Sophisticated OS X Backdoor Discovered • Hacker News Board

Re: Sophisticated OS X Backdoor Discovered

#141

Post by stephenr » Fri, Sep 09, 2016, 9:09 AM UTC

initram wrote: post #90

stephenr wrote: post #35

Earlier quoted context omitted.

The article only includes the word "Video" once in the summary, but then mentioned screen captures every 30 seconds. I'm guessing that is what the summary is referring to when it says "video capture", because there is no other reference to video or camera.

The list of source files include avfsession.mm which is likely a C++ wrapper around AVCaptureSession[0], Cocoa's audio and video capture class. [0] https://developer.apple.com/library/ios/documentation/AVFoun...

The article itself makes no other mention to capturing video from the camera. Is it possible that they use that class purely to capture audio?

Re: Sophisticated OS X Backdoor Discovered

#142

Post by intoverflow2 » Fri, Sep 09, 2016, 9:40 AM UTC

jesalg wrote: post #18

This sounds a lot like the zero-day exploit used in the show Mr.Robot. Life imitating art.

How so? This isn't an exploit it's a piece of malware

Re: Sophisticated OS X Backdoor Discovered

#143

Post by mauz0r » Fri, Sep 09, 2016, 9:47 AM UTC

bink wrote: post #37

What is it that makes this malware sophisticated? I didn't see anything about rootkits or process hiding / obfuscation. Is it not just a simple daemon that can be configured to monitor audio/video/keyboard and send the results back via an encrypted connection?

My guess would be that they figured out how to compile QT statically (hence 14MB file size)... Other then that it seems to be a common RAT

Re: Sophisticated OS X Backdoor Discovered

#144

Post by mrmondo » Fri, Sep 09, 2016, 10:27 AM UTC

1. This is not a backdoor, it's malware or an exploit.

2. This is not specific to OS X, it affects many operating systems, so this sounds like an attempt at slandering software that someone doesn't like, or has a reason not to like.

Re: Sophisticated OS X Backdoor Discovered

#145

Post by _Codemonkeyism » Fri, Sep 09, 2016, 10:54 AM UTC

Looks like it's not only OS X - the OS X variant is newly discovered.

Title should be 'OS X Variant of Backdoor Discovered', shouldn't it?

"OS X variant of a cross-platform backdoor which is able to operate on all major operating systems (Windows,Linux,OS X). Please see also our analysis on the Windows and Linux variants."

Re: Sophisticated OS X Backdoor Discovered

#146

Post by matt-attack » Fri, Sep 09, 2016, 12:57 PM UTC

vemv wrote: post #20

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

Perhaps some would enjoy some related humor while we're on the topic of backdoors:

https://www.youtube.com/watch?v=cuYQ4qUEfEI

Re: Sophisticated OS X Backdoor Discovered

#147

Post by mordocai » Fri, Sep 09, 2016, 5:03 PM UTC

woodman wrote: post #130

jdmichal wrote: post #129

Earlier quoted context omitted.

I'm obviously not communicating my point well. Let's try this: A backdoor executes in a remote machine. It allows attackers to access that machine. A rootkit executes in a "remote" privileged context. It allows attackers to access that privileged context. It's in this context that I refer to escalation; it allows the attacker in a non-priviledged context access to a privileged context; aka escalation. And yes, the ac…

Well I do appreciate you trying, but I disagree with you that it is pedantry that doesn't matter. This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason. A backdoor doesn't need to be remote and the user isn't necessarily an attacker. It is simply a secret method of access that the designer put in place, it isn't de…

I think you are spot on for rootkit, but you are absolutely wrong on backdoor.

You say "This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason." when YOU(and others like you) are the one corrupting the meaning of backdoor.

Backdoor has meant for ages to be a way to access a computer/program while bypassing the normal authentication method, whether added by the designer or by someone else. You are trying to redefine it to mean only methods of bypassing normal authentication added by the designer. If you find it confusing that both types of backdoor are backdoors, then make up a new word that can be considered a subtype of backdoor don't try to coop an existing word and change its meaning.

