Attack On Jerry Mac OS
The first virus that targeted Macintosh computers, nVir, emerged in 1987 and remained a problem until 1991. It infected executable files on Macs, causing system issues like printing problems, application crashes, and slow response times. View the profiles of people named Jerry Mac. Join Facebook to connect with Jerry Mac and others you may know. Facebook gives people the power to share.
The subject that fan boys of each side love to argue about. Mac malware. Balance (itch) (timrodz) mac os. The fact is that malware for Mac is real and it continues to grow as a problem. In 2012 Apple removed the statements “It doesn’t get PC viruses” and “A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers.” I would like to shed light on the malware from beginning to now in hopes that it will bring an understanding of why security is needed on all operating systems, including your Mac.
1982 – The first threat that occurred was the Elk Cloner (this however did not actually affect the Mac) which would cause the Apple II to boot up with a poem:
Elk Cloner: The program with a personality
It will get on all your disks
It will infiltrate your chips
Yes, it’s Cloner!
It will stick to you like glue
It will modify RAM too
Send in the Cloner!
1987-2003
There were a few different malware families that came out but being as they are using an operating system that is not really used I won’t go into great detail. In 1987 nVIR virus began to infect Macintosh computers. In 1988 HyperCard viruses started to gain traction. HyperCard was software created by Apple to execute scripts immediately on opening. MDef was discovered in 1990. MDef infected application and system files on the Mac. In 1995 Microsoft released a virus that would infect both PC and Mac users via Microsoft Word called Concept. In 1996 Laroux, the first Excel macro virus was found but didn’t actually do anything to Macs until Excel ’98 was released. In 1998 Both AutoStart 9805 and Sevendust were discovered.
2004-Present – This brings us into the modern operating system we all know and love OS X. Also the time frame where threats are created that can still affect systems in use today.
https://congvenpadi1976.netlify.com/clone-con-carne-mac-os.html. 2004 – Renepo was found. It had the ability to disable a system firewall, and it would try to copy itself to /System/Library/StartupItems.
2004– Amphimix a program which is also a MP3 file. When launched it displays a dialog box which reads “Yep, this is an application. (So what is your iTunes playing now?)” It then loads itself into iTunes as an MP3 file called “Wild Laugh”, playing four seconds laughter.
2006 – Leap is widely considered to be the original Mac Trojan. Leap used iChat to spread itself; forwarding itself as a latestpics.tgz file to the contacts on the machine. Inside the Gzipped Tar File (.tgz) was an executable file masked as a JPEG. When executed, it infected all Cocoa applications.
2006 – Inqtana was the second worm for Mac OSX. The worm propagated through a vulnerability in unpatched OSX systems.
2008 was a big year for Mac malware… Apple published an advisory to use antivirus software. They removed the statement from its website after being up for about two weeks.
2008 – BadBunny is a multi-platform worm written in several scripting languages and distributed as an OpenOffice document containing a macro. It spreads itself by dropping script files that affect the behavior of popular IRC (Internet Relay Chat) programs, causing it to send the worm to other users.
2008 – RSPlug is a Trojan that changed DNS to send users to malicious servers. It originally spread as a video codec that was downloaded from various porn websites.
Attack On Jerry Mac Osmosis
2008 – AppleScript.THT tries to disable security software, steal user’s passwords, turn on file sharing, take screenshots of the desktop, and take a photo of the user via the built-in camera. The malware exploits a vulnerability with the Apple Remote Desktop Agent, which allows it to run as root.
2008 – MacSweeper, Mac’s first ‘rogue’ application (a fake antivirus misleading users by reporting infections that doesn’t exists). When the infected user tried to remove the “infections”, MacSweeper asked to provide credit card details and pay $39.99 for a “lifetime subscription serial key.”
I won’t lie, before I got into threat research, I ended up with this on my Mac… https://bonus-let-house-free-kky-of-fun.peatix.com.
2008 – Hovdy tried to install itself to /Library/Caches. It disabled syslog/system updates, stole password hashes, open ports in the firewall, disabled security software, installed LogKext keylogger and started web server, VNC, and SSH. It also tried to get root access by way of ARDAgent vulnerability.
