Showing posts with label Malware Analysis. Show all posts
New Malware Allows Full Access to Mac Systems
Recently the internet security software company Bitdefender found that Apple computer systems, Mac OS X, faces a new threat that allows attackers to take full control of the system imperceptibly and collect all the sensitive information from the infected computers.
New Malware Allows Full Access to Mac Systems
Recently Bitdefender found a new malware that installs backdoors into the Mac operating system which grants attackers full access to Mac Systems. The malware has been called “Backdoor.MAC.Elanor” and has been discovered by researchers at Bitdefender security.
As we have already mentioned that we are dedicated to installing backdoors in the operating system so that the attackers may have full access, including user data or can take control of the webcam, execute arbitrary code and much more.
As a means of distribution used a false file conversion application known as EasyDoc Converter.app, which can be found in places widely used by Mac users when seeking applications to install, according to the Bitdefender security.
Initially, the researchers found it difficult to accurately determine the means by which infection occurs. Most likely, the backdoor is distributed via spam messages, but it can also get on the system through applications downloaded from untrusted sources. As explained by the experts, one of the loader components distributed via ZIP-file.
As the ZIP-file contains the executable file in the Mach-O format, which disguised as a text or JPEG-file. However, at the end of the expansion, there is a space, when you double click on the “ZIP-file” the file opens it in the Terminal, and not in TextEdit or Preview as regular files. Since the Finder file manager identifies the icon of the executable file as a JPEG or TXT, the user is unlikely to suspect that something was wrong and are likely to open it.
The backdoor, packed with a modified version of the UPX, seeking persistence on the system, setting PLIST-file in the “/Library/LaunchAgents/(if available superuser) or $ USER” and “/Library/ LaunchAgents/ (without root access)”. The Icloudsyncd executable file is stored in the “Library/Application Support/com.apple.iCloud.sync.daemon directory”.
However, the Mac have an increased security step known as “Gatekeeper”, which is located in the System Preferences under Security & Privacy. By default, it prevents running any unsigned applications from the unidentified sources or developers. So, if you download an unsigned application from any unidentified source then the Mac App Store will try to run it, but, ultimately you will get a message that “stating the application cannot be opened”. Hence, the Gatekeeper would have blocked the malware, if it is enabled.
Tag :
MAC OS,
Malware Analysis
6 Ways to Improve Your Organisation's Malware Defences
Malware is one of the most common types of security attack, so it's vital that your organisation takes steps to protect its sensitive data.
What is Malware?
Malware is malicious software that is unintentionally installed by a user and designed to attack your systems, devices or data. Once installed on one device, it can quickly spread through an organisation’s network, compromising value data in the process.
Thankfully, your organisation doesn't have to be powerless against the threat of malware.
1) Install Automated Anti-Malware Tools
Your organisation should start with the obvious (but very important) task of installing a comprehensive suite of automated anti-malware tools. This should include:
- Anti-virus
- Anti-spyware
- Personal firewalls
- WAFs (Web Application Firewalls) and WAMs (Web Anti Malware)
These anti-malware tools should be installed across all workstations, servers and mobile devices to protect the whole of your organisation’s network.
2) Choose Cloud-Based Software
Your anti-malware software is only as good as its ability to communicate with every machine on the system. When new malware signatures are identified, this new information needs to be sent to every machine on the network, quickly and efficiently.
The advantage of cloud-based software over locally-hosted software is that if one machine or server is compromised, it doesn’t impact upon your software’s ability to communicate with the rest of your system- allowing the new signature to be uploaded to the cloud, protecting the rest of your network from the threat.
3) Disable Auto-Run
Auto-run is malware’s enabler friend. Malware can enter through any number of points, like email attachments, web pages and removable media.
You should configure all of your organisation’s laptops, workstations and servers so that they don’t auto-run content from removable media like thumb drives, USB hard drives or CDs. This will close off one potential entry point.
Additionally, you should configure your systems so that they automatically perform an anti-malware scan of removable media when it’s inserted. This will protect against user actions, such as accidentally opening a compromised file.
4) Sandbox Email Attachments
Email sandboxing is a way of executing your email software and attachments in a contained environment, separate from your organisation’s IT infrastructure. This protects your organisation against malicious attachments and executables: the sandbox can be deleted, taking any malicious content with it
5) Develop an Incident Response Process
Your organisation needs to improve communication between your IT and security teams by developing and implementing a defined incident response process.
In the event of a security breach, IT need to supply your security team with examples of malware that has successfully bypassed their system, so that security can update and improve their anti-malware software.
6) Analyse the efficacy of Your Malware Defences
With new threats and vulnerabilities being identified all the time, it is important that your organisation is continually testing and evaluating its malware defences.
To analyse the efficacy of your malware defences, you need to measure the following:
- How long does it take the system to identify malicious software that is installed or executed on a computer system?
- How long does it take the system to send notifications to your security team that malicious code has been identified?
- Does the system have the ability to block installation, prevent execution, or quarantine malicious software?
- Does the system have the ability to identify where in the organisation the malicious software was identified?
- How long does it take the organisation to completely remove the malicious code after it has been identified?
When it comes to malware defences, you can’t just ‘set it and forget it’. New threats are being developed all the time, so you need to be continually improving your organisation’s security.
How to Avoid Malware Infection from a Phishing Email
One of the most common methods used to distribute malware is a phishing (fraudulent) email. Embedded in the email will be a “call to action” link, asking you to click here to learn more. The seemingly benign action of clicking on the link can start a destructive chain of events that culminates in compromising your computer, your identity, or even your business.
Here is a common scenario. You receive an email announcing a big sale at a national retailer. The email entices you to click on a link to get your exclusive 50% off coupon. The link looks like this: http://www.national-retailer.com/coupon.
You click the link and the coupon appears on your screen. End of story? Not necessarily. What a link says it is and what a link is programmed to do can be vastly different. That same link could just as easily be taking you to http://www.verybadguy.ru/malware.exe, where malicious code is programmed to download and execute on your computer. This type of redirection doesn’t require any programming skill. It is built into any application that uses hyperlinks.
So what should you do? DON’T CLICK! Instead, open your browser and type or paste in a known good URL. Not clicking is a fool-proof way to avoid malware infection from a phishing email.
