It shouldn’t really be a surprise when a Mac is attacked via malware. Admittedly, the larger number of Windows systems in use has influenced the route that cybercriminals usually choose, which typically meant fewer occurrences of Mac malware. But, despite the lower numbers of Mac systems, 9to5Mac reported that Mac-targeted attacks rose 744 percent in 2016 Q4, according to data from McAfee Labs.

A New Mac Malware

Checkpoint Software found a new example of malware infecting German users. It is part of a major effort, made up of several different schemes.

Dok, as it is called, is able to totally take over a Mac until the infection process is complete and then erase itself. Attackers will gain complete access to all the victim’s communication, including communication that is SSL encrypted — a particular trick done by redirecting traffic through a malicious proxy server. Bleeping Computer reported the malware had a zero percent detection rate on VirusTotal when it was discovered.

The virus starts off as a malicious attachment in a phishing email. When the attached is opened, it first sets up a fake login item in the AppStore. That ensures persistence of the malware when the computer is restarted.

In the second phase, a fake window asserts that new OSX updates are available for download. It may stop all other windows from becoming active while displayed. Clicking the window’s OK button brings up a dialog box the user is directed to fill in, providing the Mac’s administrative password.

Once it has that password, Dok goes to town, installing a new root certificate. It also changes the network settings so all outgoing connections must pass through a proxy. That proxy is dynamically changed using a Proxy AutoConfiguration (PAC) file, which sits on a malicious server.

Bringing in Basic Security Practices

Certain preventable actions are necessary for this malware scheme to succeed. For example, users should not to click on unknown attachments, which applies to a lot of malware attacks. Secondly, they should not give an unknown dialog box the system’s administrative password. A page that tries this is nonstandard, which serves as a dead giveaway.

Ultimately, the question is, “How did the malware get a valid developer certificate?” There is a feature called GateKeeper on Macs that stops unknown programs from running unless a valid certificate is present. Yet, this malware somehow bypassed the security feature.

Apple needs to carefully check its entire issuance process so this doesn’t happen again, as well as immediately revoke the malware’s certificate.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…