Re: Sophisticated OS X Backdoor Discovered

#148

Post by jdmichal » Fri, Sep 09, 2016, 5:16 PM UTC

woodman wrote: post #130

jdmichal wrote: post #129

Earlier quoted context omitted.

I'm obviously not communicating my point well. Let's try this: A backdoor executes in a remote machine. It allows attackers to access that machine. A rootkit executes in a "remote" privileged context. It allows attackers to access that privileged context. It's in this context that I refer to escalation; it allows the attacker in a non-priviledged context access to a privileged context; aka escalation. And yes, the ac…

Well I do appreciate you trying, but I disagree with you that it is pedantry that doesn't matter. This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason. A backdoor doesn't need to be remote and the user isn't necessarily an attacker. It is simply a secret method of access that the designer put in place, it isn't de…

> A rootkit doesn't need to be remote and the user isn't necessarily an attacker.

No one said a rootkit needs to be remote. (I used "remote" in quotes just to align it to the backdoor.) And in the context of security, it is definitely an attack. If there's not a user executing unauthorized commands, then it's simply installed and authorized software.

> It doesn't need to have any functionality for user interaction...

This is true, and I can see how some of my statements were maybe a bit more specific about this than they needed to be. The point is still to give an attacker a context with elevated permissions; it need not be an interactive context.

> It runs with the same privileges as the OS that it is part of.

This I still think is overly restrictive. I don't think running in ring 0/1/2 with the kernel and drivers is a necessary component; having "root" access such that it can invoke kernel functionality necessary to achieve its goals is sufficient. Now, it may use "root" access to modify kernel files and drivers, which is perhaps what you're referring to and where the line blurs and pedantry beings. If "root" access gives you unfettered access to the system, including modifying kernel executable files, then there is basically no difference between "root" and ring 0.

> For example, by your definition: a remotely accessible privileged service is a rootkit, because an unprivileged internet user can interact with it - accessing data and executing code in the service's privileged context. 'sudo nginx' is not a rootkit.

More pedantry. Clearly intended and authorized access to a service is just normal operation. This is why I'm very explicit about the usage being unauthorized and label the user an "attacker".

Re: Sophisticated OS X Backdoor Discovered

#149

Post by woodman » Fri, Sep 09, 2016, 7:02 PM UTC

mordocai wrote: post #147

woodman wrote: post #130

Earlier quoted context omitted.

Well I do appreciate you trying, but I disagree with you that it is pedantry that doesn't matter. This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason. A backdoor doesn't need to be remote and the user isn't necessarily an attacker. It is simply a secret method of access that the designer put in place, it isn't de…

I think you are spot on for rootkit, but you are absolutely wrong on backdoor. You say "This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason." when YOU(and others like you) are the one corrupting the meaning of backdoor. Backdoor has meant for ages to be a way to access a computer/program while bypassing the norma…

> ... whether added by the designer or by someone else.

Your exception seems to hing on the word designer. I'd describe the individual responsible placing the backdoor as the designer. So if you place a modified version of /usr/sbin/sshd, then you've designed the backdoor for that system. I see no redefinition.

Re: Sophisticated OS X Backdoor Discovered

#150

Post by woodman » Fri, Sep 09, 2016, 7:18 PM UTC

jdmichal wrote: post #148

woodman wrote: post #130

Earlier quoted context omitted.

Well I do appreciate you trying, but I disagree with you that it is pedantry that doesn't matter. This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason. A backdoor doesn't need to be remote and the user isn't necessarily an attacker. It is simply a secret method of access that the designer put in place, it isn't de…

> A rootkit doesn't need to be remote and the user isn't necessarily an attacker. No one said a rootkit needs to be remote. (I used "remote" in quotes just to align it to the backdoor.) And in the context of security, it is definitely an attack. If there's not a user executing unauthorized commands, then it's simply installed and authorized software. > It doesn't need to have any functionality for user interaction...…

I think that we're as close as we'll get to agreeing - the main contention being the "attacker" part. I'd describe Symantic's data protection product as a rootkit, regardless of who installed it. I'd say the same for the LKMs that I've installed in honeypots.