April 21, 2016 By Douglas Bonderud 2 min read

OS X has detractors and champions. Some laud the arm’s-length distance between users and fundamental processes, while others regard this distance as a failure waiting to happen when security threats breach the gate-kept trunk of Apple’s tree.

Both camps may have a point. Here’s a roundup of the good, the bad and the ugly security news for OS X.

The Good…

As noted by Threatpost, security researcher Partrick Wardle has developed a generic ransomware detection tool for the operating system. This is a kind of holy grail for ransomware spotting: It’s a tool that doesn’t depend on identifying specific strains but generalizes based on app behavior and stops offending processes before they get too far.

While OS X faces fewer ransomware attacks than its PC counterparts, Wardle’s RansomWhere? defense is still a step in the right direction. The researcher decided to act after he watched KeRanger sneak through Gatekeeper using a legitimate Apple developer ID.

RansomWhere? starts by determining whether a process is trustworthy — for example, those processes signed by Apple or directly approved by users. Unapproved apps are then monitored. If they start to encrypt files at high speed, they’re halted and a notification is sent to users.

Wardle pointed out that some files will be lost as the tool scans existing processes. His solution isn’t perfect since it can be bypassed, but overall it’s good news on the defense front.

The Bad…

On the bad side is old Git source code that’s included as part of the Command Line Tools package for Xcode, which is used by developers who create apps for OS X or iOS. According to CSO Online, the most recent version of the package comes with Git version 2.6.4, released in December 2015. But last month, two serious flaws — CVE-2016-2315 and CVE-2016-2324 — were discovered.

On the client side, these vulnerabilities make it possible for attackers to carry out remote code attacks, so on March 17, Git released version 2.7.4, which fixed both issues.

The problem? The Command Line Tools haven’t been updated to reflect this change. It’s also not easy to update Git alone on an Apple device, meaning both developers and new applications could be at risk.

…The Ugly

To address concerns over OS X hacks, Apple recently implemented the System Integrity Protocol (SIP), which prevents the modification of specific programs in certain directories even with root access.

As noted by TechWeekEurope UK, however, all OS and iOS versions earlier than 10.11.4 and 9.3 contain a flaw that allows attackers to escalate their privileges and bypass SIP using a phishing or browser attack. It also enables them to evade detection by other security programs. If users don’t update to the newest OS versions — released just last month — their mobile device or laptop could be modified without their knowledge or consent.

Good news? OS X got a generic ransomware detector. Not-so-good news? Outdated Git code and a vulnerable SIP could put users at serious risk.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today