First Apple Silicon M1 malware discovered in the wild

[wall03]

Summary

The first malware native to Apple Silicon M1 Macs has been discovered by independent security researcher Patrick Wardle.

 

Quotes

Quote

Ex-NSA researcher Patrick Wardle has recently praised Apple for the security of its M1 processor, but even so has now discovered evidence of hackers recompiling malware for it.

 

Wardle discovered the existence of GoSearch22.app, an M1-native version of the longstanding Pirrit virus. This version appears to have been aimed at displaying ads and collecting data from the user's browser.

 

"Today we confirmed that malicious adversaries are indeed crafting multi-architecture applications, so that their code will natively run on M1 systems," says Wardle in a blog post. "The malicious GoSearch22 application may be the first example of such natively M1 compatible code."

Quote

Wardle notes that the adware – a type of malware that generates revenue by spamming users with pop-ups and adverts – was signed with an Apple developer ID, a paid account that allows Apple to keep track of all Mac and iOS developers, on November 23. 

Having a developer ID also means Having a user downloading the malware wouldn’t trigger Gatekeeper on macOS, which notifies users when an application they’re about to download may not be safe. 

 

What’s more, Wardle says that a number of current antivirus systems that could spot the Intel versions of the Pirrit virus failed to identify the M1 version.

 

“Certain defensive tools like antivirus engines struggle to process this 'new' binary file format,” Wardle says. “They can easily detect the Intel-x86 version, but failed to detect the ARM-M1 version, even though the code is logically identical.”

 

Apple has yet to respond to Wardle's findings, but the the company has revoked the GoSearch22 certificate.

 

Thankfully, for the few that already own an Apple Silicon Mac, the GoSearch22 threat doesn’t seem too dangerous. However, it's undoubtedly a sign that more M1-native malware is on the horizon.

 

 

My thoughts

Well... you can't expect a platform to be virus-free for too long. 90 days is a while though. Also: "mAcs dOnT nEEd anTiVIruSes"

 

Sources

First Apple Silicon M1 malware discovered in the wild | AppleInsider

The first M1 MacBook malware has arrived – here's what you need to know | TechRadar

Edited February 17, 2021 by wall03
edit 1 - formatting | edit 2 - added moah thoughts | edit 3 - added moah sources and info

[WhitetailAni]

Queue "Macs don't need antivirus!"

[JamesTheFolf]

1 minute ago, wall03 said:

Summary

The first malware native to Apple Silicon M1 Macs has been discovered by independent security researcher Patrick Wardle.

 

Quotes

 

My thoughts

Welp... you can't expect a platform to be virus-free for too long. 90 days is a while though.

 

Sources

First Apple Silicon M1 malware discovered in the wild | AppleInsider

Well hopefully it is possible to patch the vulnerability

[ProjectBox153]

1 minute ago, FakeKGB said:

Queue "Macs don't need antivirus!"

In all honesty, they don't in a lot of cases. 

[TempestCatto]

[Dabombinable]

At the end of the day it is still ARM...and just look at the Android and iOS viruses. I'd say Windows as well...but RT is kind of secure through sheer obscurity.

[lafrente]

As long as there are paid antivirus softwares, there will be viruses. Unfortunately it's not the other way round.

[RejZoR]

Being M1 has absolutely nothing to do with malware. M1 doesn't make itself more secure against what's essentially a software like any other program. We're not talking about vulnerability or exploit here, simply malware. They just made it run native on ARM Macs. Boo hoo.

[RejZoR]

1 minute ago, lafrente said:

As long as there are paid antivirus softwares, there will be viruses. Unfortunately it's not the other way round.

No, you have this so backwards it reeks of conspiracy theories. Antiviruses exist because malware writers see it as a profitable venture by stealing banking details or hold user data for ransom. This stupid conspiracies that antivirus companies write viruses just so they sell antivirus software is the dumbest I've ever heard. There is no need for them to write malware when there are so many bad actors already doing that.

[lafrente]

16 minutes ago, RejZoR said:

No, you have this so backwards it reeks of conspiracy theories. Antiviruses exist because malware writers see it as a profitable venture by stealing banking details or hold user data for ransom. This stupid conspiracies that antivirus companies write viruses just so they sell antivirus software is the dumbest I've ever heard. There is no need for them to write malware when there are so many bad actors already doing that.

You're definitely making a lot of noise for someone who says nothing. Ding ding, boy. Antivirus companies made $40bil last year. That's about Russia's annual military budget. 

[Bombastinator]

47 minutes ago, FakeKGB said:

Queue "Macs don't need antivirus!"

Half truths are a specialty of good lie tellers.  It’s a sort of half truth.  The trick is how you define the word “virus”

[TetraSky]

Malwares are like cockroaches, if you find one, it means there's dozen (hundred) more that are hidden.

 

Honestly, not surprised there's malware already. I am surprised it took this long for them to find the "first one" though.

[Dabombinable]

6 minutes ago, lafrente said:

You're definitely making a lot of noise for someone who says nothing. Ding ding, boy. Antivirus companies made $40bil last year. That's about Russia's annual military budget. 

It isn't a case of "which came first, the chicken or the egg". Anti virus software only exists because of viruses.

[RejZoR]

11 minutes ago, lafrente said:

You're definitely making a lot of noise for someone who says nothing. Ding ding, boy. Antivirus companies made $40bil last year. That's about Russia's annual military budget. 

I've been reading these conspiracy theories for decades. Sorry dude, bad actors make new malware in 5 digits on weekly basis pretty much. Last thing antivirus companies have time to is write more malware themselves for some reason. It's entirely nonsensical.

 

So, antivirus companies make profit. Guess who makes even more profit. Malware writers. The money stolen or lost through data stealing and ransomware i far beyond that. So, why not tap into that? If there is demand, they'll provide it. It's capitalism. What's next, you're gonna accuse pharmacies of creating all these medical problems or you'll agree they just exist and they just happily provide solutions for it and simply charge for it?

[lafrente]

5 minutes ago, RejZoR said:

The money stolen or lost through data stealing and ransomware i far beyond that. So, why not tap into that? If there is demand, they'll provide it. It's capitalism. What's next, you're gonna accuse pharmacies of creating all these medical problems or you'll agree they just exist and they just happily provide solutions for it and simply charge for it?

"Far beyond" is a pretty vague claim, any actual numbers other than "far beyond, too much, very big"? 

 

You're talking about capitalism yet you got no clue how it works. If a pharmacy company has an option to 

 

A- Cure cancer with a single pill

B- Treat it for 25 years

 

It WILL always choose the option B. That's not a conspiracy theory, that's a fact.

[BuckGup]

1 hour ago, FakeKGB said:

Queue "Macs don't need antivirus!"

I'd still take 1 over > 100,000

[lewdicrous]

Baby's first malware

 

This is still a new platform, more will come in the future.

[Brooksie359]

38 minutes ago, lafrente said:

"Far beyond" is a pretty vague claim, any actual numbers other than "far beyond, too much, very big"? 

 

You're talking about capitalism yet you got no clue how it works. If a pharmacy company has an option to 

 

A- Cure cancer with a single pill

B- Treat it for 25 years

 

It WILL always choose the option B. That's not a conspiracy theory, that's a fact.

Not necessarily the case. If you can treat cancer with one pill undoubtedly the cost of the pill is cheaper than 25 years of long term care for the pharmaceutical companies. Sure you may have constant revenue from that 25 years of treatment but the cost the pharmaceutical company has to pay for those 25 years isn't trivial and often times the end customer ends up in debt in which case they may not get the money back in a timely manner. That compared to producing a single pill that is likely low cost and selling it for an absurd amount of money i think most would choose the single pill and just profit off of that alot more. That and undoubtedly the pharmaceutical company has family members with cancer. I would highly doubt if there was an easy solution that they wouldn't provide it for those family members. On top of that there are tons of organizations that do cancer research that aren't profit driven like pharmaceutical companies so I think you might be a bit too suspicious of everyone. 

[lafrente]

8 minutes ago, Brooksie359 said:

Not necessarily the case. If you can treat cancer with one pill undoubtedly the cost of the pill is cheaper than 25 years of long term care for the pharmaceutical companies. Sure you may have constant revenue from that 25 years of treatment but the cost the pharmaceutical company has to pay for those 25 years isn't trivial and often times the end customer ends up in debt in which case they may not get the money back in a timely manner. That compared to producing a single pill that is likely low cost and selling it for an absurd amount of money i think most would choose the single pill and just profit off of that alot more. That and undoubtedly the pharmaceutical company has family members with cancer. I would highly doubt if there was an easy solution that they wouldn't provide it for those family members. On top of that there are tons of organizations that do cancer research that aren't profit driven like pharmaceutical companies so I think you might be a bit too suspicious of everyone. 

So yeah, you have no idea how it works. You're just writing whatever comes to your mind & trying to support it by your own entirely wrong assumptions.

[captain_to_fire]

4 hours ago, FakeKGB said:

Queue "Macs don't need antivirus!"

