New Mac Trojan installs silently, no password required


Recommended Posts

A new Mac OS X Trojan has been discovered that drops different components depending on whether or not it is executed on a user account with Admin permissions. The threat installs itself silently (no user interaction required) and also does not need your user password to infect your Apple Mac. The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions.

Intego, which had to update its anti-malware signatures upon discovering the threat, refers to it as "OSX/Crisis." The good news is that the security firm has yet to find OSX/Crisis in the wild; the company only stumbled upon it over at VirusTotal, a service for analyzing suspicious files and URLs.

This Trojan is like most: when run, it installs silently to create a backdoor. What makes this threat particularly worrying is that depending on whether or not it runs on a user account with Admin permissions, it will install different components, which use low-level system calls to hide their activities. Either way, it will always create a number of files and folders to complete its tasks.

If the dropper runs on a system with Admin permissions, it will drop a rootkit to hide itself. The malware creates 17 files when it's run with Admin permissions, 14 files when it's run without. Many of these are randomly named, but there are some that are consistent.

With or without Admin permissions, this folder is created: /Library/ScriptingAdditions/appleHID/

Only with Admin permissions, this folder is created: /System/Library/Frameworks/Foundation.framework/XPCServices/

Here's where it gets interesting. "The file is created in a way that is intended to make reverse engineering tools more difficult to use when analyzing the file," an Intego spokesperson said in a statement. "This sort of anti-analysis technique is common in Windows malware, but is relatively uncommon for OS X malware."

Curiously, this particular malware only affects OS X 10.6 Snow Leopard and OS X 10.7 Lion. The latest threat further underlines the importance of protecting Macs against malware with an updated antivirus program as well as the latest security updates. That means you should start by getting OS X 10.8 Mountain Lion when it comes out Wednesday (although it's currently unclear whether OSX/Crisis or Mac security software will work on it).

Source:

http://www.zdnet.com/new-mac-trojan-installs-silently-no-password-required-7000001519/

Unless of course you're running GateKeeper settings to only allow app store and identified developer installs; keeps it off your system ;)

Where does it say that? Gatekeeper isn't going to prevent exploits in signed software. I don't see how it's being installed detailed.

I just Have to LoL, all the people "But Mac's Dont Get Viri"

Its an OS built by Humans, it will get hit, just a matter if time

edit - Stupid iPad and these Text box's

On Topic - I do feel that Very Few people run OSX as a Non-Admin User account, and surprised the infection doesn't need credentials at all

I just Have to LoL, all the people "But Mac's Dont Get Viri"

Its an OS built by Humans, it will get hit, just a matter if time

edit - Stupid iPad and these Text box's

On Topic - I do feel that Very Few people run OSX as a Non-Admin User account, and surprised the infection doesn't need credentials at all

What people? i don't think anyone says that these days, maybe before, but back then it was pretty much the case.. it didn't have viruses, and even now it's hardly anything to worry about. Anyone with half a brain can prevent or easily spot changes in the system. I didn't run a virus scanner for all the years of running Windows and never got a virus, malware, or trojans so i wont be needing it for the Mac either, for those that do worry have virus software available to them.

I don't know why windows use get so giddy when this sort of news appears.

Just FYI if gatekeeper has a 'only run signed packages' option then it's also got an equilivent in windows for XP and newer, via the GPO you can set it to only run signed executables using the certificates you provide, though I've never actually seen anyone/any company use it.

And yes exploits can/will be discovered but the more protection you have, the more % of people that'd give up before getting it cracked.

I don't know why windows use get so giddy when this sort of news appears.

I don't either but they've been wetting their pants for 10 years now since I switched....it's coming, it's coming....yeah...here I am unbitten.

  • Like 2

What people? i don't think anyone says that these days, maybe before, but back then it was pretty much the case.. it didn't have viruses, and even now it's hardly anything to worry about. Anyone with half a brain can prevent or easily spot changes in the system. I didn't run a virus scanner for all the years of running Windows and never got a virus, malware, or trojans so i wont be needing it for the Mac either, for those that do worry have virus software available to them.

