Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sophisticated OS X Backdoor Discovered

securelist.com

Post reply on HN
Print view View original

101–110 of 155 posts

Re: Sophisticated OS X Backdoor Discovered

#101

Post by rurban »

Mizza wrote: post #2

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the camera activity light. Are there any examples of that?

Apparently this malware doesn't take webcam screenshots (as law inforcement illegally does). It just takes screenshots, possibly to match keystrokes to the window, to be able to match password entries to the application or url. And then exploit that furtheron. I wonder why it takes audio captures though? Just for the thrill? Or is it the government?

Re: Sophisticated OS X Backdoor Discovered

#102

Post by woodman »

jdmichal wrote: post #98
woodman wrote: post #66

Earlier quoted context omitted.

No, that is really wrong. Rootkits aren't for privilege escalation, see the paragraph immediately following your quote: "... an attacker can install it once they've obtained root or Administrator access." Calling BO a backdoor is a major corruption of the word, as you loose the only word for describing intentionally weakened security - so that you may describe a thing which already has several more explicitly definin…

The installation of the rootkit is different from its purpose. A rootkit may require a root permission to install, perhaps piggybacking on another legitimate install such as in the famous Sony BMG rootkit. Or it may use an exploit to gain root access and install. However, once installed , the purpose is the same: To provide the attacker with root permissions. It will also typically use its access to root permissions…

> A rootkit may require a root permission to install...

This sort of phrasing is misleading. If your OS restricts security sensitive kernel functions to the root user (hint: 99% of OSes do), then it isn't "may" - it is "must". Are there wrapper scripts that run privilege escalation exploits before installing the rootkit? Yes. Doesn't that make the exploit part of the rootkit? No, they are two very different things performing two different functions and are capable of operating independent of one-another.

> ...the purpose is the same: To provide the attacker with root permissions.

No, it is to allow code to run at the same privilege level as the kernel itself. Unrestricted loadable kernel modules. Think that is a distinction without a difference? OSX disagrees, as does Windows.

Re: Sophisticated OS X Backdoor Discovered

#103

Post by mseri »

eriknstr wrote: post #73
Analemma_ wrote: post #51

Earlier quoted context omitted.

If you previously establish that the vulnerability was introduced by a third party, then "backdoor" might be an OK term afterward - after the context has been introuced. In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They shoul…

I agree. My first reaction when I read the headline was, I thought Apple had put it there, which I found disturbing seeing as how Apple has publicly spoken out against backdoors. I think a better title would be something like "Sophisticated OS X Backdooring Malware Discovered". That would make it clear that the backdoor is not present in the binaries shipped by Apple.

Same here. Malicious backdoor or rootkit backdoor would have been more appropriate

Re: Sophisticated OS X Backdoor Discovered

#104

Post by bdamm »

kabdib wrote: post #6
stephenr wrote: post #5

Earlier quoted context omitted.

A lot of cross platform software that attempts audio/video (e.g. Skype etc) would be considered malware by some. Usually people who've had to use it at least once.

Serious question: Is this snark, or does the software in question do sketchy things with privilege escalation that might be leveraged into attacks? I agree that much software has terrible UI, but it's good to distinguish surface stuff from objectively terrible security decisions.

This is an excellent example of where user visibility into authorized processes could improve trust in software. Specifically, this software is ideal as a trojan horse; the user likely felt slightly coerced into installing it (install this plugin or you can't take part in this meeting / talk with love interest / remote family) and so they likely did so, possibly bypassing blessed trust sources. And even worse, the software is being granted privileges that are particularly ripe for abuse.

So this would lead a reasonably paranoid person to conclude that such software would be the ideal vehicle for privacy violation. Thus, if ever there is a software package for which a user ought to have visibility and enhanced control, this would be it.

Re: Sophisticated OS X Backdoor Discovered

#106

Post by mxvzr »

mwfunk wrote: post #58
yuja_wang wrote: post #16

Earlier quoted context omitted.

They still say it! On a page on their website in 2016. And their paid AstroTurfers are here on hn, with the downvotes.

Me saying this is downvote-worthy in itself and I'll gladly take my lumps because I'm only adding to the noise, but let's break this down: (1) You claim that because someone wrote malware that requires root access to install, but can't be used to get root access to a system in the first place, that the vendor who makes that system should no longer publicly state (in their marketing materials no less) that they care a…

To anyone, like me, who might be wondering what happened on September 1993: I assume it is in reference to this https://en.wikipedia.org/wiki/Eternal_September

Re: Sophisticated OS X Backdoor Discovered

#107

Post by djrogers »

toyg wrote: post #55
richardwhiuk wrote: post #46

Earlier quoted context omitted.

The aim is to look legitimate, but not clobber applications - merely to look like something the user shouldn't delete.

But the post says that the malware checks if any of those folders exists, only then writing the necessary plist. By your reasoning, one of these folders should have been created in advance by another process. So this "backdoor" is even incomplete...

> But the post says that the malware checks if any of those folders exists

Presumably so it doesn't re-infect an already compromised host

Re: Sophisticated OS X Backdoor Discovered

#108

Post by manarth »

Not sure whether to be amused, vindicated, or concerned that the most prominent conversation here on HN is terminology: "Is 'backdoor' the correct term?"

Malware, trojan, virus, rootkit, backdoor, squirglebunny (OK, I may have made that last one up).

There's not a lot of talk about the threat vector though - does anyone know how this infects systems?

Re: Sophisticated OS X Backdoor Discovered

#109

Post by jdmichal »

woodman wrote: post #102
jdmichal wrote: post #98

Earlier quoted context omitted.

The installation of the rootkit is different from its purpose. A rootkit may require a root permission to install, perhaps piggybacking on another legitimate install such as in the famous Sony BMG rootkit. Or it may use an exploit to gain root access and install. However, once installed , the purpose is the same: To provide the attacker with root permissions. It will also typically use its access to root permissions…

> A rootkit may require a root permission to install... This sort of phrasing is misleading. If your OS restricts security sensitive kernel functions to the root user (hint: 99% of OSes do), then it isn't "may" - it is "must". Are there wrapper scripts that run privilege escalation exploits before installing the rootkit? Yes. Doesn't that make the exploit part of the rootkit? No, they are two very different things pe…

Regardless, the point of a rootkit is to provide an execution context with escalated privileges. Whether that means root user, kernel space, System user is I would think depends on the specific rootkit. (Whose name, of course, points to "root" privileges.) Which was my original definition and is inline with the posted definition from Wikipedia.

Re: Sophisticated OS X Backdoor Discovered

#110

Post by [deleted] »

woodman wrote: post #102
jdmichal wrote: post #98

Earlier quoted context omitted.

The installation of the rootkit is different from its purpose. A rootkit may require a root permission to install, perhaps piggybacking on another legitimate install such as in the famous Sony BMG rootkit. Or it may use an exploit to gain root access and install. However, once installed , the purpose is the same: To provide the attacker with root permissions. It will also typically use its access to root permissions…

> A rootkit may require a root permission to install... This sort of phrasing is misleading. If your OS restricts security sensitive kernel functions to the root user (hint: 99% of OSes do), then it isn't "may" - it is "must". Are there wrapper scripts that run privilege escalation exploits before installing the rootkit? Yes. Doesn't that make the exploit part of the rootkit? No, they are two very different things pe…

[deleted]
Post reply on HN