Connect with us

Biz & IT

The accidental notary: Apple approves notorious malware to run on Macs

Published

on

Enlarge / A replica of the Trojan horse made up of thousands of computer and mobile phone components infected with various viruses and malware, named the “Cyber Horse” is displayed at the entrance to the annual Cyber Week conference at the Tel Aviv University in the Israeli city of Tel Aviv on June 20, 2016.
The Cyber Horse is a piece of art composed of devices that can be harmed by malware and was created in order to prompt national and international awareness of the dangers of cyber-attacks.

JACK GUEZ/AFP via Getty Images

When might an Apple malware protection pose more user risk than none at all? When it certifies a trojan as safe even though it sticks out like a sore thumb and represents one of the biggest threats on the macOS platform.

The world received this object lesson over the weekend after Apple gave its imprimatur to the latest samples of “Shlayer,” the name given to a trojan that has been among the most—if not the most—prolific pieces of Mac malware for more than two years. The seal of approval came in the form of a notarization mechanism Apple introduced in macOS Mojave to, as Apple put it, “give users more confidence” that the app they install “has been checked by Apple for malicious components.”

With the roll out of macOS Catalina, notarization became a requirement for all apps. Unless installed using methods not mentioned by Apple (more about that later), an unnotarized app will generate the following notice that says it “can’t be opened because Apple cannot check it for malicious software.”

Classic Shlayer… with one big difference

On Friday, college student Peter H. Dantini found that homebrew[.]sh—a knockoff of the legitimate homebrew site brew.sh—was pushing a fake Adobe Flash update and warning users that their current version lacked the latest security updates.

It was a classic Shlayer campaign that was similar to hundreds or thousands of previous ones that also used fake Flash updates to infect users with adware except for one key difference: the trojan had been notarized by Apple. Patrick Wardle, who is a security researcher at the macOS and iOS enterprise management firm Jamf, said he believes this is the first malware to receive the notarization “stamp of approval.”

Wardle notified Apple on Friday of the erroneously notarized file, and the company quickly revoked the certification, a move that prevented the trojan from infecting up-to-date Macs. On Sunday, Wardle said, he found the site was serving new malicious payloads that were, once again, notarized by Apple.

“Unfortunately, a system that promises trust, yet fails to deliver, may ultimately put users at more risk,” Wardle wrote in a post. “How so? If Mac users buy into Apple’s claims, they are likely to fully trust any and all notarized software. This is extremely problematic as known malicious software (such as OSX.Shlayer) is already (trivially?) gaining such notarization!”

Antivirus provider Malwarebytes also weighed in, saying: “Unfortunately, it’s starting to look like notarization may be less security and more security theater.”

In defense of notarization

In a statement, Apple officials wrote: “Malicious software constantly changes, and Apple’s notarization system helps us keep malware off the Mac and allows us to respond quickly when it’s discovered. Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe.”

In Apple’s defense, the company has always been clear that the notarization is “an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly.” As such, Apple has never presented it as a comprehensive security check.

And even when notarization prevents an app from being installed normally, it’s not that hard to work around the mechanism. As shown in the screenshot below, courtesy of Malwarebytes, unnotarized versions of Shlayer have long presented marks with a custom background that instructed them to right-click on a disk image file, rather than double-click it as normal, and then select open.

Malwarebytes

With that the malware is installed.

Toothless… and a pain to use

At the same time, and as noted last year by Andrew Cunningham, now a freelance reviewer for Ars, notarization is a burden both for users and developers. Presumably Apple mandated it to augment previously introduced code-signing protections, which require developers to authenticate their apps with an Apple-issued cryptographic certificate. If the service made users safer, you might have a good case for saying that the inconvenience is worth it. It’s harder to make that argument if the new feature gives users a false sense of security.

Notarization looks especially toothless when it fails to detect this particular malware family. As Kaspersky Lab reported in January, Shlayer has been the top macOS threat for about two years and accounted for about 30 percent of all detections on the OS for 2019. Shlayer also goes well beyond the nuisance of adware. For instance, after using click-jacking techniques to trick users into installing a self-signed cryptographic certificate, the malware decrypts and reads all encrypted HTTPS traffic. It also harvests user IDs.

Apple’s goof is even harder to understand when it falls for files like those found on Friday and again on Sunday.

“It was a fake Flash player update… with the Adobe icon and all… that of course was not signed by Adobe,” Wardle told me in an online chat. “You’d have thought that’s a big red flag that Apple would straight up just block anyways like, umm, anything that masquerades as ‘Flash’ update …yah, no, don’t notarize that, as who cares what it does (i.e. what malware/adware it is), obv. it’s fake/malicious.”