I don't know why windows use get so giddy when this sort of news appears.

because the reality distortion field is getting weaker...

Where does it say that? Gatekeeper isn't going to prevent exploits in signed software. I don't see how it's being installed detailed.

IF it is signed, Apple can revoke the certificate and ALL macs running gatekeeper will stop executing the file (plus in ML they beefed up their built in AV so they could delete it from your system very quickly too)

What people? i don't think anyone says that these days, maybe before, but back then it was pretty much the case...

I get alot of people in the repair shop talking about switching to a mac after their computer got hit with an infection, thinking they wont have problems..

I don't either but they've been wetting their pants for 10 years now since I switched....it's coming, it's coming....yeah...here I am unbitten.

I always said, if market share for Macs gets to big, then they will start getting attacked more. Right now, Mac users are safe but I still advise work and others that I know who have Macs to have proper protection.

This will probably be patched soon so no big deal.

I don't know why windows use get so giddy when this sort of news appears.

I'm not giddy...tho I have no sympathy for people who think they are untouchable and do not have the proper protection in place. Especially when its people who I warn and recommend products to to keep them safe.

Im so glad that macs have increased in popularity so much that they now have to worry about viruses, spyware and trojans just like the rest of us :-). Now the days of the snobby mac user attitue of saying how they dont need antivirus those days are now over :-). Plus this will create many new jobs as tech companies can now make and sell antivirus/spyware products or mac users now. As the popularity of apple becomes more and more its OS will have so many viruses and junked up just like Windows lol.

This new trojan installs silently. I laugh when all the mac users I see in person say how they cant get viruses or how secure the OS is. This proves how blinded they are.

At least Linux is still fairly free from all of this :-)

It personally makes me laugh because Mac advocates like to constantly remind us of how much better a mac is, when in reality they're just as easy if not more so than Windows computers to exploit.

What people? i don't think anyone says that these days, maybe before, but back then it was pretty much the case.. it didn't have viruses, and even now it's hardly anything to worry about. Anyone with half a brain can prevent or easily spot changes in the system. I didn't run a virus scanner for all the years of running Windows and never got a virus, malware, or trojans so i wont be needing it for the Mac either, for those that do worry have virus software available to them.

I don't know why windows use get so giddy when this sort of news appears.

You are correct when it comes to the users here... but out in the real world the attitude "macs don't get viruses" is still very prevalent.

I have ML which to my understanding GateKeeper is an anti-virus of sorts... That said I think that the FUD is starting to get to me because I feel the need to get an anti-virus program. idk... I think the anti-virus software makers the ones that get the giddiest about this news because they want nothing more than to tap into the Mac market.

It personally makes me laugh because Mac advocates like to constantly remind us of how much better a mac is, when in reality they're just as easy if not more so than Windows computers to exploit.

What really makes me laugh is PC advocates like to pretend the lack of viruses is the soul reason. That while in reality many Mac users have vastly different reasons for having made the switch.

Funny, I've been unbitten on windows for almost 20...

Let me send a BIG...HUGE happy birthday shout out to my fellow neowinian, HawkMan! Happy birthday, HAWK-MAN....(sings the HB song) (Y)

IF it is signed, Apple can revoke the certificate and ALL macs running gatekeeper will stop executing the file (plus in ML they beefed up their built in AV so they could delete it from your system very quickly too)

While Gatekeeper is indeed good feature to have, it doesn't make you free from exploits, attacks and vulnerabilities. It's not its purpose, I would say. If it was, it's a **** poor job. Getekeeper's whole point is to prevent you (as in you and your mouse pointer) running bad things, and to whitelist the good stuff from the bad. It's literally just signing, you (and the developer) knowing that the file isn't altered.

