheaper in this case. It's being packaged as a pirated copy of Little Snitch, but Little Snitch only costs $45 for a single license [obdev.at] (and if you're using it on multiple machines, odds are you're a professional and should really know better than to be pirating software for your business).
Re: (Score:3)
Anyone else remember... (Score:2, Informative)
Back in the day in the Mac v Windows wars, one of the big pluses for Mac was, "Macs don't get viruses! They're not insecure like Windoze! Lulz!"
Re:Anyone else remember... (Score:5, Informative)
Back in the day in the Mac v Windows wars, one of the big pluses for Mac was, "Macs don't get viruses! They're not insecure like Windoze! Lulz!"
Since this one seems to require that you download and install it, it's more a Trojan than a virus.
But, yeah, the lesson seems to be, don't install software from sketchy sites.
Re: (Score:2)
So does Piratebay vet their software then?
Re: (Score:2)
No, but the users will leave comments if there's something fishy going on with a particular torrent. Also, there are "trusted" users with good track records that you can check their history.
Re: (Score:2)
You get what you pay for?
Re: (Score:1)
A virus is not the same as a trojan horse.
You mean they aren't imuun for malware (collection name for viruses, worms, trojans and spyware)
Re: (Score:2)
The number of viruses and other malware that affect the Mac was and still is much lower than Windows. It was always a question of market share - fewer users means less motivation to write the malware. There are, of course, architectural differences in the OS and maybe the Mac is a bit harder to attack, but fundamentally ANY OS will have vulnerabilities. It is just the nature of complex software. But you're way smarter than me, so you knew that.
Re: Anyone else remember... (Score:2)
Back in the day in the Mac v Windows wars, one of the big pluses for Mac was, "Macs don't get viruses! They're not insecure like Windoze! Lulz!"
I wondered how long it would be before some slopehead would drag out that tired meme. Guess we know.
Macs still donâ(TM)t get self-replicating malware, i.e. "viruses". This is a Trojan; or at least the distribution method is Trojan-like.
And, as has been pointed-out many times: There is simply no practical way to create a usable OS that can provide 100% protection against a User determined to bypass, defeat and ignore every single security measure built into said OS.
Re: Anyone else remember... (Score:1)
Macs had viruses scince the days of the first Macs.
The only reason why they get fewer viruses than M$ is because they are a smaller market. If Apple, not M$ dominated the desktop, people would be saying "Well Windows does not get viruses!"
Mac users need to turn off their personal reality distortion field. They are as vulnerable as anyone else.
Re: (Score:2)
Try this:
Install Windows in a VM, maybe an AWS instance.
Run a file integrity monitor that records the SHA2 of each file.
Connect it to the internet for 15 minutes without a Linux or BSD firewall in front of it to protect it.
After 15 minutes check out all of the system files and registry keys that have been replaced by malware.
Vs
On a Mac, if you intentionally download and install "hacked" software, it's now possible that the hacked software may indeed be hacked. Which is NEWS.
Unvetted software (Score:5, Insightful)
As was shown many times in the past, malicious actors are successful at targeting official app stores. Typically, this is done by buying legitimate apps, uploading obfuscated malicious code via patch, the malicious payload successfully fools automated detection that is mostly signature-based and compromising even users that only use platform's app store and screen all their applications.
Re: (Score:3)
As was shown many times in the past, malicious actors are successful at targeting official app stores. Typically, this is done by buying legitimate apps, uploading obfuscated malicious code via patch, the malicious payload successfully fools automated detection that is mostly signature-based and compromising even users that only use platform's app store and screen all their applications.
Mac apps downloaded from the MAS run in a sandbox, so their malware potential is limited. And Apple does run automated checks to see if you're acting like malware. And if an app does get bought and subverted to do bad things outside its sandbox... once its behavior is detected, Apple will revoke the developer's cert and inactivate the app. Dev certs cost actual money, so if your app's behavior is criminal and you used your real credit card to buy it, expect a visit from the FBI. Sure, you can use a stolen c
Re: (Score:2)
These policies and practices are exactly why I am a very happy user of the supposedly evil walled-garden of the Apple ecosystem.
And yes I appreciate that on my Macs, there are ways around it and incremental versions between all or nothing.
As for my phone, even if they offered an option for bypassing, I would never do it.
Proves the effectiveness of proprietary software (Score:3)
Idea for tracking... (Score:1)
It would be interesting to send the ransom address soem small amount - say $10 - and then see if that account sent money anywhere else... could be you could track backwards from where the money was sent on, to find the owner of the ransomware wallet.
Re: Idea for tracking... (Score:2)
It would be interesting to send the ransom address soem small amount - say $10 - and then see if that account sent money anywhere else... could be you could track backwards from where the money was sent on, to find the owner of the ransomware wallet.
That's why it is vitally important to outlaw the use of all cryptocurrency!
No cryptocurrency; no ransomware payment-conduit. Simple as that!
Bad timing for Google re: Backup and Sync (Score:2)
.
(noting that El Cap debuted in late 2015, so not even five years old)
And so - relevant to this story - no doubt some of those searc
Re: (Score:2, Interesting)
My beef isn't that Google's decided not to support an (arguably old) release of OSX any more - that's their choice. The issue is that they ...then LATER decided to announce that, oh, hey, it's now unsupported on your os, you're screwed.
(1) didn't make any prior announcement that they were dropping it,
(2) released a buggy auto-update that crashed on El Capitan that gave zero info to the user on what was wrong,
(3)
Re
Re: (Score:2)
--Speaking as someone who was recently using an ElCap iMac as their primary PC, no software company is obliged to support any particular OS version indefinitely. From wiki:
Support status
Unsupported. Extended support ended in September 2018
--So yeah, they're google - but they don't want to continue supporting software for an unsupported OS.
You get what your fucking deserve (Score:1)
If you think you're being leet for stealing software, this is your reward.
Oh, you wouldn't have bought it anyway? Then why are you stealing now? Just because it's free?
Let the excuses fly.
Re: (Score:2)
And besides, you have to buy TurboTax every year. An old copy of it will not work for any year other than the one it was made for.
Red in the face (Score:2)
which researchers are now calling ThiefQuest, gets more interesting from there. In addition to ransomware, ThiefQuest
"Thief" has bad connotations. Parents won't want their scriptkids playing with it. Let's call it RougeQuest instead.