2009 – Iservice was discovered in a pirated version of iWork ’09. It copied itself to /usr/bin/iWorkServices and tried to execute a HTTP request. Updated variants were later found in a pirated versions of many high use programs.
August 28, 2009 – Apple released an anti-malware tool called XProtect,at release it could protect a Mac against only two threats (RSPlug and Iservice).
2010 – HEllRTS (aka HellRaiser) is a Trojan that allows control of a computer by a remote user. The remote user has the ability to transfer files, pop up chat messages, display pictures, and even restart or shut down the infected machine.
2010 – Boonana, a Trojan that spread via social media and email disguised as a video. It runs as a Java applet, which downloads its installer to the machine. After installed it starts running in the background and communicating with a variety of servers such as command and control servers.
2011 – MacDefender, another rogue like MacSweeper that installs itself into the /Application folder and wants you to pay them for the “infections” to be removed from your mac.
2011/2012 – Flashback was disguised as a Flash player download and targets a Java vulnerability on Mac OS X. The system is infected after the user is redirected to a compromised bogus site, where JavaScript code causes an applet containing an exploit to load. The Flashback malware was the largest attack to date, hitting more than 600,000 Mac computers.
Attack On Jerry Mac Oscar
2013 – Lamadai, a backdoor Trojan, targeted NGOs (Non-Government Organizations) and exploited a Java vulnerability to drop further malware code.
2013 – Hackback spied on victims and was designed to take a list of certain file types, find all files matching those types, compress them into a zip located in /tmp/ and upload them to a remote server.
2014 – LaoShu went viral via spam emails posing as a notification from FedEx. It contacts a remote server sending system information, files, and screenshots. It is important to note that it is signed with a valid Apple developer ID certificate.
2014 – CoinThief is designed to steal Bitcoins from infected machines, and is disguised as legitimate apps. The source code was on Github for a while under an app named StealthBit.
It’s worth mentioning that these have been the main threats seen on the Mac and not all of them. There are many smaller variants and proof of concepts that are not listed. Also, that I didn’t include any adware variants such as Genieo or VSearch on here, but I did write about in my last blog. Even after seeing all of these there will still be those that refuse to believe that their mac is vulnerable to attack, but trust me it will only get worse from here. Apple is increasing their market share and with that comes an opportunity for malware writers to make more money.
Alongside the features and bug fixes in its non-Mac operating systems (see “Apple Releases iOS 14.2, iPadOS 14.2, watchOS 7.1, HomePod Software 14.2, and tvOS 14.2,” 5 November 2020), Apple has released macOS Catalina 10.15.7 Supplemental Update (with a re-release of macOS Catalina 10.15.7 Update for those who haven’t yet installed it), iOS 12.4.9 (for the iPhone 5s, iPhone 6 and 6 Plus, iPad Air, iPad mini 2 and 3, and the sixth-generation iPod touch), watchOS 5.3.9 (for the Apple Watch Series 1 and later), and watchOS 6.2.9 (for the Apple Watch Series 1 and Series 2).
These updates all address the same three serious security vulnerabilities, which could lead to arbitrary code execution or kernel memory being disclosed. That’s bad, but the real problem is that Apple says it is aware of reports that exploits for these vulnerabilities exist in the wild. In other words, the bad guys are already using these bugs to attack Apple devices.
The updates for iOS 14.2, iPadOS 14.2, and watchOS 7.1 also close these vulnerabilities; tvOS 14.2 has security fixes but apparently isn’t vulnerable to these particular bugs. Needless to say, whatever operating system version you’re using, if there’s an update to address these vulnerabilities, we encourage you to install it sooner rather than later.
Once you install the macOS Catalina 10.15.7 Supplemental Update, macOS will have the build number 19H15, which you can verify by choosing About This Mac from the Apple menu and clicking the version number.
https://sydneygoo.weebly.com/master00catcher-paid-mac-os.html. Note that iOS 13 and iPadOS 13 did not receive any updates for these vulnerabilities, presumably because Apple expects those users to upgrade to iOS 14.2 and iPadOS 14.2. Given the lack of updates for them, we also presume that 10.14 Mojave and older versions of macOS aren’t affected by these vulnerabilities.