Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)... - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...

All started with iPhone...:)

Some days ago I had to replace the battery on my wife's iPhone, and after that I noticed that the Wifi was not working properly anymore...so I decided to check on Google for pictures of the iPhone antenna so that I could open again and verify if I left anything loose (which later I found to be the case...) :) .
A regular search for "iphone wifi antenna"  (BE CAREFUL) and I got several hits...and as Google is proactive, it also showed some examples of pictures related to my search.
Well, I decided to see one of the pictures and clicked on it. It then started to load and suddenly was redirected to another page, which looked like my Finder screen:

As you can see, this looks a lot as a common Finder screen. It also looks a LOT like the common FakeAV (FakeAlert) tactics for Windows, where they use JavaScript to simulate a fake scan on "My Computer", showing all drivers and folders being scanned.

That is exactly what happens on the next screenshot:

Note that everything is really well crafted to look real. On Windows systems they use real detection names for the fake trojans found on the system. Here they use detection names to resemble Mac trojan names, which includes the OSX on the name.

 Whenever you press Cancel or Remove All it will push the "anti-malware.zip" file which is actually a .DMG file (the one used by Mac OSX).

At the time of this diary, only 17 of 42 AV detects it on VirusTotal, some as MacDefender, some as Downloader.OSX.

--------------------------------------------------------------
Pedro Bueno (pbueno /%%/ isc. sans. org)
Twitter: http://twitter.com/besecure

Pedro

155 Posts
ISC Handler
This page does not look like any Finder window I've seen, at least in Mac OSX 10.5 for PowerPC that I currently use. (1) Finder menu bar does not resemble the browser's menu bar as it does in the photo, complete with a reload button, and URL. (2) the bottom shows tabbed items and a "Show all downloads" link, which are not present in finder windows. (3) "Apple Security Center" does not resemble any Apple-authored application I've ever seen on a Mac, especially with the oversized beachball and horrific use of window real estate, though it does resemble some marginally-constructed 3rd party software I've seen.
Anonymous
I was just reading a New York Times article and right across the top of my screen was an ad for MacDefender. We all know that most people don't follow ISC Diary, and generally trust what they read or see in the New York Times, therefore that must be a valid product right?
Tom

2 Posts
The displayed content shows the usual problems with grammar and spelling - I've found this to be the most consistent way to quickly identify these attempts. Also, what legit Mac programmer would use the term 'PC' to describe the machine?

If the bad guys ever learn to spell and write correctly, we may have bigger problems :)
TonyH

8 Posts
@D.O Leary
It does look like a Finder window, if you ignore all the little extra things from the fact that is is a lookalike displayed in a Chrome window. You're looking at this as someone who knows window decorations, these infections work on the fact that the majority of users would have no idea what I was talking about when I said Window Decorations.

Most people who have updated their Macs in the recent past know Apple pushed something to catch MacDefender. They've never seen it before so something they've never seen before claiming to be "Apple Security Center" is going to get a easy pass and be assumed to be legit.

Third, your problem with this is again related to the first. Ya this would never pass Apples HIG, do you honestly believe the majority of users know or care to know that?

As others pointed out it also has all the grammar issues as many other pieces of malware. That malware is also installed all the time. People do not pay attention. This and all malware like it rely on that and are doing very well with it.
TonyH
5 Posts
@TonyH: "The displayed content shows the usual problems with grammar and spelling"

True, but what makes you think a large fraction of users are any better than that with _their_ grammar and spelling?
John Hardin

62 Posts
It's not the grammar or spelling that caught my eye but rather the last line in the popup dialog box "... check your PC for malicious programs". PC? :-D
John Hardin
20 Posts
Hey Pedro

What happen to the MacDefender that I submitted on Mother's Day?

I haven't seen any write up or analysis on the 1st Gen MacDefender pkg.

I think some of that analysis would have been great to add to this diary post.
HackDefendr

65 Posts
Not trying to flame, but for those relying on spelling and grammar, what are you going to do when someone just a wee bit more professional attacks your organization?
Dean

135 Posts
@dsh I don't think anyone is relying on spelling and grammar for detection alone...its just one of the more prominent ways of detection. Misspellings and bad grammar are one of the main ways spammers, and fake av writers count on for bypassing filters. Just the same as getting spam written in a completely different language than what you read and write...its real easy to detect the native language of any client, so why aren't spam senders smart enough to detect and use it? Because translated spam will have a higher detection rate.

To date, the level of sophistication used in the everyday virus and spam attacks just isn't that great from an educated user point of view. But its that visible lack of sophistication that makes their attack that much more professional.

So what do we do when someone more professional attacks my network? I can't say, but all of this less professional attacking is helping us learn, and be more prepared. Its the really good hackers that we never hear about until its too late, so all you can do is be as prepared as you can and hope its enough when a big hack happens.

--
Jeff
HackDefendr

65 Posts

Sign Up for Free or Log In to start participating in the conversation!