Newly discovered Mac malware uses “fileless” technique to remain stealthy | Hacker News Reader

Newly discovered Mac malware uses “fileless” technique to remain stealthy

arstechnica.com

Yet another virus for OSX that you have to manually download a DMG and install to be vulnerable to. Not to be obnoxious, but I'm still waiting for a Windows-style virus that can proliferate with no action on the user's behalf. That would be legitimate cause for concern.

Malware that can proliferate on Windows boxes without user action almost always requires some remote code execution vulnerability (or some security misconfiguration issue) to be exploited first. This is true for macOS as well. That cycle is usually:

Exploit vuln -> download malware payload -> execute malware

I think that was GP's point as well. That fully hands-free RCE process just doesn't seem to happen as often on OSX as on windows. Whether that's because of market share, software differences, or something else remains open for debate.

> Newly discovered Mac malware uses “fileless” technique to remain stealthy

...

> The malware isn’t entirely fileless. The first stage poses as a cryptocurrency app with the file name UnionCryptoTrader.dmg

Come on...

It's explained in the article and in more detail in the longer analysis it links

https://objective-see.com/blog/blog_0x51.html

The 'fileless' part is about getting the executable payload that does the actual malwarin' into memory without touching the filesystem.

Except for the part about moving a launch script into /Library/LaunchDaemons to achieve persistence.

That's the scaffolding, basically. A launch script in itself is not malicious and the idea is this would be less noticeable to automated or manual scans.

>An executable file in itself is not malicious

I'm not sure who you're quoting but it's not me. Easiest way to get a more detailed explanation is to read the linked technical analysis. The idea is to obfuscate and make detection harder by not-placing the actual final payload on the filesystem. Staging more-malicious things through things that look less-malicious is pretty much what makes malware mal.

TLDR: this probably doesn't affect you if you're not on crypto exchanges.

Check if you're affected:

    ls /Library/LaunchDaemons/vip.unioncrypto.plist
    ls /Library/UnionCrypto/unioncryptoupdater

So, there are files?

Yeah it seems like there are. I guess to a layman user there don't appear to be, because they're in hidden directories?

But also how many layman users are going to crypto exchanges on a mac?

Yes. It is not in any sense fileless.

Not exactly fileless. There's a persistent component that remains on-disk (disguised as a cryptocurrency app), and when the OS launches it after boot it contacts a server to download the malicious, in-memory payload.

The curious thing here is I noticed this in my News app on my iPhone, I went to read more, but I had a message saying the story had been removed.

Yet here it is; still on Ars Technica.

Am I to infer that Apple censured this story in their News App?

Its not appearing as a story in the Ars Technica channel, even thought it was recently posted.

Does this then suggest that this is a hot issue for Apple?

> Am I to infer that Apple censured this story in their News App?

I mean, I guess that's possible, but it seems much more likely that this is just a bug. The Apple News app can be weird sometimes.

AFAIU Apple doesn't touch much of the individual channels. They editorialize the main feeds by hand. If it's gone from Ars' channel then Ars must have removed the article from Apple News for whatever reason, possibly even by mistake.

I've noticed this with other stories, it feels more like we clicked the link when it wasn't updated to the latest news, somehow taking us to a stale page.

It doesn't feel like censorship from what I've experienced, more like a link going stale or something - theres not really any common themes in the articles ice noticed.

Much more critical stories of Apple than this one have been published on the News app. It's 100% a bug. Can you imagine the PR disaster if it turned out Apple was actively censoring negative stories about itself?

A bug?

So how many stories don't get through. Is it that tricky to get a feed of stories and match them up with items appearing in the newsfeed?

If its not going through you go back and check to see where the story is lost. I've done this on websites I was supporting, finding that people copying and pasting from PDF seem to have picked up a number of unicode control characters that hadn't been rinsed out when stored in SQL, and caused the web API to splutter.

This was for item records clients were paying for so dropping records looks a bit naff.

Enough of me though, dare I say it News has just one job, to show news.

Reply on news.ycombinator.com