Tag Archive for: macOS

New Mac Malware Hijacks Web Connections: What to Do

/in ,

“2018 is barely two weeks old, and already it looks like we’ve got new piece of macOS malware! Hooray :)”

That’s how Apple-focused security researcher Patrick Wardle opened a blog post on Jan. 11, detailing what Wardle calls “MaMi,” a stealthy DNS hijacker that reroutes your internet traffic to possibly malicious websites.

MaMi also has abilities that haven’t yet been activated: It can steal passwords, take screenshots, download files and programs, run other pieces of software and inject bogus security certificates.

Check If You’re Infected

To see whether your Mac was infected by MaMi, go to System Preferences, click on the Network section and check the IP address of your DNS server. If it’s “82.163.143.135” or “82.163.142.137,” then you’ll need to change it to something benign, such as Google’s 8.8.8.8 or 8.8.4.4 or OpenDNS’s 208.67.2222.222 or 208.67.220.220.

Notice we said “was” infected. The MaMi sample that Wardle found deleted itself after changing the DNS settings on his test machine, so even if you found a smoking-gun DNS setting, the malware that did it may be long gone.

How to Prevent Infection

To prevent infection by MaMi, use common sense. Every piece of Mac malware found in recent years has required user approval, presumably unwitting, to be installed.

So don’t authorize that Adobe Flash Player update, that video player you apparently need to see a clip of a naked celebrity, or that antivirus software that showed up in a pop-up window telling you your Mac was infected. Instead, hold off and get Mac antivirus software straight from the source.

It’s not yet known how MaMi (named after a text string Wardle found in the code) infects a Mac, though Wardle suspects “rather lame methods such as malicious email, web-based fake security alerts/popups or social-engineering type attacks.” But as of this writing, only one antivirus scanning engine in the online VirusTotal repository detects MaMi through the usual file-matching methods.

How MaMi Malware Works

DNS servers are the phone books of the internet. They match human requests with network addresses  so that, among other things, you can see this website in your web browser.

DNS hijacking sends a computer to a malicious DNS server that could, for example, send you to an evil version of Tom’s Guide that could infect you with even more malware.

It’s not clear how widespread MaMi is so far. Wardle was tipped off to it by a posting on a Malwarebytes forum, but didn’t explain how he located his own copy. Wardle did point to a website that automatically downloaded the binary to our computer when we connected. (We’re using a Windows PC, so the malware didn’t do anything to us.)

tomsguide.com

macOS High Sierra Bug Lets Anyone Gain Root Access Without a Password

/in , ,

If you own a Mac computer and run the latest version of Apple’s operating system, macOS High Sierra, then you need to be extra careful with your computer.

A serious, yet stupid vulnerability has been discovered in macOS High Sierra that allows untrusted users to quickly gain unfettered administrative (or root) control on your Mac without any password or security check, potentially leaving your data at risk.

Discovered by developer Lemi Orhan Ergin on Tuesday, the vulnerability only requires anyone with physical access to the target macOS machine to enter “root” into the username field, leave the password blank, and hit the Enter a few times—and Voila!

In simple words, the flaw allows an unauthorized user that gets physical access on a target computer to immediately gain the highest level of access to the computer, known as “root,” without actually typing any password.

Needless to say, this blindingly easy Mac exploit really scary stuff.

This vulnerability is similar to one Apple patched last month, which affected encrypted volumes using APFS wherein the password hint section was showing the actual password of the user in the plain text.

Here’s How to Login as Root User Without a Password

If you own a Mac and want to try this exploit, follow these steps from admin or guest account:

  • Open System Preferences on the machine.
  • Select Users & Groups.
  • Click the lock icon to make changes.
  • Enter “root” in the username field of a login window.
  • Move the cursor into the Password field and hit enter button there few times, leaving it blank.

With that (after a few tries in some cases) macOS High Sierra logs the unauthorized user in with root privileges, allowing the user to access your Mac as a “superuser” with permission to read and write to system files, including those in other macOS accounts as well.

This flaw can be exploited in several ways, depending on the setup of the targeted Mac. With full-disk encryption disabled, a rogue user can turn on a Mac that’s entirely powered down and log in as root by doing the same trick.

At Mac’s login screen, an untrusted user can also use the root trick to gain access to a Mac that has FileVault turned on to make unauthorized changes to the Mac System Preferences, like disabling FileVault.

All the untrusted user needs to do is click “Other” at the login screen, and then enter “root” again with no password.

However, it is impossible to exploit this vulnerability when a Mac machine is turned on, and the screen is protected with a password.

Ergin publicly contacted Apple Support to ask about the issue he discovered. Apple is reportedly working on a fix.

“We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”

Here’s How to Temporarily Fix the macOS High Sierra Bug

Fortunately, the developer suggested a temporary fix for this issue which is as easy as its exploit.

To fix the vulnerability, you need to enable the root user with a password. Heres how to do that:

  • Open System Preferences and Select Users & Groups
  • Click on the lock icon and Enter your administrator name and password there
  • Click on “Login Options” and select “Join” at the bottom of the screen
  • Select “Open Directory Utility”
  • Click on the lock icon to make changes and type your username and password there
  • Click “Edit” at the top of the menu bar
  • Select “Enable Root User” and set a password for the root user account

This password will prevent the account from being accessed with a blank password.

Just to be on the safer side, you can also disable Guest accounts on your Mac. for this, head on to System Preferences → Users & Groups, select Guest User after entering your admin password, and disable “Allow guests to log in to this computer.”