Four months after its debut, sneaky Mac malware went undetected by AV providers

guest · Dec 21, 2018

Four months after its debut, sneaky Mac malware went undetected by AV providers
December 21, 2018
https://arstechnica.com/information...-mac-malware-went-undetected-by-av-providers/

Windshift is what researchers refer to as an APT—short for "advanced persistent threat"—that surveils individuals in the Middle East. The group operated in the shadows for two years until August, when Taha Karim, a researcher at security firm DarkMatter, profiled it at the Hack in the Box conference in Singapore. Slides, a brief description, and a report from Forbes are here, here and here, respectively.

On Thursday, Mac security expert Patrick Wardle published an analysis of Meeting_Agenda.zip, a file Karim had said installed the rare Mac malware. To Wardle's surprise, results from VirusTotal at the time showed that only two antivirus providers—Kaspersky and ZoneAlarm—detected the file as malicious.

The reason the findings were so surprising is that Apple had already revoked the cryptographic certificate the developers used to digitally sign their malware. That meant Apple knew of the malware.
Wardle wrote:

[...] Does this mean Apple isn't sharing valuable malware/threat-intel with AV-community, preventing the creation of widespread AV signatures that can protect end-users?!
Click to expand...

"In the Trails of Windshift APT" (PDF): https://gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%20of%20WINDSHIFT%20APT%20-%20Taha%20Karim.pdf

The Hammer · Dec 24, 2018

Here's the link to the article.apple-isnt-sharing-malware-definitions-with-third-party-antivirus-firms-new-analysis-suggests

Log in or Sign up

Four months after its debut, sneaky Mac malware went undetected by AV providers

guest Guest

The Hammer Registered Member

Log in or Sign up

Four months after its debut, sneaky Mac malware went undetected by AV providers

guest Guest

The Hammer Registered Member

Useful Searches