Repurposing Mac Malware Not Difficult, Researcher Shows

guest · Aug 9, 2019

Repurposing Mac Malware Not Difficult, Researcher Shows
August 9, 2019
https://www.securityweek.com/repurposing-mac-malware-not-difficult-researcher-shows

The research was conducted by Patrick Wardle, Mac security expert and principal researcher at Apple device management platform provider Jamf. Jamf acquired Digita Security, a macOS security company co-founded by Wardle, last month.
Wardle told SecurityWeek that one of the goals of his research is to show that its rather trivial and far less time-consuming to repurpose malware than to develop a completely new piece of malware.

Wardle has also demonstrated several techniques for making minor modifications to known Mac malware so that they are no longer detected by signature-based security solutions, such as Apple’s XProtect and Malware Removal Tool (MRT).

The bypass methods analyzed and successfully executed by Wardle include changing a single byte in the malicious file, unsigning and resigning components to bypass certificate revocation mechanisms, and simply renaming components.
The solution to detecting these types of threats, Wardle says, is focusing on potentially malicious behavior rather than signatures.
Click to expand...

Rasheed187 · Aug 10, 2019

Completely agree, you should never rely on signature-based security solutions. And cool that you can download Mac malware via the Objective-See site, always handy to test your defenses.

https://objective-see.com/malware.html

guest · Mar 1, 2020

Former NSA hacker repackages in-the-wild Mac malware for his own use
February 28, 2020
https://arstechnica.com/information...-when-you-can-rip-off-a-competitors-a-how-to/

Patrick Wardle, who is now a security researcher at the macOS and iOS enterprise management firm Jamf, showed how reusing old Mac malware can be a smarter and less resource-intensive approach for deploying ransomware, remote access spy tools, and other types of malicious code. Where the approach really pays dividends, he said, is with the repurposing of advanced code written by government-sponsored hackers.

“There are incredibly well-funded, well-resourced, very motivated hacker groups in three-letter agencies that are creating amazing malware that’s fully featured and also fully tested,” Wardle said during a talk titled "Repurposed Malware: A Dark Side of Recycling."
Hijacking the hijackers
To prove the point, Wardle described how he altered four pieces of Mac malware that have been used in in-the-wild attacks over the past several years.

Wardle was able to make other tweaks to his repurposed pieces of code so they would bypass malware mitigations built in to macOS.
Click to expand...

The examples of recycled malicious code mentioned earlier should make clear that this kind of recycling works against any operating system or platform.
Click to expand...

"Repurposed Malware: A Dark Side of Recycling" (PDF - 27.7 MB):

https://published-prd.lanyonevents.com/published/rsaus20/sessionsFiles/17809/2020_USA20_HT-T11_01_Repurposed-Malware-A-Dark-Side-of-Recycling.pdf

Log in or Sign up

Repurposing Mac Malware Not Difficult, Researcher Shows

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Repurposing Mac Malware Not Difficult, Researcher Shows

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches