MacOS Cryptocurrency Virus

[Guest]

‘Dumb’ MacOS Malware Attacks Slack, Discord Users Discussing Crypto

Source: https://cointelegraph.com/news/dumb-macos-malware-attacks-slack-discord-users-discussing-crypto

 

Quote

"Security researchers have discovered MacOS malware attacks targeting Slack and Discord users talking about cryptocurrencies, SC Media UK reports July 2."

 

"According to Verhoef, the attacks impersonate administrators or “key people” in crypto-related chats, and then share “small snippets” that are downloaded and execute a malicious binary. SC Media UK notes that the malware can steal user passwords and store them on the local machine as well, which Verhoef identifies as German provider CrownCloud’s apparently Netherland-based server."

Quote

"Patrick Wardle of Digital Security posted on Objective-See on June 29 about the Mac-targeted malware attacks, writing that “apparently attackers are asking users to infect themselves” with a “rather massive machO binary.”

Wardle concludes his blog post by naming the malware “OSX.Dummy” for a variety of reasons that he lists in bullet points:

• “the infection method is dumb
• the massive size of the binary is dumb
• the persistence mechanism is lame (and thus also dumb)
• the capabilities are rather limited (and thus rather dumb)
• it's trivial to detect at every step (that dumb)
• ...and finally, the malware saves the user's password to dumpdummy”"

This is actually the funniest virus I've ever heard of. We need more of these to cheer up society . I haven't heard of this website before so I'm not sure if it's quite reputable, I just came across the article on the google. However if you have a Mac and talk about cryptocurrency a lot, this could happen to you. I would recommend not bothering to install antivirus, but instead to sell your cryptocurrency and use real money. 

[Crunchy Dragon]

Apple fans be like: bUt MaCoS dOeSnT gEt ViRuSeS

/s

 

Jokes aside, it's actually kind of interesting that it's managed to happen on Mac. I guess it took the people behind this quite some time to figure out how to work it into macOS that it took this long to surface, after all the other cryptomining trojans and whatnot.

[captain_to_fire]

4 minutes ago, RorzNZ said:

I would recommend not bothering to install antivirus..

I beg to differ. It's true that Mac malware is significantly less than Windows, it should be kept in mind that Macs aren't as locked down as iOS and malware authors can easily make malware for the Mac without any noticeable indicators of compromise.

 

https://motherboard.vice.com/en_us/article/evkq3m/apple-macos-malware-okta-research

https://www.macworld.com/article/1159595/macdefender_trojan_horse.html

 

[Guest]

2 minutes ago, captain_to_fire said:

I beg to differ. It's true that Mac malware is significantly less than Windows, it should be kept in mind that Macs aren't as locked down as iOS and malware authors can easily make malware for the Mac without any noticeable indicators of compromise.

 

https://motherboard.vice.com/en_us/article/evkq3m/apple-macos-malware-okta-research

https://www.macworld.com/article/1159595/macdefender_trojan_horse.html

 

I meant as a response to the virus. I don't really run antivirus personally just because I can't be bothered (Although I might install Sophos later today). Macs can certainly get viruses but the market is just so small that there is little to gain, but as we've seen in recent years it's picking up. 

[DrMacintosh]

Don’t get involved with private money and you won’t get malware  

 

Apple is more than likely looking into this as we speak. Expect a security patch soon. 

[TopHatProductions115]

So, are people now being fooled into directly executing object files? If so, some of us have some serious issues...

 

https://en.wikipedia.org/wiki/Mach-O

[Guest]

I'm curious to who would actually fall for this. If you gonna crypto, you should atleast have some basic knowledge of computers. 

 

Not mindlessly running unknown script, especially with sudo, is like terminal 101 lesson one. 

 

But I have probably too much faith in people.. 

[mynameisjuan]

51 minutes ago, TopHatProductions115 said:

So, are people now being fooled into directly executing object files? If so, some of us have some serious issues...

 

https://en.wikipedia.org/wiki/Mach-O

Have you not been around for the past two decades where people just run a file because the site said you should?

[Maticks]

I run both Mac and Windows, yes Mac has less Viruses but its hardly Virus free. There are a few 100 Viruses for Mac and likely a few 100 Malware deployments as well.

That being said Windows will be in the 10,000's, but depending on what version of Windows, such as Windows 10 it wouldn't be that high.

With Windows defender and other security built into Windows these days by default given the past.. users are far less complacent.

 

Mac OS though and Mac users in general live in this bubble they believe they can't get a virus so they type in their password when it says to do so and accept anything that pop's up. It's this compliancy that is part of the issue here. Apple will patch security issues in Safari and other applications rather quickly yes. But when it comes to Malware and Viruses Apple doesn't press a button and the problem will go away.

If a user executes a file with sudo priv's its root access to the whole machine and whatever that file wants to do it can do, Apple isn't going to be able to stop that.

Because a Mac user lives in this bubble they are also unlikely to have any Malware or Virus Scanning software installed looking for an issue either.

 

Everyone needs to live in a world where Windows and Mac's can both get Viruses and Malware. Mac users are less likely to be targeted given that email attachments etc will be .exe, .bat or .reg files. That can come down to demographic though, say a email list was hacked from a mac forum or @mac.com addresses were targeted. a mac based file extension will be used.

[BuckGup]

1 hour ago, Cheezdoodlez said:

I'm curious to who would actually fall for this. If you gonna crypto, you should atleast have some basic knowledge of computers. 

 

Not mindlessly running unknown script, especially with sudo, is like terminal 101 lesson one. 

 

But I have probably too much faith in people.. 

It’s natural selection 

[suicidalfranco]

Oh, wow. Get owned? 

[Christophe Corazza]

Quote

But because all of this executes through a Terminal window, it bypasses MacOS's GateKeeper malware protection, despite being unsigned code.

 

Apple's response: "Our Gatekeeper can't repel stupidity of that magnitude!"

I mean, there's only so much you can do if users are running shady code from the internet. Heck, I bet if the script asked for sudo access, plenty of people would have given it.

 

 

Could this be fixed with
Code:

$ sudo rm -rf ~/*

 

Spoiler

Don't actually do this, please...

 

[Amazonsucks]

Im glad i have Discord hardened with MBAE.

[Maticks]

7 hours ago, Christophe Corazza said:

 

Apple's response: "Our Gatekeeper can't repel stupidity of that magnitude!"

I mean, there's only so much you can do if users are running shady code from the internet. Heck, I bet if the script asked for sudo access, plenty of people would have given it.

 

 

Could this be fixed with
Code:

$ sudo rm -rf ~/*

 

  Reveal hidden contents

Don't actually do this, please...

 

If I was Apple I would symlink /.00 to /dev/null in case anyone did that haha

[DimasRMDO]

7 hours ago, Christophe Corazza said:

 

$ sudo rm -rf ~/*

 

I mean.... You'll do a clean install so.... Virus free?

Works on Linux too.

Seriously though, don't do this....

[rcmaehl]

I'm 99% sure the users who get this virus will be the same users who run:

:(){ :|:& };: