I think it's pretty funny that they go through all the trouble of making this for MacOS, yet it searches for only MS Office file extensions and not Apple's iWork extensions. It also seems to me that this all hinges on having gatekeeper disabled.
Sophisticated OS X Backdoor Discovered
71–80 of 155 posts
Re: Sophisticated OS X Backdoor Discovered
#72Is 'backdoor' the correct term if the vulnerability does not originate from Apple?
Backdoor is probably the correct term, I guess we just got used to vendor placed backdoors. Although I also assumed at first that it was vendor placed, even though I was familiar with backdoors from the past (Back Orifice, Sub7 etc)
Then maybe we need a more defined term? Something like 1st-party backdoor vs 3rd-party backdoor?
Re: Sophisticated OS X Backdoor Discovered
#73Earlier quoted context omitted.
Backdoors can be installed after the fact. The vendor putting in a back door is only one way for it to be present. This would be malware inserting a back door for further exploitation.
If you previously establish that the vulnerability was introduced by a third party, then "backdoor" might be an OK term afterward - after the context has been introuced. In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They shoul…
I agree. My first reaction when I read the headline was, I thought Apple had put it there, which I found disturbing seeing as how Apple has publicly spoken out against backdoors. I think a better title would be something like "Sophisticated OS X Backdooring Malware Discovered". That would make it clear that the backdoor is not present in the binaries shipped by Apple.
Re: Sophisticated OS X Backdoor Discovered
#74Okay, but no information on what to do about it, or how to protect against it.
Enable Gatekeeper on Mac (or just don't disable it, I think it's enabled by default).
Re: Sophisticated OS X Backdoor Discovered
#75I feel the use of 'backdoor' here is misleading. The software described would usually be classified as an Advanced Persistent Threat [1] or Rootkit [2] Backdoor [3] usually refers to methods to sidestep authentication added by the vendor. 1: https://en.wikipedia.org/wiki/Advanced_persistent_threat 2: https://en.wikipedia.org/wiki/Rootkit 3: https://en.wikipedia.org/wiki/Backdoor_(computing)
Not misleading, incorrect.
Re: Sophisticated OS X Backdoor Discovered
#76Earlier quoted context omitted.
Binary checksums are usually not very helpful for identifying malware. The fact that the binary they were looking at was called "unpacked" suggests that there would be packed versions out there, and they would have a different checksum.
Yes. And the malware could be polymorphic. Or there could be multiple versions of the same "core" out there. It's not clear to me how sophisticated virus (malware) scanners for OS X are with dealing with that.
From what I know (which is not much) scanners, among other things, search for identifying patterns in files. So there is an identifying pattern of each discovered malware/virus in a database.
Re: Sophisticated OS X Backdoor Discovered
#77Earlier quoted context omitted.
I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."
No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only…
Whether the terminology is technically correct or not, I think it's obvious that it can easily be interpreted in different ways, some of which are incorrect. As such, while it may not be wrong, it is poorly chosen, and may be misleading. A better way to phrase it might have been "A sophisticated backdoor targeting OS X discovered".
Re: Sophisticated OS X Backdoor Discovered
#78Is there any diagnostic tool out there to determine if you've been infected?
I whipped up https://gist.github.com/atdt/e84483c70c078a72f5e08ead365c69f... based on the information in the report.