VB2014 preview: Methods of malware persistence on Mac OS X

Posted by   Virus Bulletin on   Aug 27, 2014

Patrick Wardle shows that OS X users really have something to worry about.

In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. Today, we look at the paper 'Methods of malware persistence on Mac OS X', by Patrick Wardle (@patrickwardle), Director of Research at Synack.

The very first in-the-wild virus, Elk Cloner, targeted Macs (in particular the Apple II). Yet over the course of time, many Mac users came to believe that they were immune to malware - a belief no doubt strengthened by an Apple marketing campaign.

In recent years, this belief has been proven wrong, for instance by the prevalent 'Flashback' trojan, or the 'Crisis' rootkit, allegedly used by some governments. And indeed, Apple has built a number of tools into OS X with the explicit purpose of keeping malware at bay.

However, as Patrick shows in his paper, tools such as XProtect and Gatekeeper are relatively easy to bypass. OS X's verification of binary signatures, and even the fact that kernel extensions need to be signed, don't provide the protection they promise. In the latter case, the fact that verification takes place in user mode certainly doesn't help.

Getting a piece of malware to run once usually isn't what its authors are after though: they want the malware to persist, by running in the background as a daemon or by being launched every time the user logs in. Patrick's paper describes various methods that can be used to make this happen.

Turning a binary into a launch daemon or agent (non-application binaries that run in the background), for instance, is as simple as inserting an XML file into a particular directory. This is how Flashback managed to infect more than 600,000 devices, making it the most successful OS X malware to date. Crisis, which was delivered via targeted exploits and employed some sophisticated stealth capabilities, also persisted as a launch agent.

  Flashback maintaining persistence through a launch agent.

A different persistence method is used by 'Kitmos', another malware family that targets activists. To ensure the spyware is executed every time the user logs in, it registers itself as a 'login item', the 'Apple-approved' way for applications to persist. Again, it requires a single file for an app to become a login item.

Patrick's paper - which contains many more examples of persistence techniques - should convince even the most stubborn members of the "Macs can't get viruses" brigade that, in fact, there are a number inherent weaknesses in OS X's anti-malware mechanisms that help those creating malicious software.

Thankfully, there is a positive conclusion to the paper: Patrick has created a tool, known as KnockKnock, which shows users which persistent binaries are running on the system. The tool is open source and is available from Synack's Github page.

  KnockKnock detecting a cron job set by the 'Janicab' trojan.

You can now register for VB2014. And if you have some research that you want to share with the security community, why not submit an abstract to fill one of the seven remaining 'last-minute' presentation slots? (Deadline 28th August 2014.)

Posted on 27 August 2014 by Martijn Grooten



Latest posts:

VB2019 conference programme announced

VB is excited to reveal the details of an interesting and diverse programme for VB2019, the 29th Virus Bulletin International Conference, which takes place 2-4 October in London, UK.

VB2018 paper: Under the hood - the automotive challenge

Car hacking has become a hot subject in recent years, and at VB2018 in Montreal, Argus Cyber Security's Inbar Raz presented a paper that provides an introduction to the subject, looking at the complex problem, examples of car hacks, and the…

VB2018 paper and video: Android app deobfuscation using static-dynamic cooperation

Static analysis and dynamic analysis each have their shortcomings as methods for analysing potentially malicious files. Today, we publish a VB2018 paper by Check Point researchers Yoni Moses and Yaniv Mordekhay, in which they describe a method that…

VB2019 call for papers closes this weekend

The call for papers for VB2019 closes on 17 March, and while we've already received many great submissions, we still want more!

Registration open for VB2019 ─ book your ticket now!

Registration for VB2019, the 29th Virus Bulletin International Conference, is now open, with an early bird rate available until 1 July.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.