OSX Pirrit : Why you should care about malicious mac adware

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

#RSAC
OSX Pirrit:
Why You Should Care About Malicious
Mac Adware
Amit Serper
Principal security researcher, Cybereason,

#RSAC
OSX.Pirrit
2

#RSAC
$ whoami
3
• Amit Serper (What’s with the weird name, dude?)
• Principal security researcher @ Cybereason
Low level ...

#RSAC
$ cat /Users/amit/agenda.txt
4
1. For those that weren’t around 15 years ago: Intro to adware
2. This apple is getti...

#RSAC
Intro to Adware
5
• Adware usually gets to your machine with installers.
• These installers install a program that y...

#RSAC
Intro to Adware
6
1. Software that resides on one’s machine and displays ads
2. Adware divide into several categorie...

#RSAC
Adware on the Mac
7
1. Similar to windows, adware to OS X comes usually in the form of
toolbars
2. These toolbars ar...

#RSAC
Adware on the Mac
8
1. Similar to windows, adware to OS X comes usually in the form of
toolbars
2. These toolbars ar...

#RSAC
The story begins…
9
• An irc user “Xiano” popped in to #osxre @ freenode and told us that his
friend’s mac is acting...

#RSAC
The story begins…
10

#RSAC
Qt?
• Qt (pronounced cute) is a cross-platform application
development framework
• Allows a developer to maintain a ...

#RSAC
The story begins… (continued)
http://forums.macrumors.com/threads/what-is-unillumination-process-mavericks.1966015/

#RSAC

#RSAC

#RSAC

#RSAC
Let’s look at the binary (strings table)

#RSAC
Another URL in the strings table

#RSAC
Let’s google that url…
http://shorte.st/st/2904deaf2db062b776f39f499bf88ad9/%1
Gives 1 result to a JoeSandbox analys...

#RSAC
Shorte.st – URL shortening service

#RSAC
Let’s Google that….

#RSAC
Let’s look at the script – rec_script.sh

#RSAC
Windows is easy…

#RSAC
But removal instructions for mac?
What is… “No”.

#RSAC
Xiano was back with more…
• He found an app bundle called “DemoUpdater”
on his friend’s machine.
• He mentioned that...

#RSAC
In the executable - Suspicious functions and strings galore!

#RSAC
Mysterious domains
*.93a555685cc7443a8e1034efa1f18924.com
*.aa625d84f1587749c1ab011d6f269f7d64.com
*.2ff328dcee054f2...

#RSAC
And also… Some more windows crap

#RSAC
But what about that update2 shell script?
• When the executable finishes running, it executes Update2.sh
• It’s a HU...

#RSAC
So here’s what we know until now
• It’s an adware
• It generates traffic
• It’s cross-platform
• It’s definitely try...

#RSAC
But here’s what no one knows
How the hell did people get infected?!

#RSAC
FLASH FORWARD!

#RSAC
FLASH FORWARD!

#RSAC
• Mac equivalent of the MSI (Installer file)
• An extensible archive format (XAR)
• Has a nice wizard with useful EU...

#RSAC
• Pkg files are a very convenient way to drop
malware
• You can codesign them
• And you can just use the scripting f...

#RSAC
PKG file – Suspicious package
http://www.mothersruin.com/software/SuspiciousPackage/

#RSAC
PKG file – Suspicious package

#RSAC
Let’s Look at this Script

#RSAC
Entire Process
User downloads
crack
Gets pkg
Pre install script
runs
Script
downlodas
“DemoUpdater”
component
DemoUp...

#RSAC
DemoUpdater
• DemoUpdater is the first component that’s actually being installed by Pirrit.
• This is the component ...

#RSAC
DemoUpdater
• The script then carries on with creating the DemoUpdater bundle and
executable while not forgetting to...

#RSAC
Wait… LaunchDaemons?
• A LaunchDaemon is an autorun in Mac speak
• It loads when the computer boots
• And just like ...

#RSAC
The soil is ready… Now – plant the seed
• After all of the basic building blocks were layed, it is time for the main...

#RSAC
The soil is ready… Now – plant the seed
• The proxy is called DemoInjector.
• It is also a QT project.
• It also has...

#RSAC
A hidden user… Oh my!

#RSAC
Hide500Users?

#RSAC
Someone was reading Apple documentation 
https://support.apple.com/en-il/HT203998

#RSAC
Someone was reading Apple documentation 

#RSAC
Another LaunchDaemon, this time for DemoInjector

#RSAC
And now – Traffic redirection!
• DemoInjector is listening on 127.0.0.1:9882
• All of the packets that are generated...

#RSAC
Aaaaand… Profit!

#RSAC
Droppers… Droppers everywhere!

#RSAC
Uncovering the perpetrators
• Like all good things… It happened totally by accident!
• I just got a fresh sample of ...

#RSAC
Uncovering the perpetrators

#RSAC
A quick LinkedIn search for the name…

#RSAC
TargetingEdge? Boy… Their product sounds just like Pirrit!

#RSAC
Buzz is created!
• About 40 different papers/news site cover OSX/pirrit
• Including: ThreatPost, Ars Technica, SC Ma...

#RSAC
Calcalist – Isreal’s ‘The Economist’
TargetingEdge’s response (translated from Hebrew):
“We’ve read Cybereason’s hig...

#RSAC
P.S – this is awesome… Exhibit B - CV

#RSAC
Conclusion

#RSAC
Thanks!
• PATRICK WARDLE / OBJECTIVE-SEE.COM /
@PATRICKWARDLE
• My pals from Cybereason for the moral support
YOU!

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 60 Ad

View on Slideshare

1 of 60 Ad