Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...
All started with iPhone...:)
Some days ago I had to replace the battery on my wife's iPhone, and after that I noticed that the Wifi was not working properly anymore...so I decided to check on Google for pictures of the iPhone antenna so that I could open again and verify if I left anything loose (which later I found to be the case...) :) .
A regular search for "iphone wifi antenna" (BE CAREFUL) and I got several hits...and as Google is proactive, it also showed some examples of pictures related to my search.
Well, I decided to see one of the pictures and clicked on it. It then started to load and suddenly was redirected to another page, which looked like my Finder screen:
As you can see, this looks a lot as a common Finder screen. It also looks a LOT like the common FakeAV (FakeAlert) tactics for Windows, where they use JavaScript to simulate a fake scan on "My Computer", showing all drivers and folders being scanned.
That is exactly what happens on the next screenshot:
Note that everything is really well crafted to look real. On Windows systems they use real detection names for the fake trojans found on the system. Here they use detection names to resemble Mac trojan names, which includes the OSX on the name.
Whenever you press Cancel or Remove All it will push the "anti-malware.zip" file which is actually a .DMG file (the one used by Mac OSX).
At the time of this diary, only 17 of 42 AV detects it on VirusTotal, some as MacDefender, some as Downloader.OSX.
--------------------------------------------------------------
Pedro Bueno (pbueno /%%/ isc. sans. org)
Twitter: http://twitter.com/besecure
Comments
D. O'Leary
Jun 15th 2011
1 decade ago
Tom
Jun 15th 2011
1 decade ago
If the bad guys ever learn to spell and write correctly, we may have bigger problems :)
TonyH
Jun 15th 2011
1 decade ago
It does look like a Finder window, if you ignore all the little extra things from the fact that is is a lookalike displayed in a Chrome window. You're looking at this as someone who knows window decorations, these infections work on the fact that the majority of users would have no idea what I was talking about when I said Window Decorations.
Most people who have updated their Macs in the recent past know Apple pushed something to catch MacDefender. They've never seen it before so something they've never seen before claiming to be "Apple Security Center" is going to get a easy pass and be assumed to be legit.
Third, your problem with this is again related to the first. Ya this would never pass Apples HIG, do you honestly believe the majority of users know or care to know that?
As others pointed out it also has all the grammar issues as many other pieces of malware. That malware is also installed all the time. People do not pay attention. This and all malware like it rely on that and are doing very well with it.
SMB
Jun 15th 2011
1 decade ago
True, but what makes you think a large fraction of users are any better than that with _their_ grammar and spelling?
John Hardin
Jun 15th 2011
1 decade ago
Old Dad
Jun 15th 2011
1 decade ago
What happen to the MacDefender that I submitted on Mother's Day?
I haven't seen any write up or analysis on the 1st Gen MacDefender pkg.
I think some of that analysis would have been great to add to this diary post.
HackDefendr
Jun 15th 2011
1 decade ago
dsh
Jun 15th 2011
1 decade ago
To date, the level of sophistication used in the everyday virus and spam attacks just isn't that great from an educated user point of view. But its that visible lack of sophistication that makes their attack that much more professional.
So what do we do when someone more professional attacks my network? I can't say, but all of this less professional attacking is helping us learn, and be more prepared. Its the really good hackers that we never hear about until its too late, so all you can do is be as prepared as you can and hope its enough when a big hack happens.
--
Jeff
HackDefendr
Jun 15th 2011
1 decade ago