Upload File

mac os x malware: from myth to mainstream

29
Vicente Diaz, Senior Security Analyst, Global Research & Analysis Team, Kaspersky Lab Kaspersky Security for Mac Launch Event, Moscow, 14-16, May 2012 Mac OS X Malware: From Myth to Mainstream

Upload: imagazinepl

Post on 30-Nov-2014

1.421 views

Category:

Technology


0 download

Report

Tags:

DESCRIPTION

 

TRANSCRIPT

Page 1: Mac OS X Malware: From Myth to Mainstream

Vicente Diaz, Senior Security Analyst, Global Research & Analysis Team, Kaspersky Lab

Kaspersky Security for Mac Launch Event, Moscow, 14-16, May 2012

Mac OS X Malware: From Myth to Mainstream

Page 2: Mac OS X Malware: From Myth to Mainstream

Mac OS X: security from a user´s perspective

Page 3: Mac OS X Malware: From Myth to Mainstream

Wait a minute…

Page 4: Mac OS X Malware: From Myth to Mainstream

Recipe for an infection:

1.Vulnerability

2.Exploit

3.Attack vector

Or

4.Fooling the user

The cybercriminals’ checklist

Page 5: Mac OS X Malware: From Myth to Mainstream

Mac OS X vulnerabilities in the past…

Page 6: Mac OS X Malware: From Myth to Mainstream

And even more vulnerabilities now

2008 2009 2010 2011 2012*0

50

100

150

200

250

300

350

400

450

Advisories

Vulnerabilities

Source: Apple Security Updates: http://support.apple.com/kb/HT1222

Page 7: Mac OS X Malware: From Myth to Mainstream

Apple’s management of Mac OS X vulnerabilities

32 days

20 days

48 days

Page 8: Mac OS X Malware: From Myth to Mainstream

The cybercriminals’ checklist

Recipe for an infection:

1. Vulnerability

2. Exploit

3. Attack vector

Or

4.Fooling the user

Page 9: Mac OS X Malware: From Myth to Mainstream

Mac OS X’s pre-installed protection measures

ASLR Stack protection XProtect

2005

OSX 10.4 Tiger

No No Only warnings

2007

OSX 10.5 Leopard

Buggy - useless

Optional Only warnings

2009

OSX 10.6 Snow Leopard

Buggy - useless

OS compiled with protection

Enhanced

2011

OSX 10.7 Lion

Fully implemented

OS compiled with protection

Enhanced

Page 10: Mac OS X Malware: From Myth to Mainstream

Introducing … Xprotect (aka File Quarantine)

Live Demo

Page 11: Mac OS X Malware: From Myth to Mainstream

The future of Mac OS X protection

Page 12: Mac OS X Malware: From Myth to Mainstream

The cybercriminals’ checklist

Recipe for an infection:

1. Vulnerability

2. Exploit

3. Attack vector

Or

4. Fooling the user

Page 13: Mac OS X Malware: From Myth to Mainstream

Attack vectors

Compromised websites

Black Hat SEO

Targeted attacks

Page 14: Mac OS X Malware: From Myth to Mainstream

The cybercriminals’ checklist

Recipe for an infection:

1. Vulnerability

2. Exploit

3. Attack Vector

Or

4. Fooling the user

Page 15: Mac OS X Malware: From Myth to Mainstream

If what you say is true…show me the malware

Page 16: Mac OS X Malware: From Myth to Mainstream

Mac OS X malware over time

2008 2010

20112009

Scareware

DNSChanger

Remote control

FakeAV

Page 17: Mac OS X Malware: From Myth to Mainstream

Mac OS X’s malware evolution

Source: Kaspersky Lab

2003

.08

2005

.08

2005

.10

2005

.12

2006

.03

2006

.11

2007

.01

2008

.01

2008

.06

2008

.11

2009

.05

2009

.10

2009

.12

2010

.02

2010

.04

2010

.10

2010

.12

2011

.05

2011

.08

2011

.10

2011

.12

2012

.02

2012

.04

0

50

100

150

200

250

300

Page 18: Mac OS X Malware: From Myth to Mainstream

Case Study 1: Flashback

Page 19: Mac OS X Malware: From Myth to Mainstream
Page 20: Mac OS X Malware: From Myth to Mainstream

Flashback attack method

Page 21: Mac OS X Malware: From Myth to Mainstream

Flashback attack vector

Main infection vector: Hacked WordPress sites

Late February to early March: between 30,000 and 100,000 sites were hacked

Depending on OS and browser, victims are redirected to an exploit

85% of hacked sites were based in the U.S.

