Sophisticated OS X Backdoor Discovered • Hacker News Board

Re: Sophisticated OS X Backdoor Discovered

#51

Post by Analemma_ » Thu, Sep 08, 2016, 7:01 PM UTC

mhurron wrote: post #21

vemv wrote: post #20

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

Backdoors can be installed after the fact. The vendor putting in a back door is only one way for it to be present. This would be malware inserting a back door for further exploitation.

If you previously establish that the vulnerability was introduced by a third party, then "backdoor" might be an OK term afterward - after the context has been introuced.

In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They should have just said "malware".

Re: Sophisticated OS X Backdoor Discovered

#52

Post by takeda » Thu, Sep 08, 2016, 7:04 PM UTC

vemv wrote: post #20

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

Backdoor is probably the correct term, I guess we just got used to vendor placed backdoors.

Although I also assumed at first that it was vendor placed, even though I was familiar with backdoors from the past (Back Orifice, Sub7 etc)

Re: Sophisticated OS X Backdoor Discovered

#53

Post by drdrey » Thu, Sep 08, 2016, 7:09 PM UTC

linkregister wrote: post #28

vemv wrote: post #20

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."

Looks to me like your run-of-the-mill malware. A rootkit is typically something that uses OS hooks to hide itself from the list of running processes for instance.

Re: Sophisticated OS X Backdoor Discovered

#54

Post by jesalg » Thu, Sep 08, 2016, 7:09 PM UTC

niij wrote: post #26

jesalg wrote: post #18

This sounds a lot like the zero-day exploit used in the show Mr.Robot. Life imitating art.

I think Mr. Robot is art imitating life. Life, if course, being exploits like these.

Well I think the show depicted something like this before it became public knowledge. But point taken, they were inspired by similar exploits.

Re: Sophisticated OS X Backdoor Discovered

#55

Post by toyg » Thu, Sep 08, 2016, 7:10 PM UTC

richardwhiuk wrote: post #46

toyg wrote: post #44

That list of directories is really weird. On my machine, none of them exists, neither in ~/Library nor /Library. And I do run most of that software (Dropbox, Skype, Firefox, Chrome in the past...). Either the malware targeted very old versions of such software and/or OSX, or somebody between the malware author and the blog writer f###ed up.

The aim is to look legitimate, but not clobber applications - merely to look like something the user shouldn't delete.

But the post says that the malware checks if any of those folders exists, only then writing the necessary plist. By your reasoning, one of these folders should have been created in advance by another process. So this "backdoor" is even incomplete...

Re: Sophisticated OS X Backdoor Discovered

#56

Post by takeda » Thu, Sep 08, 2016, 7:11 PM UTC

throwaway76543 wrote: post #43

linkregister wrote: post #28

Earlier quoted context omitted.

I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."

No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only…

rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible.

The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.

Re: Sophisticated OS X Backdoor Discovered

#57

Post by drdrey » Thu, Sep 08, 2016, 7:12 PM UTC

clinton_sf wrote: post #48

saosebastiao wrote: post #33

Is there any diagnostic tool out there to determine if you've been infected?

> Is there any diagnostic tool out there to determine if you've been infected? From what I can tell, they posted the SHA256 of the offending binary under the IOCs section of that web page. So you should be able to do this in the root of your home directory to detect if such a file exists: # find . -type f -print0 | xargs -0 shasum -a 256 | grep 664e0a048f61a76145b55d1f1a5714606953d69edccec5228017eb546049dc8c

Binary checksums are usually not very helpful for identifying malware. The fact that the binary they were looking at was called "unpacked" suggests that there would be packed versions out there, and they would have a different checksum.

Re: Sophisticated OS X Backdoor Discovered

#58

Post by mwfunk » Thu, Sep 08, 2016, 7:15 PM UTC

yuja_wang wrote: post #16

kyriakos wrote: post #14

Earlier quoted context omitted.

I think that myth got shot down years ago. Along with magical and courageous marketing terms.

They still say it! On a page on their website in 2016. And their paid AstroTurfers are here on hn, with the downvotes.

Me saying this is downvote-worthy in itself and I'll gladly take my lumps because I'm only adding to the noise, but let's break this down:

(1) You claim that because someone wrote malware that requires root access to install, but can't be used to get root access to a system in the first place, that the vendor who makes that system should no longer publicly state (in their marketing materials no less) that they care about security and design their operating systems with security in mind.

(2) When people downvote your incredibly astute, mature, and insightful comment, you feel the need to follow up on it and complain publicly about people giving downvotes. Because everyone knows that the most appropriate response to downvotes is to complain about getting downvoted.

(3) You don't stop there, though! Why would you? You are so confused as to why someone would disagree with you that instead of reconsidering your original opinion, you assume that a huge corporation must be paying people to downvote the deep, deep wisdom you've chosen to express here. You don't keep this suspicion to yourself though- you are so certain of its veracity that you publicly state your conspiracy theory as well, because of course you will.

Any one of these things is incredibly downvote-worthy. All of these things combined are a perfect storm of comically stereotypical Internet forum asshattery that everyone has seen a million times over during the past 20 years and has no desire to ever, ever see again. Sadly, it will never completely go away because there's always a new generation to keep the traditions of Slashdot circa 1997 alive (or Usenet after September 1993). All anyone can do is downvote on sight and hope that each generation learns these lessons a little more quickly than the one that came before it. Honest critical thinking == good, mindless hateful tribalism == bad, that's all there is to it.

Re: Sophisticated OS X Backdoor Discovered

#59

Post by njloof » Thu, Sep 08, 2016, 7:15 PM UTC

Mizza wrote: post #2

Are video captures actually possible? I could imagine video capture as part of a RAT, but what scares me is the idea of video capture that doesn't turn on the camera activity light. Are there any examples of that?

Be safe and do as Mark Zuckerberg does -- stick a Post-It™ over the camera lens.

Re: Sophisticated OS X Backdoor Discovered

#60

Post by sordidfellow » Thu, Sep 08, 2016, 7:16 PM UTC

toyg wrote: post #55

richardwhiuk wrote: post #46

Earlier quoted context omitted.

The aim is to look legitimate, but not clobber applications - merely to look like something the user shouldn't delete.

But the post says that the malware checks if any of those folders exists, only then writing the necessary plist. By your reasoning, one of these folders should have been created in advance by another process. So this "backdoor" is even incomplete...

It says it checks if those folders are available - which could mean checking if the name is not already taken, and then creating the path for itself to use.