Let's start from the fact that Gatekeeper and code signing as a whole (i.e. from system) only applies to executable files. It doesn't prevent you from running malicious code on the system, just opening executables (as in application packages and installers). Also note that Gatekeeper only quarantines executables downloaded using applications that support and flag the files as downloaded. It doesn't care about drive-bys or files coming from applications that do not specifically mark files as downloaded. For instance file coming via file sharing protocol, syncing service or drive-by are handled as other seemingly existing, old files.

Also its up to the caller of the executable to decide whether they validate or require signatures. For instance a platform installed on the system can run the platform specific plugins, scripts etc. without verifying any signatures.

What really makes me laugh is PC advocates like to pretend the lack of viruses is the soul reason. That while in reality many Mac users have vastly different reasons for having made the switch.

I don't care what makes people switch. Apple fans seem to make out that OSX is immune to being hacked or virused, when in fact evidence suggests that if anything it's easier than Windows to exploit (Vista onwards anyway, with XP it's about a draw)

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Passkeys: Think of them like a broken heart necklace. Imagine one of those heart necklaces that breaks into two matching pieces. One person keeps one half, and the other person keeps the other half. With passkeys, the website has one half, and you have the other half. If the website gets hacked and someone steals its half, that stolen piece is useless by itself. It cannot unlock your account without your matching half. This particular heart necklace is one of a kind, there is only one in existence. Your half of the necklace has to be stored somewhere. It might be stored on your phone, tablet, computer, security key, or a password manager that can sync it between all your devices. A security key is a small physical device that you keep with you, kind of like a house key, car key, or flash drive. I would not usually recommend a security key as the first option for the average person. For most people, it is easier to use their phone, computer, or a password manager that can sync passkeys between their devices. A security key is more like a spare key you keep in a safe place, just in case you lose access to your other devices or your password manager. Some security keys plug into your computer. Some plug into your phone or tablet. Some get tapped against your device. The idea is simple: a security key can hold another passkey for the same website. Think of it like creating a second one-of-a-kind heart necklace for the same account. One necklace could be paired with your password manager, while another necklace could be paired with your security key. That means the website has more than one matching half on file. One half matches the passkey in your password manager. Another half matches the passkey stored on your security key. So, if you lose access to your phone, computer, or password manager, you would still be able to log in using the passkey stored on your security key. Think of it like keeping an extra special necklace piece on a tiny keychain, stored somewhere safe. The website still has the matching half for that security key, but your half is safely stored inside the little key. A passkey does not automatically exist on every device you own. It lives wherever you save it. If your half is stored on one device, then that device is the one that has the matching piece. For example, if you create the passkey on your Windows computer and it is only saved to that computer, your iPhone does not automatically have that same half. If you create it on your iPhone and it only stays on that iPhone, your Android phone does not automatically have it either. That is where password managers come in. A password manager can act like a protected jewelry box for your passkeys. Instead of your half of the necklace being locked to only one device, the password manager can securely sync that half to your other approved devices. For example, Apple Passwords and iCloud Keychain can sync passkeys between your Apple devices. Google Password Manager can sync passkeys with your Google account. But password managers such as 1Password and Bitwarden can sync passkeys between everything, your phones, tablets and computers. Now, you might ask: “What happens if I lose access to the device that has my passkey?” That depends on where your passkey was saved and what recovery options the website gives you. If your passkey was synced through a password manager, you may be able to sign in from another device that has access to that same password manager. For example, if your passkey is saved in iCloud Keychain, Google Password Manager, 1Password, or Bitwarden, another approved device may still have access to it. If your passkey was saved only on one phone, computer, or security key, and you lose that device, then you may not have your half of the necklace anymore. In that case, you would usually need to use the website’s backup login or account recovery options. A lot of websites that support passkeys still let you fall back to your regular password. So if you lose access to your passkey, the site may still let you log in with your password, a code sent to your email, a text message, a recovery code, or some other account recovery process. That is convenient, but it is also important to understand: if the website still allows password login, then your password still matters. Passkeys are safer than passwords, but if your account still has a password as a backup, you should still use a strong, unique password and turn on two-factor authentication if the website offers it. This is why it is a good idea to have more than one safe way back into important accounts. For example, you might keep your passkey in a syncing password manager, add a second trusted device, save recovery codes somewhere safe, or set up a backup security key. A passkey is very secure, but just like a real key, you need a backup plan in case you lose access to it. Now, you might ask: “What stops a hacker from copying my half of the necklace?” That’s the important part: your half is protected. It is not something you type in, and it is not something the website gets to keep. Think of your half as being locked inside a tiny safe on your phone, computer, security key, or password manager. That safe only opens when you approve it with your fingerprint, face, PIN, or device password. When you log in, the website does not need to see your half. It only needs proof that your half matches its half. Your actual half is not handed over to the website. This is different from a password. With a password, you type the secret into the website. If you type it into a fake website, the hacker now has it. With a passkey, you are not typing your secret into the website. Your device is proving you have the matching half without giving the half away. That also helps protect you from fake websites. If someone makes a fake login page that looks like the real site, your device can tell it is not the real match. It will not use your passkey there. Now, could someone use your passkey if they stole your device, got into your password manager, or somehow unlocked the safe that holds your half? Yes, that is why your device password, PIN, fingerprint, face unlock, and password manager security still matter. But a hacker cannot just steal your passkey from the website or trick you into typing it into a fake page like they can with a password. That is why passkeys are safer than passwords. The two matching pieces have to come together, like two lovebirds who were once separated and are finally reunited.