Traffic hired from partner program associated with the rr.nu gang

Page 22: Mac OS X Malware: From Myth to Mainstream

Geographical distribution of infected Mac OS X computers

Page 23: Mac OS X Malware: From Myth to Mainstream

Case Study 2: SabPub

Page 24: Mac OS X Malware: From Myth to Mainstream

Advanced Persistent Threat targeting MAC OS X users

Doc files from 2010, rearmed with new exploits

CVE-2009-0563 – targets Office

CVE-2012-0507 – targets Java

The “10th March Stamnet”

Installs backdoor on victim´s machine

APT is currently ACTIVE

Page 25: Mac OS X Malware: From Myth to Mainstream

What has changed?

Page 26: Mac OS X Malware: From Myth to Mainstream

Mac OS X’s growth in market share

Page 27: Mac OS X Malware: From Myth to Mainstream

Call to action: Apple’s security update process

• Allow Oracle to patch Mac OS X vulnerabilities in Java directly, rather than issuing your own security updates.

• Implement automatic security updates for user systems

• Respond faster to new security vulnerabilities to minimize window of exploitation

Page 28: Mac OS X Malware: From Myth to Mainstream

Conclusions & predictions for users

• The myth of Mac OS X being invulnerable to malware has been shattered

• Use AV software and proper security practices to protect yourself

• Mac OS X mass-malware attacks will increase. This will include drive-by downloads and Mac OS X-based botnets

• Expect cross-platform exploit kits with Mac OS X-specific exploits

• Apple is pushing for a more controlled ecosystem (GateKeeper) but this will be a cat-and-mouse game.

Page 29: Mac OS X Malware: From Myth to Mainstream

Thank You

Vicente Diaz, Senior Security Analyst, Global Research & Analysis Team, Kaspersky Lab

@trompi

Kaspersky Security for Mac Launch Event, Moscow, 14-16, May 2012


Myths About Moving to the Cloud - Pronto Marketing · MYTH 1 MYTH 2 MYTH 3 MYTH 4 MYTH 5 MYTH 6 MYTH 7 MYTH 8 MYTH 9 Office 365 is just Office tools in the cloud, and I can only use

Robert Asprin - Myth 03 - Myth Directions

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis training part8 malware memory forensics

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection

Thinking through Myth, Thinking Myth Through

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

The Meaning of Myth. Definition of Myth: The Meaning of Myth

Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Bruce King / Innovations First: the mainstream Innovations First: the mainstream

Man, Myth, Malware and Multi-Scanningamtso.net/wp-content/sp-resources/forum-file...AV resources, specialist AV community resources and blackhat resources that are currently known

Evaluating Open Source Malware Sandboxes with Linux malware

Windows Malware Firewall: Remove Windows Malware Firewall

Your Voice Assistant is Mine: How to Abuse Speakers to ... · through current mainstream Android malware analysis techniques. From the aspect of permission checking [9, 22], VoicEmployer

-[ OS X Malware ]- - PUT.AS...Starting point: Macs are immune to malware. ! Latest Flashback variants broke that myth. ! In fact, it’s quite easy to write high quality OS X malware!

John Shaw, Mainstream Renewable Power: Open Innovation@ Mainstream

LIGHT OUSE - Lighthouse Charity Belfastlighthousecharity.com/wp-content/uploads/2018/08/Myths-and-Facts-Leaflet.pdfMYTH MYTH MYTH MYTH MYTH MYTH MYTH FACT FACT FACT FACT FACT FACT

Malware and Anti-Malware Seminar by Benny Czarny

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Advanced malware analysis training session6 malware sandbox analysis

Migration and Inequality Urban Studies 101. The myth of immigrant assimilation Assimilation means incorporation into mainstream American society and culture

Myth Adventures 02 - Myth Conceptions

Android Malware Exposed-Evolution of Android Malware

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Man, Myth, Malware and Multi-Scanning CFET 2011