Continue Reading

Biz & IT

Twitter deal leaves Elon Musk with no easy way out

Published

on

Enlarge / This illustration photo taken May 13, 2022, displays Elon Musks Twitter account with a Twitter logo in the background in Los Angeles. – Elon Musk sent mixed messages Friday about his proposed Twitter acquisition, pressuring shares of the microblogging platform amid skepticism on whether the deal will close.
In an early morning tweet, Musk said the $44 billion takeover was “temporarily on hold,” pending questions over the social media company’s estimates of the number of fake accounts or “bots.”
That sent Twitter’s stock plunging 25 percent. (Photo by Chris DELMAS / AFP) (Photo by CHRIS DELMAS/AFP via Getty Images)

Since the financial crisis, corporate lawyers have aspired to build the ultimate ironclad merger contract that keeps buyers with cold feet from backing out.

The “bulletproof” modern deal agreement now faces one of its biggest tests, as Elon Musk, the Tesla boss and richest person in the world, openly entertains the possibility of ditching his $44 billion deal for Twitter.

Musk said in a tweet this week that the “deal cannot move forward” until the social media platform provides detailed data about fake accounts, a request that Twitter seems unlikely to meet. Twitter’s board, meanwhile, has stated its commitment “to completing the transaction on the agreed price and terms as promptly as practicable.”

Simply abandoning the deal is not an option. Musk and Twitter have both signed the merger agreement, which states that “the parties… will use their respective reasonable best efforts to consummate and make effective the transactions contemplated by this agreement.”

With tech stocks falling—dragging down the price of the Tesla shares that form the basis of Musk’s fortune and collateral for a margin loan to buy Twitter—all eyes are on the mercurial billionaire’s next move.

Could Musk walk away for $1 billion?

The agreement includes a $1 billion “reverse termination fee” that Musk would owe if he withdrew from the merger agreement. However, if all other closing conditions are met and the only thing left is for Musk to show up at the closing with his $27.25 billion in equity, Twitter can seek to make Musk close the deal. This legal concept, known as “specific performance,” has become a common feature in leveraged buyouts since the financial crisis.

In 2007 and 2008, leveraged buyouts typically included a reverse termination fee that often allowed a company backing the acquisition to pay a modest 2 to 3 percent of a deal’s value to get out. Sellers believed at the time that private equity groups would follow through and close their transactions in order to maintain their reputations. But some did pull the plug on those agreements, leading to several court fights involving prominent companies such as Cerberus, Blackstone, and Apollo.

Since that era, sellers have implemented much higher termination fees as well as specific performance clauses that effectively require buyers to close. Most recently, a Delaware court in 2021 ordered private equity group Kohlberg & Co to close the buyout of a cake decorations business called DecoPac.

Kohlberg had argued it was allowed out of the deal because the DecoPac business had suffered a “material adverse effect” when the pandemic struck between signing and closing. The court rejected that argument and ruled that DecoPac could force Kohlberg to close—which it did.

Continue Reading

Biz & IT

How we learned to break down barriers to machine learning

Published

on

Dr. Sephus discusses breaking down barriers to machine learning at Ars Frontiers 2022. Click here for transcript.

Welcome to the week after Ars Frontiers! This article is the first in a short series of pieces that will recap each of the day’s talks for the benefit of those who weren’t able to travel to DC for our first conference. We’ll be running one of these every few days for the next couple of weeks, and each one will include an embedded video of the talk (along with a transcript).

For today’s recap, we’re going over our talk with Amazon Web Services tech evangelist Dr. Nashlie Sephus. Our discussion was titled “Breaking Barriers to Machine Learning.”

What barriers?

Dr. Sephus came to AWS via a roundabout path, growing up in Mississippi before eventually joining a tech startup called Partpic. Partpic was an artificial intelligence and machine-learning (AI/ML) company with a neat premise: Users could take photographs of tooling and parts, and the Partpic app would algorithmically analyze the pictures, identify the part, and provide information on what the part was and where to buy more of it. Partpic was acquired by Amazon in 2016, and Dr. Sephus took her machine-learning skills to AWS.

When asked, she identified access as the biggest barrier to the greater use of AI/ML—in a lot of ways, it’s another wrinkle in the old problem of the digital divide. A core component of being able to utilize most common AI/ML tools is having reliable and fast Internet access, and drawing on experience from her background, Dr. Sephus pointed out that a lack of access to technology in primary schools in poorer areas of the country sets kids on a path away from being able to use the kinds of tools we’re talking about.

Furthermore, lack of early access leads to resistance to technology later in life. “You’re talking about a concept that a lot of people think is pretty intimidating,” she explained. “A lot of people are scared. They feel threatened by the technology.”

Un-dividing things

One way of tackling the divide here, in addition to simply increasing access, is changing the way that technologists communicate about complex topics like AI/ML to regular folks. “I understand that, as technologists, a lot of times we just like to build cool stuff, right?” Dr. Sephus said. “We’re not thinking about the longer-term impact, but that’s why it’s so important to have that diversity of thought at the table and those different perspectives.”

Dr. Sephus said that AWS has been hiring sociologists and psychologists to join its tech teams to figure out ways to tackle the digital divide by meeting people where they are rather than forcing them to come to the technology.

