New PamStealer macOS Malware Uses Clever Tradecraft To Remain Stealthy (arstechnica.com) 38
An anonymous reader quotes a report from Ars Technica: Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code. The malware is delivered in two stages. The first is distributed in a disk image that masquerades as Maccy, a clipboard manager for Macs. It's compiled as AppleScript that is notable for the way it delivers the second stage. The malware is named PamStealer because the Rust-written infostealer uses the Pluggable Authentication Modules interface built into macOS to validate the target's login password before sending it to an attacker-controlled server.
[...] PamStealer shows a native password prompt designed to resemble a system authorization request. Text that appears with the prompt says: "Maccy wants to make changes. Enter your password to allow this." As noted earlier, once a target complies, the malware validates it locally through the PAM API. "This check is done entirely through PAM: there is no call out to dscl, security, osascript or any spawned process to verify the password, as many commodity macOS stealers do," [said Jamf, a security firm for macOS users]. "The result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on."
If the validation fails, PamStealer displays the prompts again until it receives the correct one. Once the target enters the correct password, PamStealer displays a message stating that the file is damaged and can't be installed. This is designed to be a decoy to prevent the target from suspecting anything is amiss. The malware uses tactics to maximize the information it can steal. One tactic is to request the target grant full disk access to the fake Maccy app. It also contains code designed to access ethereum accounts. The various techniques -- particularly the Script Editor lure, a self-contained JXA dropper, a Rust-based second stage, and local validation of credentials through PAM are all noteworthy.
[...] PamStealer shows a native password prompt designed to resemble a system authorization request. Text that appears with the prompt says: "Maccy wants to make changes. Enter your password to allow this." As noted earlier, once a target complies, the malware validates it locally through the PAM API. "This check is done entirely through PAM: there is no call out to dscl, security, osascript or any spawned process to verify the password, as many commodity macOS stealers do," [said Jamf, a security firm for macOS users]. "The result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on."
If the validation fails, PamStealer displays the prompts again until it receives the correct one. Once the target enters the correct password, PamStealer displays a message stating that the file is damaged and can't be installed. This is designed to be a decoy to prevent the target from suspecting anything is amiss. The malware uses tactics to maximize the information it can steal. One tactic is to request the target grant full disk access to the fake Maccy app. It also contains code designed to access ethereum accounts. The various techniques -- particularly the Script Editor lure, a self-contained JXA dropper, a Rust-based second stage, and local validation of credentials through PAM are all noteworthy.
Happy to see... (Score:5, Funny)
Re: (Score:3)
It's memory safe!
Re: (Score:1)
It's got electrolytes!
Re: (Score:2)
I have a ":w! saves" mug ;)
Re: (Score:2)
Jesus Saves... Buddha makes incremental backups.
Re: (Score:2)
Exactly. For once, the attackers show the world how it is done!
Bypassing notarization (Score:3)
Re: (Score:2)
What has AppleScript to do with that?
Same problem if it was a Bash script or a compiled C program ...
Re:Bypassing notarization (Score:4, Interesting)
This has nothing to do with AppleScript. It has to do with the boneheaded decision to have Mac OS X and its successor constantly prompting users for passwords to do "admin" things, even if they're logged in as an admin. This has been a flaw since 10.0, and I was complaining about it in the 10.2 days, and getting told I shouldn't worry my pretty little head about it and that nobody would ever write malware that puts up something that looks like a system request for your password, such a fraud would be unpossible!
If you want to have your operating system to request a user prove they're who they say they are, you need to have the OS prove it is what it says it is to the user first. Otherwise requiring passwords to authenticate is literally useless. Your OS is insecure. The only question I have is why it's taken 25 years for the actual malware writers to notice.
Re: (Score:1)
Re: Bypassing notarization (Score:3)
Not even adminy stuff, why TF do I need to enter a password just to run the lldb debugger as me on one of my own binaries??
Re: Bypassing notarization (Score:2)
I donâ(TM)t get prompted like this. Is this is an extra step in Apple Silicon machines or Iâ(TM)ve just granted more permissions to my terminal?
Re: (Score:2)
Its an x86 mini. Given its run from the shell I doubt terminal permissions come into it.
Re: (Score:2)
And you Terminal is listed under "Developer Tools" in Privacy & Security? FWIW, mine is also listed under "Full Disk Access".
I'm on an Intel MBP. lldb never requires a password. I only debug command line apps - maybe that's it?
Re: (Score:2)
Mac users are not logged in as admins.
If they have the (admin) besides their username, it means they can use sudo. Aka they are in the "wheel" group and listed in the sudoer file.
When they log on, they are ordinary users.
In the case in question it was pretty obvious that it was not a password request from the System. So no idea about what you are complaining.
Sounds more like PamAsker. (Score:2)
Re: (Score:3)
Asking for it in a situation where a user would expect to have to enter it, so they won't find the request unusual or suspicious.
Re: (Score:2)
asking for a password every ten minutes.
seeing an advertisement every ten seconds.
a feature being removed every week.
a pop-up asking you to enable some dumb-ass feature (for the 10th time) in the middle of text entry.
a web page still loading even though it looks done and resetting the search box in the middle of entering a search term.
lack of buttons to control basic safety features on your new car.
walking throu
Lol (Score:4, Interesting)
Same sort of technique I used back in secondary school, lol ;) We had a programming class (in Basic on DOS), and it was painfully trivial, so I'd always complete the assignments in like 5 minutes and then spend the rest of class messing around. So one thing I wrote was a program that mimicked the DOS prompt, including common commands, and when someone ran the login command and typed in their username and password, it would say that the password was incorrect so they'd think they had typed it wrong (while it was actually saving their username and password, then logging out of my account), so that when they tried again, it worked. I would launch on a bunch of computers in the lab after class when I could get away with it..
Among the passwords collected were the teacher's administrator username and password. So when it came time to write my final project for the course, among the various demo-style scenes in it was a stereogram generator. The hidden image in the stereogram was her username and password. ;)
(Thankfully she had a good attitude about it... seemed like she wanted to get mad at me but also found it funny. In retrospect, that could have gone very badly had she gotten angry...)
Re: (Score:2)
Re: (Score:2)
Not "logging into DOS" - logging into your account. I literally said "mimicked the DOS prompt, including common commands", e.g., you're at the DOS prompt. When you want to login, you ran LOGIN.EXE, which "mounted" your network account. I believe it was Novell NetWare-based.
Re: (Score:2)
I have to ask: did you literally never use a computer lab at all in the DOS era?
Must be a slow news day (Score:2)
Re: (Score:2)
Thank God Mac OS X hasn't been training people to enter their admin password whenever they install anything or do anything adminy using an easily replicated dialog since 2001. Otherwise people might fall for this!
Re: (Score:2)
Like sudo?
Re: (Score:2)
It's asking for the root password. How can Sudo help? Maybe you can hack the installer to use your jailed account? I'm not sure how this fixes anything. If you were doing the install from the command line, sure. But not a hard coded script app.
Re: (Score:2)
They’re saying linux does the exact same thing.
Re: (Score:3)
Yes, exactly. Although, after thinking about it, the way systemd automatically asks for root's password when any unprivileged user attempts to run a systemctl task that requires privilege is probably a more similar example.
Re: (Score:2)
On Macs you don't "install" software. You copy the application from the distribution medium into the /Applications folder, that is it.
The only stuff you "install" are things like VirtualBox hat actually do install a low level driver which is used for an virtual ethernet bridge.
If the system asks for password it is indeed a non fakeable system dialog. So no idea what you are complaining about.
Always Worry (Score:2)
Every time I install a 3rd party app, I worry about typing my password for anything. I mean I guess I could change root, install the app, and change root back. That is the number one reason I do NOT hate the walled garden. It can be annoying, but the odds are that your apps are safe.
Re: Always Worry (Score:2)
the older and dumber i get, the more i appreciate the walled garden, all its glaws notwithstanding.
Re: Always Worry (Score:2)
Iâ(TM)m wondering whoâ(TM)s typing passwords these days for elevation. Havenâ(TM)t all Mac laptops had Touch ID for years? I have an external keyboard, but itâ(TM)s still easier and faster to reach over to my MBP for one touch authentication.
Apple Security (Score:2)
has always been mostly an illusion. The reality is Apple's security is pretty awful. It's trivially easy to bypass pretty much all of it, even remotely, and most Apple users are too stupid to prevent it.