VB2014 preview: Methods of malware persistence on Mac OS X

Posted by   Virus Bulletin on   Aug 27, 2014

Patrick Wardle shows that OS X users really have something to worry about.

In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. Today, we look at the paper 'Methods of malware persistence on Mac OS X', by Patrick Wardle (@patrickwardle), Director of Research at Synack.

The very first in-the-wild virus, Elk Cloner, targeted Macs (in particular the Apple II). Yet over the course of time, many Mac users came to believe that they were immune to malware - a belief no doubt strengthened by an Apple marketing campaign.

In recent years, this belief has been proven wrong, for instance by the prevalent 'Flashback' trojan, or the 'Crisis' rootkit, allegedly used by some governments. And indeed, Apple has built a number of tools into OS X with the explicit purpose of keeping malware at bay.

However, as Patrick shows in his paper, tools such as XProtect and Gatekeeper are relatively easy to bypass. OS X's verification of binary signatures, and even the fact that kernel extensions need to be signed, don't provide the protection they promise. In the latter case, the fact that verification takes place in user mode certainly doesn't help.

Getting a piece of malware to run once usually isn't what its authors are after though: they want the malware to persist, by running in the background as a daemon or by being launched every time the user logs in. Patrick's paper describes various methods that can be used to make this happen.

Turning a binary into a launch daemon or agent (non-application binaries that run in the background), for instance, is as simple as inserting an XML file into a particular directory. This is how Flashback managed to infect more than 600,000 devices, making it the most successful OS X malware to date. Crisis, which was delivered via targeted exploits and employed some sophisticated stealth capabilities, also persisted as a launch agent.

  Flashback maintaining persistence through a launch agent.

A different persistence method is used by 'Kitmos', another malware family that targets activists. To ensure the spyware is executed every time the user logs in, it registers itself as a 'login item', the 'Apple-approved' way for applications to persist. Again, it requires a single file for an app to become a login item.

Patrick's paper - which contains many more examples of persistence techniques - should convince even the most stubborn members of the "Macs can't get viruses" brigade that, in fact, there are a number inherent weaknesses in OS X's anti-malware mechanisms that help those creating malicious software.

Thankfully, there is a positive conclusion to the paper: Patrick has created a tool, known as KnockKnock, which shows users which persistent binaries are running on the system. The tool is open source and is available from Synack's Github page.

  KnockKnock detecting a cron job set by the 'Janicab' trojan.

You can now register for VB2014. And if you have some research that you want to share with the security community, why not submit an abstract to fill one of the seven remaining 'last-minute' presentation slots? (Deadline 28th August 2014.)

Posted on 27 August 2014 by Martijn Grooten



Latest posts:

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

First 11 partners of VB2019 announced

We are excited to announce the first 11 companies to partner with VB2019, whose support will help ensure a great event.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.