Simply reframing complex AI/ML topics in terms of everyday actions can remove barriers. Dr. Sephus explained that one way of doing this is to point out that almost everyone has a cell phone, and when you’re talking to your phone or using facial recognition to unlock it, or when you’re getting recommendations for a movie or for the next song to listen to—these things are all examples of interacting with machine learning. Not everyone groks that, especially technological laypersons, and showing people that these things are driven by AI/ML can be revelatory.

“Meeting them where they are, showing them how these technologies affect them in their everyday lives, and having programming out there in a way that’s very approachable—I think that’s something we should focus on,” she said.

Continue Reading

Biz & IT

2 vulnerabilities with 9.8 severity ratings are under exploit. A 3rd looms

Published

on

Getty Images

Malicious hackers, some believed to be state-backed, are actively exploiting two unrelated vulnerabilities—both with severity ratings of 9.8 out of a possible 10—in hopes of infecting sensitive enterprise networks with backdoors, botnet software, and other forms of malware.

The ongoing attacks target unpatched versions of multiple product lines from VMware and of BIG-IP software from F5, security researchers said. Both vulnerabilities give attackers the ability to remotely execute malicious code or commands that run with unfettered root system privileges. The largely uncoordinated exploits appear to be malicious, as opposed to benign scans that attempt to identify vulnerable servers and quantify their number.

First up: VMware

On April 6, VMware disclosed and patched a remote code execution vulnerability tracked as CVE-2022-22954 and a privilege escalation flaw tracked as CVE-2022-22960. According to an advisory published on Wednesday by the Cybersecurity and Infrastructure Security Agency, “malicious cyber actors were able to reverse engineer the updates to develop an exploit within 48 hours and quickly began exploiting the disclosed vulnerabilities in unpatched devices.”

CISA said the actors were likely part of an advanced persistent threat, a term for sophisticated and well-financed hacker groups typically backed by a nation-state. Once the hackers have compromised a device, they use their root access to install a webshell known as Dingo J-spy on the networks of at least three organizations.

“According to trusted third-party reporting, threat actors may chain these vulnerabilities. At one compromised organization, on or around April 12, 2022, an unauthenticated actor with network access to the web interface leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user,” Wednesday’s advisory stated. “The actor then exploited CVE-2022-22960 to escalate the user’s privileges to root. With root access, the actor could wipe logs, escalate permissions, and move laterally to other systems.”

Independent security researcher Troy Mursch said in a direct message that exploits he’s captured in a honeypot have included payloads for botnet software, webshells, and cryptominers. CISA’s advisory came the same day VMware disclosed and patched two new vulnerabilities. One of the vulnerabilities, CVE-2022-22972, also carries a severity rating of—you guessed it—9.8. The other one, CVE-2022-22973, is rated 7.8.

Given the exploits already underway for the VMware vulnerabilities fixed last month, CISA said it “expects malicious cyber actors to quickly develop a capability to exploit newly released vulnerabilities CVE-2022-22972 and CVE-2022-22973 in the same impacted VMware products.

BIG-IP also under fire

Meanwhile, enterprise networks are also under attack from hackers exploiting CVE-2022-1388, an unrelated vulnerability with a 9.8 severity rating found in BIG-IP, a software package from F5. Nine days ago, the company disclosed and patched the vulnerability, which hackers can exploit to execute commands that run with root system privileges. The scope and magnitude of the vulnerability prompted marvel and shock in some security circles and earned it a high severity rating.

Within a few days, exploit code became publicly available and almost immediately after that, researchers reported ​​exploit attempts. It wasn’t clear then if blackhats or whitehats carried out the activity.

In more recent days, however, researchers captured thousands of malicious requests that demonstrate a significant portion of the exploits are used for nefarious purposes. In an email, researchers from security firm Greynoise wrote:

Given that the requests involving this exploit require a POST request and result in an unauthenticated command shell on the F5 Big-IP device, we have classified actors using this exploit as malicious. We have observed actors using this exploit through anonymity services such as VPNs or TOR exit nodes in addition to known internet VPS providers.

We expect actors attempting to find vulnerable devices to utilize non-invasive techniques that do not involve a POST request or result in a command shell, which are catalogued in our tag for F5 Big-IP crawlers: https://viz.greynoise.io/tag/f5-big-ip-crawler. This crawler tag did experience a rise in traffic correlated with the release of CVE-2022-1388.

Mursch said that the BIG-IP exploits attempt to install the same trio of webshells, malware for performing distributed denial-of-service attacks, and cryptominers seen in the attacks on unpatched VMware machines. The image below, for instance, shows an attack that attempts to install widely recognized DDoS malware.

Troy Mursch

The following three images show hackers exploiting the vulnerability to execute commands that fish for encryption keys and other types of sensitive data stored on a compromised server.

Troy Mursch

Troy Mursch

Troy Mursch

Given the threat posed by ransomware and nation-state hacking campaigns like the ones used against customers of SolarWinds and Microsoft, the potential damage from these vulnerabilities is substantial. Administrators should prioritize investigating these vulnerabilities on their networks and act accordingly. Advice and guidance from CISA, VMware, and F5 are here,
here, here, and here.

Continue Reading

Trending