Vulnerabilities / Threats
7/26/2011
01:21 PM
50%
50%

Apple OS X Targeted By Remote Backdoor Malware

Researchers say a remote-controlled Trojan application, known as the Olyx backdoor, is going after OS X devices.

Apple WWDC Visual Tour: First Look At iCloud, Lion, iOS 5, And More
Slideshow: Apple WWDC Visual Tour: First Look At iCloud, Lion, iOS 5, And More
(click image for larger view and for slideshow)
Apple has recently released a slew of product updates, some timed to coincide with the release of its new OS X 10.7 Lion operating system. But illustrating the rapid pace at which malware evolves, on Monday, security researchers began reporting seeing a new, remote-controlled Trojan application now targeting Apple OS X.

The malware, known as the Olyx backdoor, resembles GhostNet, first seen in 2009, which targeted older versions of Windows. The new version, however, contains a malicious executable which is decidedly Mac-focused. It also includes a signed digital certificate to help it evade defenses.

Using the digital certificate, the malware "installs and runs in the background without root or administrator privileges," according to a blog post from Meths Ferrer at the Microsoft Malware Protection Center.

The application disguises itself as a Google application support file, then remains dormant until the infected user logs in. At that point, "the backdoor initiates a remote connection request to IP address 121.254.173.57, where it continues to make attempts until established," said Ferrer. Then, once the malware connects, "the remote attacker may take advantage of the backdoor file management feature which allows it to upload, download, and navigate through files and [directories]." But he said the valid digital certificate used by Olyx has now been revoked, which should neuter the attack.

Despite the emergence of the new, remote-controlled Olyx backdoor, malware that targets Apple OS X remains rare, despite a small spike in May, when security experts reported seeing the first-ever Apple crimeware pack appear. That same month, fake antivirus software known as "MACDefender" appeared, also targeting Apple OS X users. Ultimately, Apple hardcoded a patch into its operating system to block the fake AV software.

In other Apple patching news, last week the company released a massive Apple OS X security update, fixing 57 vulnerabilities in Safari, 46 of which might lead to remote code execution.

"The sheer number of vulnerabilities being patched in Safari is mind boggling," said Andrew Storms, director of security operations for nCircle, via email. "Microsoft and Oracle definitely release ... big patches, but the fixes they ship generally apply to many different applications and operating systems. This is a vast number of bugs for just Safari alone. There are so many code execution bugs alone I've gone cross-eyed."

Last week, Apple also released an iOS patch for iPhone, iPad, and iPod Touch devices, addressing a zero-day PDF vulnerability that could be used to remotely jailbreak the devices.

But that update was superseded by the new iOS 4.3.5 update, released on Monday. According to a blog post from Chester Wisniewski, a senior security advisor at Sophos Canada, "this update fixes a flaw in X.509 certificate handling and could allow attackers to intercept SSL/TLS secure connections from iDevices."

As with all iOS updates, the fix can be downloaded only from within iTunes.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.