Apple security expert Patrick Wardle found that some macOS malware written for the new M1 processor can bypass anti-malware tools.

It was only a matter of time. Apple Macs are growing in popularity in the enterprise - as is the number of malware variants targeting macOS. But the much-anticipated arrival of Apple's new system-on-a-chip, the M1, has spawned a new generation of macOS-specific malware that anti-malware tools, threat hunters, and researchers must quickly learn to spot and, ultimately, thwart.

Most macOs malware traditionally has been repurposed from Windows malware variants. But the pandemic's pivot to work-from-home sent more Macs to the enterprise as employees set up home offices (some with home Mac devices), making them a more lucrative target for attackers going after businesses.

Mac security expert Patrick Wardle has already seen increasing numbers of malware variants written specifically for the M1 platform, Apple's new ARM64-based microprocessor. M1 boasts faster and more efficient processing, graphics, longer battery life, and is now running in its new generation of Macs and the iPad Pro. It also comes with some new baked-in security features, including one that helps protect the machine from remote exploitation, as well as physical access protection.

Even so, Wardle found that new macOs malware can slip by many anti-malware tools. He will demonstrate next month in a talk at Black Hat USA in Las Vegas some techniques for threat hunters and researchers to spot these new malware variants, including understanding native M1 code and reverse-engineering code written for the processor.

"It's no surprise" malware is arriving that targets Apple's M1 systems, says Wardle, the founder of Objective-See, whose career includes stints at the National Security Agency and NASA. "As attackers evolve and change their ways, we as malware analysts and security researchers need to stay abreast of that as well."

Wardle will share what he learned from reverse-engineering and studying M1-specific malware samples: "How we can hunt it and protect systems from it, and how we can reverse-engineer and analyze it," he says.

A recent Malwarebytes report shows Windows malware detections dropping 24% among business users, while increasing 31% for Mac business users. 

About half of all macOS malware in 2020 were variants that started on Windows or Linux and had been ported to macOS, including nation-state attack code and adware, the most pervasive Mac threat to date, Wardle notes.

Wardle found in his research that when he split out the binaries for macOS malware, one built for the Intel-based Mac platform and the other for the M1-based platform, anti-malware systems more successfully detected the malware aimed at the Intel platform than the macOS malware aimed at the M1 platform - even though the binaries are "logically the same," he says. There was a 10% drop in their detection rate for the M1 malware.

That's a sign that existing antivirus signatures tend to be created only for the Intel variant of the macOS malware, not the M1 variant, he notes. Detections instead should also blend in behavior-based technology since static analysis alone can fail.

For malware analysts and threat hunters, it's a matter of honing their skills to the new Apple silicon, he says. 

"I want to empower Mac analysts, red teams, and anyone in cybersecurity," he says, with reverse-engineering skills and an understanding of the ARM64 instruction set.

Also important, Wardle says, is understanding that "the M1 system actually does significantly improve security at the hardware level, but it's transparent to the everyday user," Wardle says. And baking security features into hardware is "the best place," he says.

Even so, there's a learning curve to detect, analyze, and block the new M1-targeted malware, as well as the repurposed variants out there. 

"Just make sure your security posture has parity between Windows and macOS. MacOS is just as vulnerable in the same arena: Don't assume Macs are more secure," he warns.

Read more about:

Black Hat News

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights