WireLurker Malware Infecting iOS and OS X

<div dir="ltr" style="text-align: left;" trbidi="on"> <div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> </div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivIxtWQ0uR_sBnpYipjojBuibvNGfca11DsQfL0yLIdROTJJoIdKJshfrAQSFLXnmCdIEJrCGjQ1iGKfcL_PYD2115Ke83TKVDPR-UJUjmB_uyqaAybZiE7yQ1mo-bxD4v0ffaX4n-vhEP/s1600/WireLurker+Malware+Infecting+iOS+and+OS+X.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="WireLurker Malware Infecting iOS and OS X" border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivIxtWQ0uR_sBnpYipjojBuibvNGfca11DsQfL0yLIdROTJJoIdKJshfrAQSFLXnmCdIEJrCGjQ1iGKfcL_PYD2115Ke83TKVDPR-UJUjmB_uyqaAybZiE7yQ1mo-bxD4v0ffaX4n-vhEP/s1600/WireLurker+Malware+Infecting+iOS+and+OS+X.jpg" title="" width="400" /></a></div> <br /> <b><br /></b> <b>WireLurker </b>a new form of malware is infecting Apple operating system for the past 6 months.According to a report by Palo Alto Networks security researchers says that it is the biggest in scale within the malware family.The researcher said "The Discovery of WireLurker poses a new Era of Malware".</div> <br /> WireLurker is the second known malware family that infect iOS devices through OS X vis USB.It the first malware to automate generation of malicious iOS applications through binary file replacement also the first malware that can infect iOS applications similare to the traditional virus.This malware can install third-party applications on non-jailbroken iOS devices through enterprising provisioning.<br /> <br /> "Wirelurker is unlike anything we have ever seen in terms of Apple iOS and OS X malware.The techniques in use suggest that bad actors are getting more sophisticated when it comes to exploiting some of the world's best known desktop and mobile platforms.",said Ryan Olson(Company's intelligence director).<br /> <br /> <h3 style="text-align: left;"> How it works</h3> <div> <br /></div> <div> This type of malware is very unique.It infect iOS devices via Apple's OS X.When users download a Wirelurker affected app its start waiting for user to attach a iOS device.Once connected it try to find whether the device is jailbroken or not.If its is jailbroken,If its is jail broken,Wirelurker backup the device's apps to the Mac where it repackages them with malware and then installs the infected the infected versions on the devices.If its is non-jailbroken,Wirelurker takes advantage of the method created by Apple which allow them to install special software on the staff's devices.This involved placing infected apps on the devices that has been signed by a bogus "enterprise certificate",a code is added to the product to prove that this app is from an trustworthy source.To ensure that the device has accepted this certificate, a permissions request was  pop up on the targeted iOS device. It asked permission to run the app, but if the user clicked “continue” it installed code called a “provisioning profile”.Once user clicked on continue iOS device will accept any app that has been signed with the same enterprise certificate.</div> <br /> WireLurker was used to trojanize 467 OS X applications on the Maiyadi App Store (third-party Mac applications store in China).<br /> <br /> In the past 6 months ,these 467 infected applications were downloaded over 356,104 times and it has infected more than thousand of users.Recently a new flaw was discovered in <a href="http://www.trickbug.com/2014/11/rootpipe-critical-security-flaw-in-mac-os-x-yosemite.html"><span style="color: red;">Mac OS X by a security researcher Emil</span></a>.<br /> <br /> <blockquote class="tr_bq"> WireLurker monitors any iOS device connected via USB with an infected computer and installs downloaded third-party applications or automatically generated malicious applications onto the device,regardless of whether its is jailbroken.This is the reason why call it "WireLurker".Researchers have demonstrated similar methods to attack non-jalibroken device before..However,this malware combines a number of techniques to successfully realize a new brand of threat to all iOS devices.</blockquote> In statement Apple said that "We are aware of malicious software available from a download site aim at users in China,and we've blocked the identified apps to prevent them for launching.As always,we recommend that users download and install software from a trusted sources."<br /> <br /> We recommend our users to take some safety tips mention below.<br /> <br /> <ul style="text-align: left;"> <li>Don't download apps from third-party store.</li> <li>Don't jailbreak iOS devices.</li> <li>Don't connect your devices to untrusted computers.</li> <li>Keep iOS version up-to-date.</li> <li>Do not accept any unknown enterprise provisioning profile unless an authorised ,trusted party instruct you to do so.</li> <li>You can also use this tool to detect the Wirelurker malware family on OS X.This tool is available on <a href="https://github.com/PaloAltoNetworks-BD/WireLurkerDetector"><span style="color: red;">github</span></a> and tool is made by Palo Alto Networks.</li> </ul> </div>

WireLurker Malware Infecting iOS and OS X

WireLurker a new form of malware is infecting Apple operating system for the past 6 months.According to a report by Palo Alto Networ...

Read more »

Rootpipe critical security flaw in Mac OS X Yosemite

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> </div> <br /> <br /> <table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj25xnMGu9bmh7lkLvxzSbQr9Q3SS4-fYXjkE1tpGuKRKFJNmvYcGMJSwqFF21NvHLSJYIGHH6zFIVZYaoYiTx6y45jbJr3xxoclVXRaJUOvFwNgWFU4q_ifyXGARsguq6qlzS2BAjIg0nk/s1600/Rootpipe+critical+security+flaw+in+Mac+OS+X+Yosemite.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Rootpipe critical security flaw in Mac OS X Yosemite" border="0" height="273" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj25xnMGu9bmh7lkLvxzSbQr9Q3SS4-fYXjkE1tpGuKRKFJNmvYcGMJSwqFF21NvHLSJYIGHH6zFIVZYaoYiTx6y45jbJr3xxoclVXRaJUOvFwNgWFU4q_ifyXGARsguq6qlzS2BAjIg0nk/s1600/Rootpipe+critical+security+flaw+in+Mac+OS+X+Yosemite.jpg" title="" width="400" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Rootpipe critical security flaw in Mac OS X Yosemite</td></tr> </tbody></table> Swedish security researcher Emil Kvarnhammar from Truesec has discovered a critical vulnerability in Apple's Mac OS X 10.10 Yosemite,dubbed as "<b>Rootpipe</b>".By this vulnerability attacker can escalate administrative privileges on a infected computer and can gain root access.<br /> <center> <blockquote class="twitter-tweet" lang="en"> Details on the <a href="https://twitter.com/hashtag/rootpipe?src=hash">#rootpipe</a> exploit will be presented, but not now. Let's just give Apple some time to roll out a patch to affected users.<br /> — Emil Kvarnhammar (@emilkvarnhammar) <a href="https://twitter.com/emilkvarnhammar/status/522646505128480768">October 16, 2014</a></blockquote> <script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script> </center> <div style="float: left; padding: 10px;"> <br /> Once hacker exploited this bug on a compromised machine he can install malicious software,steal sensitive information or make changes to your system without the need of password.<br /> <br /> "It all started in when I was preparing for two security events, one in Stockholm and one in Malmö," Emil says. "I wanted to show a flaw in Mac OS X,but relatively few have been published.There are few 'proof-of-concepts' online,but the latest I found affected the older 10.8.5 version of OS X.I couldn't find anything similar for 10.9 or 10.10."<br /> <br /> He tested the vulnerability on 10.8,10.9 and 10.10 version of  OS X.He also said that this vulnerability is existed since 2012.<br /> <br /> Mac users keep their system more updated than Windows users,Emil says and he wanted to find a vulnerability that would affect current users of OS X.<br /> <br /> "I started looking at admin operations and found a way to create a shell with root privileges.It took a few days of binary analysis to find the flaw,and I was pretty surprised when I found it.",Emil said.<br /> <br /> <h3 style="text-align: left;"> Apple's Response</h3> <div> Emil already informed Apple about this vulnerability.Apple asked him for more details about the bug and said not to disclose this until January 2015.</div> <blockquote class="tr_bq"> "The current agreement with Apple is to disclose all details in mid-January 2015.This might sound like a long wait,but hey time flies.It's important that they have time to patch,and that the patch is not available for some time.",Emil said.</blockquote> Emil also uploaded a demo video of this vulnerability.Just have a look.<br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <iframe allowfullscreen="allowfullscreen" frameborder="0" height="300" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/fCQg2I_pFDk?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="400"></iframe></div> <br /></div> </div>

Rootpipe critical security flaw in Mac OS X Yosemite

Rootpipe critical security flaw in Mac OS X Yosemite Swedish security researcher Emil Kvarnhammar from Truesec has discovered a cri...

Read more »