Another macOS exploit

[Yoused]

Booby-trapped sites delivered potent new backdoor trojan to macOS users

Written from scratch, DazzleSpy is the latest advanced piece of Mac malware.

arstechnica.com

This thing is troublingly sophisticated, using vulnerabilities that show macOS has some poor security hygiene going on. Nevermind it uses zero-click entry, getting in directly through web page coding and silently gaining root access.

I hope we are not going to see a bunch more of this nonsense.

 

[User.45]

Booby-trapped sites delivered potent new backdoor trojan to macOS users

Written from scratch, DazzleSpy is the latest advanced piece of Mac malware.

arstechnica.com

This thing is troublingly sophisticated, using vulnerabilities that show macOS has some poor security hygiene going on. Nevermind it uses zero-click entry, getting in directly through web page coding and silently gaining root access.

I hope we are not going to see a bunch more of this nonsense.

Indeed, researchers from Google’s threat analysis group who first uncovered the exploits said that, based on their analysis of the malware, they “believe this threat actor to be a well-resourced group, likely state-backed, with access to their own software engineering team based on the quality of the payload code.”

As the Google researchers first noted, the malware was spread in watering-hole attacks that used both fake and hacked sites appealing to pro-democracy activists in Hong Kong.

Well...

 

[Joe]

Apple is just using this as an excuse to close MacOS like iOS. It's for the children!

 

[Cmaier]

Apple is just using this as an excuse to close MacOS like iOS. It's for the children!

As long as Xcode works, I’d be fine with that.

 

[Yoused]

As long as Xcode works, I’d be fine with that.

Back in the '80s & '90s they had this awesome tool called HyperCard — Xcode and Cocoa made slapping together a thing that does some stuff almost that easy.

 

[Cmaier]

Back in the '80s & '90s they had this awesome tool called HyperCard — Xcode and Cocoa made slapping together a thing that does some stuff almost that easy.

I remember HyperCard well. Hell, Myst started out as a HyperCard app.

 

[jbailey]

Booby-trapped sites delivered potent new backdoor trojan to macOS users

Written from scratch, DazzleSpy is the latest advanced piece of Mac malware.

arstechnica.com

This thing is troublingly sophisticated, using vulnerabilities that show macOS has some poor security hygiene going on. Nevermind it uses zero-click entry, getting in directly through web page coding and silently gaining root access.

I hope we are not going to see a bunch more of this nonsense.

From the article:

Apple has since patched the vulnerabilities exploited in this attack.

 

[Huntn]

Booby-trapped sites delivered potent new backdoor trojan to macOS users

Written from scratch, DazzleSpy is the latest advanced piece of Mac malware.

arstechnica.com

This thing is troublingly sophisticated, using vulnerabilities that show macOS has some poor security hygiene going on. Nevermind it uses zero-click entry, getting in directly through web page coding and silently gaining root access.

I hope we are not going to see a bunch more of this nonsense.

Hopefully Apple is all over this.

 

[Yoused]

Hopefully Apple is all over this.

As jbailey notes, they did patch the vulnerability. Still, modern CPUs have all raft of tools they can use to make sure shit like this does not have an attack vector. For example, the exploit wrote some stuff and then jumped right into it: a secure OS should make all its memory NX (non-executable) except for the very small spots where actually machine code runs. It would not fix everything, but it would shut one way in.

 

[Nycturne]

As jbailey notes, they did patch the vulnerability. Still, modern CPUs have all raft of tools they can use to make sure shit like this does not have an attack vector. For example, the exploit wrote some stuff and then jumped right into it: a secure OS should make all its memory NX (non-executable) except for the very small spots where actually machine code runs. It would not fix everything, but it would shut one way in.

JavaScript engines tend to be a source of problems related to NX flagging of pages. While macOS has supported it by default for the heap and stack for 64-bit executables, you do have to disable it in places for the JIT to work, and while I haven’t read up on this specific exploit, I suspect part of the exploit abuses the gaps a JIT engine like JavaScriptCore provides.

I remember HyperCard well. Hell, Myst started out as a HyperCard app.

As a bit of a fan of Rand and Robyn Miller’s works, there’s their work that led up to Myst that was all HyperCard. The Manhole, Cosmic Osmo and Spelunx.