‘Thunderstrike 2’, a worm which moves from Macbook to Macbook using
hardware, joins privilege escalation bug seen in the wild for the first
time.
For years, Mac users have been safe in the knowledge that their platform was relatively safe from malware. A combination of the lower number of users on the platform, less attention from security researchers and, in general, fewer security holes in the operating system than Windows has led to a history generally free of damaging viruses and malware. So proud has Apple been of its security that it even ran several spots in its Mac vs PC ad campaign dedicated to the idea that Macs don’t get viruses.
But in quick succession, two new serious vulnerabilities in OS X have introduced Mac malware back into the conversation.
One exploits a weakness first confirmed in mid-July, which allows a malicious program that gains access to a Mac to run as though it is the administrator of the computer – a vulnerability known as “privilege escalation”. In doing so, it can bypass a lot of Apple’s security features, which rely on appropriately limiting the ability of downloaded code from affecting the deeper functions of the operating system.
Stefan Esser, the German coder who discovered the exploit, heavily criticised Apple for having already patched it in the beta versions of its next operating system, Mac OS X El Capitan. The company, which did not respond to a request for comment from the Guardian, still has not fixed the flaw in the latest current version of Mac OS, Yosemite, nor in the beta for the next Yosemite patch.
“At the moment it is unclear if Apple knows about this security problem or not, because while it is already fixed in the first betas of OS X 10.11, it is left unpatched in the current release of OS X 10.10.4 or in the current beta of OS X 10.10.5,” Esser wrote.
Later, he tweeted that “Apple was informed about said bug months ago and as usual did the irresponsible to fix it for some beta half a year in the future only.
“That means Apple released the bug via a patch … 4 months before they want to ship the ‘fix’,” he added.
Now, Esser’s bug has been seen in the wild for the first time. Researchers from Malwarebytes discovered a new adware installer doing the rounds, which allowed the adware to embed itself into the operating system, and – crucially – allowed the adware to install itself without requiring the user’s password.
Malwarebytes, which also criticises Esser for releasing the exploit without giving due notice to Apple, says: “This is obviously very bad news. Apple has evidently known about this issue for a while now … Unfortunately, Apple has not yet fixed this problem, and now it is beginning to bear fruit.”
At the same time, a very different exploit is about to be revealed to researchers at the Black Hat security conference in Las Vegas. It uses a bundle of weaknesses in the firmware of a computer, the embedded operating system which runs the lowest-level functions such as fans, power supply units, and USB ports, and lets the researchers overwrite that software with their own code, and five of these six weaknesses are present on Macs as well as PCs.
The researchers notified Apple, which has patched two of the vulnerabilities, but three remain unpatched.
Worse still, researchers managed to write a proof of concept attack which uses the weakness to create a “worm”: a virus which can spread from MacBook to MacBook directly. A deliberately infected email can infect the first MacBook, which then automatically attempts to infect any other hardware physically connected to it, such as Apple’s ethernet adapters. If that hardware is later plugged into an uninfected computer, the worm spreads further.
“People are unaware that these small cheap devices can actually infect their firmware,” researcher Xeno Kovah told Wired. “You could get a worm started all around the world that’s spreading very low and slow. If people don’t have awareness that attacks can be happening at this level then they’re going to have their guard down and an attack will be able to completely subvert their system.”
The worm, called “Thunderstrike 2”, bears a similarity to a previous proof-of-concept attack called BadUSB, which let attackers reprogram almost any USB device to attack hardware. But even that attack hadn’t been turned into a worm, limiting the potential damage.
One exploits a weakness first confirmed in mid-July, which allows a malicious program that gains access to a Mac to run as though it is the administrator of the computer – a vulnerability known as “privilege escalation”. In doing so, it can bypass a lot of Apple’s security features, which rely on appropriately limiting the ability of downloaded code from affecting the deeper functions of the operating system.
Stefan Esser, the German coder who discovered the exploit, heavily criticised Apple for having already patched it in the beta versions of its next operating system, Mac OS X El Capitan. The company, which did not respond to a request for comment from the Guardian, still has not fixed the flaw in the latest current version of Mac OS, Yosemite, nor in the beta for the next Yosemite patch.
“At the moment it is unclear if Apple knows about this security problem or not, because while it is already fixed in the first betas of OS X 10.11, it is left unpatched in the current release of OS X 10.10.4 or in the current beta of OS X 10.10.5,” Esser wrote.
Later, he tweeted that “Apple was informed about said bug months ago and as usual did the irresponsible to fix it for some beta half a year in the future only.
“That means Apple released the bug via a patch … 4 months before they want to ship the ‘fix’,” he added.
Now, Esser’s bug has been seen in the wild for the first time. Researchers from Malwarebytes discovered a new adware installer doing the rounds, which allowed the adware to embed itself into the operating system, and – crucially – allowed the adware to install itself without requiring the user’s password.
Malwarebytes, which also criticises Esser for releasing the exploit without giving due notice to Apple, says: “This is obviously very bad news. Apple has evidently known about this issue for a while now … Unfortunately, Apple has not yet fixed this problem, and now it is beginning to bear fruit.”
At the same time, a very different exploit is about to be revealed to researchers at the Black Hat security conference in Las Vegas. It uses a bundle of weaknesses in the firmware of a computer, the embedded operating system which runs the lowest-level functions such as fans, power supply units, and USB ports, and lets the researchers overwrite that software with their own code, and five of these six weaknesses are present on Macs as well as PCs.
The researchers notified Apple, which has patched two of the vulnerabilities, but three remain unpatched.
Worse still, researchers managed to write a proof of concept attack which uses the weakness to create a “worm”: a virus which can spread from MacBook to MacBook directly. A deliberately infected email can infect the first MacBook, which then automatically attempts to infect any other hardware physically connected to it, such as Apple’s ethernet adapters. If that hardware is later plugged into an uninfected computer, the worm spreads further.
“People are unaware that these small cheap devices can actually infect their firmware,” researcher Xeno Kovah told Wired. “You could get a worm started all around the world that’s spreading very low and slow. If people don’t have awareness that attacks can be happening at this level then they’re going to have their guard down and an attack will be able to completely subvert their system.”
The worm, called “Thunderstrike 2”, bears a similarity to a previous proof-of-concept attack called BadUSB, which let attackers reprogram almost any USB device to attack hardware. But even that attack hadn’t been turned into a worm, limiting the potential damage.