The thing is, antivirus programs is a double edged sword. Contrary to what antivirus vendors attempts to downplay the issue, running an antivirus is actually opening a whole can of worms as it runs on Ring 0, hence it can read and write to the kernel and that alone is a perfect candidate for attacks. Not to mention, antivirus programs pose a privacy risk as many of them act as a man in the middle to intercept all traffic.

 

Antivirus programs regardless of the vendor and their alleged "next-gen technologies" such as heuristics and behavior monitoring, is only as good as its signatures. Even with their "next-gen technologies", antivirus programs are a hit or miss when it comes to zero day malware and targeted attacks.

 

4 hours ago, wall03 said:

Also: "mAcs dOnT nEEd anTiVIruSes"

Macs do come with a built in antivirus, it's called XProtect, just like Windows 10.

[Brooksie359]

5 hours ago, lafrente said:

So yeah, you have no idea how it works. You're just writing whatever comes to your mind & trying to support it by your own entirely wrong assumptions.

These are not assumptions. Look it up and you will see tons of research in the field of cancer treatment done by nonprofits so no you are simply wrong. As far as cancer goes if there was a simple pill that could cure it you would bet the pharmaceutical companies who found a way to do that would profit off of that rather than go for a prolonged treatment plan that doesn't even primarily profit the pharmaceutical companies as much as the hospitals and staff administrating the treatment. Another sad point that doesn't really go along with your theory is that most cancer patients won't last 25 years so it really isn't worth it when so many patients die fairly quickly. If you catch it early then your treatment is short and you can get rid of it but if you catch it late you are pretty screwed. Not to mention the fact that most cancer treatment actually kills the person along with the cancer so it is counterintuitive to the point you made. Put simply your theory is bad and its not assumptions that point to that. 

[Chiyawa]

Every system has it's vulnerability. It's only a matter of time for someone to exploit it.

[RejZoR]

9 hours ago, lafrente said:

"Far beyond" is a pretty vague claim, any actual numbers other than "far beyond, too much, very big"? 

 

You're talking about capitalism yet you got no clue how it works. If a pharmacy company has an option to 

 

A- Cure cancer with a single pill

B- Treat it for 25 years

 

It WILL always choose the option B. That's not a conspiracy theory, that's a fact.

Not only you don't know how viruses and antiviruses work, you don't even know how real diseases and cures work either. You're making it sound like you just throw some magic up in the air and bam, you can just detect all malware with 100% accuracy and zero false positives. And that a single pill could just miraculously cure all cancer types. I suggest you visit oncology clinic or something and educate yourself a bit on things. Just like there are bunch of flu strains to which we don't have a magic flu shot that can catch 'em all and have to be tuned for every season separately, there are also bunch of cancer types that are treated in various different ways (and are also of different severity). Some surgically, some using medicinal methods and other using localized radiation and there is NEVER a guarantee they will not come back, either by a tiny rogue cell cluster that was not treated or because you live in environment that causes cancer. Only fact here is that you're entirely clueless on both matters.

 

Also no, I'm not making shit up, I just happen to work in security field for over 20 years and I know really well how it all works. You mister, you on the other hand most certainly are, because you don't understand the most basic fundamental things about malware landscape and antiviruses as countermeasure and how the interaction between both has evolved through decades.

[LAwLz]

I can't find GoSearch22.app on this website (Is Apple silicon Ready?).

Anyone wanna submit it?

 

 

10 hours ago, Brooksie359 said:

Not necessarily the case. If you can treat cancer with one pill undoubtedly the cost of the pill is cheaper than 25 years of long term care for the pharmaceutical companies. Sure you may have constant revenue from that 25 years of treatment but the cost the pharmaceutical company has to pay for those 25 years isn't trivial and often times the end customer ends up in debt in which case they may not get the money back in a timely manner. That compared to producing a single pill that is likely low cost and selling it for an absurd amount of money i think most would choose the single pill and just profit off of that alot more. That and undoubtedly the pharmaceutical company has family members with cancer. I would highly doubt if there was an easy solution that they wouldn't provide it for those family members. On top of that there are tons of organizations that do cancer research that aren't profit driven like pharmaceutical companies so I think you might be a bit too suspicious of everyone. 

I never get the whole "big pharma wants to keep us sick" conspiracy theory.

It feels like a belief held by mainly Americans who don't understand that in most countries, having sick people directly relates in loss of money. For example most countries in the EU has free healthcare, so those countries are quadruple incentivized to find a cure.

1) If a person is sick then the government pays for their treatment, directly losing money.

2) If a person is sick then the government indirectly loses money because it is one less person that can work and pay taxes.

3) If they find a cure then they can make a buttload of money even if they sell it for cheap.

4) They could stop all the billion dollar funding projects they are currently doing, directly saving them money.

[Drama Lama]

finally