    • Newegg offers insane combo deal on Amazon Prime Day 2026 that beats Steam Machine by Sayan Sen Building a PC is undoubtedly difficult nowadays but with this epic combo deal, Newegg is trying to make it as easy for you as it is possible. If you are making a new one or even upgrading an old system to a new Windows 11 device, this combo bundle is truly unmissable as you get AMD's Ryzen 9800X3D, a compatible X870 motherboard, a 240mm AIO liquid cooler and finally a Samsung 990 PRO SSD all for under $1000 (purchase link under the specs table down below). This should beat out the newly launched Steam Machine from Valve in terms of performance and performance per dollar especially if you are willing to set Linux up on it. Essentially with this combo you will get the AMD Ryzen 7 9800X3D 8-core 3D V cache CPU, Samsung's 990 PRO 2TB NVMe SSD, the MSI MAG X870 TOMAHAWK WIFI ATX Motherboard, and finally the Cooler Master Elite Liquid 240. Thanks to that massive vertically stacked L3 cache, the X3D desktop processors, including the 9800X3D, also come with the benefit of not needing fast memory. Even DDR5-5600 should be plenty for it. The technical specifications of the Ryzen 7 9800X3D are given in the table below: Specification Value Architecture Zen 5 Cores / Threads 8 / 16 Base Clock 4.7 GHz Max Boost Clock Up to 5.2 GHz L1 Cache 640 KB L2 Cache 8 MB L3 Cache 96 MB Total Cache 104 MB CPU Core Process TSMC 4nm FinFET I/O Die Process TSMC 6nm FinFET Socket AM5 Default TDP 120W Max Temperature (Tjmax) 95°C Thermal Solution Not included Memory Type DDR5 Max Capacity 256 GB Memory Speeds 2x1R: DDR5-5600 2x2R: DDR5-5600 4x1R: DDR5-3600 4x2R: DDR5-3600 PCIe Version PCIe 5.0 PCIe Lanes (Total/Usable) 28 / 24 USB 3.2 Gen 2 (10Gbps) 4 USB 2.0 1 Graphics Cores 2 CU RDNA 2 Frequency 2200 MHz DisplayPort over USB-C Yes Overclocking Unlocked Up next we have the tech specs for the MSI MAG X870 TOMAHAWK WIFI Motherboard: Specification Value Chipset AMD X870 CPU Support AMD Ryzen 9000 / 8000 / 7000 Series Desktop Processors Socket AM5 Memory Slots 4 × DDR5 UDIMM Maximum Memory Capacity 256GB Memory Support DDR5 8400–5600 MT/s (OC), DDR5 5600–4800 MT/s (JEDEC) Integrated Graphics Outputs 1 × HDMI 2.1 FRL (up to 8K 60Hz) 2 × USB4 Type-C with DisplayPort 1.4 HBR3 (up to 4K 60Hz) Expansion Slots PCI_E1: PCIe 5.0 x16 (CPU) PCI_E2: PCIe 3.0 x1 (Chipset) PCI_E3: PCIe 4.0 x4 (Chipset) Audio Realtek ALC4080 Codec 7.1-Channel USB High Performance Audio Supports up to 32-bit/384kHz playback on front panel S/PDIF output M.2 Slots 4 × M.2 M2_1: PCIe 5.0 x4 (CPU, 22110/2280) M2_2: PCIe 5.0 x4 (CPU, 2280/2260) M2_3: PCIe 4.0 x2 (Chipset, 2280/2260) M2_4: PCIe 4.0 x4 (Chipset, 2280/2260) SATA Ports 4 × SATA 6Gb/s RAID Support RAID 0, 1, 5, 10 for M.2 NVMe storage devices Rear USB Ports 4 × USB 2.0 3 × USB 5Gbps Type-A 2 × USB 10Gbps Type-A 1 × USB 10Gbps Type-C 2 × USB4 40Gbps Type-C Front USB Headers 4 × USB 2.0 4 × USB 5Gbps Type-A 1 × USB 20Gbps Type-C LAN Realtek 8126-CG 5G LAN Wireless Wi-Fi 7 (M.2 Key-E module pre-installed) Supports 2.4GHz / 5GHz / 6GHz bands Up to 5.8Gbps Supports 802.11 a/b/g/n/ac/ax/be Bluetooth Bluetooth 5.4, MLO, 4KQAM Internal Power Connectors 1 × 24-pin ATX Power 2 × CPU Power Connectors 1 × PCIe 8-pin Power Connector Fan Headers 1 × CPU Fan 1 × Combo Fan (Pump/System) 6 × System Fan RGB Headers 3 × Addressable V2 RGB (JARGB_V2) 1 × RGB LED (JRGB) Other Internal Headers 1 × EZ Conn-header 2 × Front Panel Headers 1 × Chassis Intrusion 1 × Front Audio 1 × TPM 2.0 Header Debug Features 4 × EZ Debug LEDs 1 × EZ Digit Debug LED Rear I/O Ports Clear CMOS Button Flash BIOS Button HDMI 2 × USB 40Gbps Type-C 1 × USB 10Gbps Type-C 4 × USB 10Gbps Type-A 3 × USB 5Gbps Type-A 4 × USB 2.0 5G LAN Port Wi-Fi/Bluetooth Antenna Connectors Audio Connectors Form Factor ATX The Samsung 990 PRO is a PCIe Gen4 NVMe SSD and still one of the fastest drives available today for under $500. Speaking of fast, sequential reads and writes are rated at 7450 MB/s and 6900 MB/s, respectively. The random throughputs for reads and writes are 1400K IOPS and 1550K IOPS, respectively. The 990 PRO is based on Samsung's 7th Gen V-NAND flash, and it too is TLC. It packs 2 gigs of LPDDR4 DRAM cache, which helps the random performance. The endurance rating for this is 1200 TBW (terabytes written), which should be sufficient for most users. The Samsung 990 PRO is compatible with the PlayStation 5, but if you are going to use the 990 PRO on a PC, check out the Samsung Magician app that lets you track your drive's health, update its firmware, customize various settings, and more. The tech specs are given below: Specification Value Interface PCIe Gen 4.0 x4, NVMe 2.0 Form Factor M.2 2280 Controller Samsung In-house Controller NAND Flash 3D TLC DRAM Cache 2GB LPDDR4 Sequential Read (Max) 7,450 MB/s Sequential Write (Max) 6,900 MB/s Random Read (4K) Up to 1,400,000 IOPS Random Write (4K) Up to 1,550,000 IOPS TBW (Endurance) 1,200 TBW MTBF 1,500,000 hours Operating Temperature 0°C to 70°C Storage Temperature -40°C to 85°C Shock Resistance 1,500G / 0.5ms Heatsink No Get the combo deal at this link: AMD Ryzen 7 9800X3D, Samsung 990 PRO 2TB, MSI MAG X870 TOMAHAWK WIFI motherboard, Cooler Master Elite Liquid 240: $784.99 + $25 off with promo code FTTF77: $759.99 (Sold and Shipped by Newegg US) Good to know This Newegg deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • I heard from a lot of people that driver support for the latest games when RDNA first came out (Radeon 5000 series) was pretty bad, but if you didn't buy the card on day one, or were not trying to play the latest titles, then you were isolated from that issue. Other than that, it's been good and only getting better.
    • Meta launches new AI glasses in 26 styles and Muse Spark multimodal capabilties by Pradeep Viswanathan Meta today announced a new line of Meta Glasses in partnership with EssilorLuxottica. The new AI glasses build on the company’s existing smart glasses portfolio, which is sold under the Ray-Ban Meta and Oakley Meta brands. The new Meta Glasses start at just $299, are compatible with prescription lenses, and will be available in 26 styles across different colors, lenses, and frames. At launch, Meta Glasses will be available in three frame styles. The Meta Adventurer features a clean rectangular design and comes in Standard and Large sizes. The Meta Fury is a bolder frame for users who want a stronger look. Meta Glasses by Kylie is a slim oval frame designed in collaboration with Kylie Jenner. Similar to existing Meta AI Glasses, the new Meta Glasses include a dedicated action button that can be used to quickly access Meta AI or launch a favorite feature. They also feature open-ear speakers for calls, music, and more. Meta has also included a multi-mic array with wind noise reduction for calls and messaging. Users can capture photos and videos hands-free using voice commands. Meta claims more than eight hours of battery life, while the portable charging case can provide up to 40 additional hours. As expected, Meta Glasses come pre-loaded with Meta AI powered by Muse Spark from day one. Muse Spark is the first model from Meta Superintelligence Labs with improved multimodal capabilities. The same Meta AI upgrade is also now available on existing Ray-Ban Meta and Oakley Meta Glasses in the US and Canada via an update. With the Muse Spark-powered AI assistant, Meta AI in the new glasses can provide smarter answers, understand what the user is seeing, and help with daily tasks such as calendar management and navigation. Meta also announced an upcoming feature called the dynamic photo feature, which captures multiple frames and recommends the best one. Pedestrian navigation is also coming soon to these glasses. Meta is also adding support for 14 new live translation languages, including Japanese, Mandarin Chinese, Hindi, and Korean. The new Meta Glasses are available starting today through Meta.com, Best Buy, Amazon, LensCrafters, Sunglass Hut, and select retailers.
    • is that a personal preference? whether it is or isn't, i get where you're coming from. i try to get and use fully open sourced applications whenever i can but there are instances where i find a superior product that is closed sourced. in these cases i do my best to learn about the company, who operates it, their background, parent and sub structure etc. to some extent, depending on "the smell test". i really believe that Syncback is really and truly something great. even if you don't use it, it's always worth a recommendation to someone else, especially if that someone else is not very computer literate. for someone of your calibre you, you'll manage just fine with Syncthing, no doubt about it.
  • Recent Achievements

    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
    • First Post
      mike_rumble earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      468
    2. 2
      +Edouard
      166
    3. 3
      PsYcHoKiLLa
      104
    4. 4
      Michael Scrip
      87
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!