OSX.Pirrit Mac Adware Part III: The DaVinci Code | Hacker News Reader

OSX.Pirrit Mac Adware Part III: The DaVinci Code

cybereason.com

110 pointsEliadEliad23 comments

Open articleView on HN

This "legitimate adware" is abusing an installation process to gain persistence.

I have a feeling BlockBlock (Objective-See) would be able to intercept and block the installation of the plist.

> https://www.objective-see.com/products/blockblock.html

If a third party app is installing a com.apple.<whatever>.plist, be aware of it.

That's a very useful security program. Thanks for the heads up!

Reminds me of the security monitoring software that Google released for MacOS.

The most disappointing thing I saw is the resumé. It makes me very sad for the software development profession that actively subverting the privacy of users and controls of their operating system is something seen as a positive.

Alternatively: a shameless person tried to claim that actively subverting the privacy of users was a positive and he was (rightfully) mocked by the majority.

Presumably a resume that lists malware development experience, would be being floated mostly past companies looking for a malware developer.

I suppose you could say the same about those who worked on Intel ME, Computrace[1], and maybe other DRM technologies too?

Personally, I can refuse an offer from Google or Microsoft because I do not agree at all with their vision, regardless of how much they want to compensate me, but it really is a difficult situation to be in --- people get asked to do things which are against their personal beliefs all the time, and there may well be other reasons why someone would work for such companies, so I don't find it unusual that he would try to make the best of it.

[1] https://news.ycombinator.com/item?id=2500472

TIL you can use AppleScript to inject Javascript into every browser page you visit, regardless of browser, as an alternative to using a browser plugin to (for example) monitor every website you visit.

Last I checked Chrome at least makes attempts to block this, but Safari will happily play along.

I was using this functionality to create a frustratingly convoluted automated Steam key redeemer for Mac (https://github.com/Benjamin-Dobell/humble-bundle-key-redeeme...) but I had to drop Chrome support.

Thankfully Valve have added a web API to activate keys, so I've since released a much less stupid Chrome extension.

However, if you're interested in a practical example running JavaScript using AppleScript-style (it's actually Ruby) behaviour then check it out.

As with many power tools, that's actually really cool and there are some neat ways to use such a thing. It's just that in this case it's getting horribly abused to subvert the user's control of their own system.

(Examples: You could use such a thing to block ads, or archive sites as you browse them)

The images were broken for me, so I found the PDF a lot better of a read: https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%2...

I worked for other adware maker in IL (left after couple of months, when I realized how the company actually makes money), it's pretty big industry here since we have a lot of adtech and endless appetite for easy money. AMA.

OK, so how do I see if I am infected?

Look for com.<dictionary_word>.plist in ~/Library/LaunchAgents/ where <dictionary_word> is a random word from /usr/share/dict/words (the unix word file).

KnockKnock [1] is also a very nice tool that scans your system for stray launch agents, kexts, and browser extensions. It also passes what it finds through VirusTotal.

[1] https://objective-see.com/products/knockknock.html

Gross. If you want your adware/pup to act like malware, expect to be treated like malware.

Wait, osascript can inject HTML and Javascript into the DOM? How is that okay?

Most browsers have remoting capabilities - if you have the access needed to run OSAScript, you could also run ChromeDriver against a local copy of Chrome...

osascript is a desktop automation technology. It can do pretty much anything the current user can do, and the current user can inject things in to the DOM. It’s a very useful thing to be able to do when automating workflows.

I just wish Apple invested more in automation.

I wish that they invested more in ARD. It was such a beautiful thing using a single program locally installed to control 500+ machines. But the ARD application over the years has just become more and more broken to the point where I rarely use it and our organization has moved away from Apple towards ChromeOS devices. (I work for a school so that makes since when we implement google classroom and other services.)

I agree with my sibling comments that in current OSs, desktop apps — especially ones with root — are generally as privileged as the user, and that's (supposed to be!) a good thing.

However, Chrome's AppleScript support was used almost exclusively by malware, so it's disabled by default now: https://crbug.com/661810.

If Apple had invested as much in AppleScript as other parts of the OS I’m sure we’d see a ‘Can automate other applications’ setting in the Privacy controls. Not sure that’d help much here as the app is a Trojan but it’d be helpful to limit the activity while removing it.

We have one, to an extent. AppleScript is supposed to be IPC, so the published interfaces for AppleScript are governed by the applications responding to the requests. However, the generic "simulate human input" response is restricted using the "Allow these apps to control your computer" setting in System Preferences -> Security & Privacy -> Privacy -> Accessibility.

This was a nice write up which I enjoyed a lot. Thank you!

Reply on news.ycombinator.com