Warning as Mac malware exploits climb 270%
Credit to Author: Jonny Evans| Date: Mon, 12 Mar 2018 05:56:00 -0700
Reputable anti-malware security vendor Malwarebytes is warning Mac users that malware attacks against the platform climbed 270 percent last year.
The security experts also warn that four new malware exploits targeting Macs have been identified in the first two months of 2018, noting that many of these exploits were identified by users, rather than security firms.
In one instance, a Mac user discovered that their DNS settings had been changed and found themselves unable to change them back.
This particular item of malware (OSX.MaMi) also installed a trusted root certificate on the person’s Mac. The threat left the user vulnerable to fraudulent phishing websites posing as the real deal and man-in-the-middle attacks.
The researchers also identified a new Java-based exploit targeting Macs that is based on malicious code likely developed for nefarious purposes by a nation state. Another attack included deployment of malicious links on a popular software downloads website.
Malwarebytes warns that such attacks are on the increase, adding that while Mac users are using secure platforms, they should not consider macOS to be “bulletproof.”
There is a wide perception that Apple’s platforms are invulnerable to such attacks, but it’s a misplaced belief.
It is, of course, true that Macs (and iOS devices) are far more secure than other platforms, but this does not make them invulnerable.
The perception that Apple’s platforms are more secure must be tempered with caution — particularly as its platforms enter the enterprise.
“Apple’s macOS includes some good security features that are helpful, but they are easily bypassed by new malware, and they don’t address the adware and PUP problem at all,” Malwarebytes warns.
Attacks can be complex.
Think about the XcodeGhost exploit in 2015, in which a fake copy of Xcode that injected malware into apps developed using it was distributed. The effect was that multiple malware-infested apps appeared (albeit briefly) on Apple’s App Store. The attack was spotted fast and dealt with, but the story proves the need to exercise some caution.
The most professional attacks are motivated by money, and attacks cost money to create.
While it remains true that mounting successful attacks against Macs is costly, there is always the risk that attackers will use complacency concerning security within more complex attempts.
Meanwhile, we see browser-based attacks proliferate while hackers buy and sell Apple ID details for $15 a time.
Security firms I’ve spoken to warn that professional hackers will use different forms of attacks against different platforms, all connected to the same command and control systems. In this way, they seek to break through existing enterprise security protections.
The scale of enterprise security threats needs to be understood.
A Ponemon Institute report claims that as many as 3 percent of the mobile devices being used across the enterprise are affected by malware at any given time, and in many cases, the company is unaware of the problem.
The move to defend against such incidents is prompting development of mobile threat detection systems that monitor device and network traffic for signs that an exploit may have taken place.
As the number of attacks against macOS and Apple’s other platforms climbs, it seems reasonable that users take steps to inform themselves of good security practise and to put them into place to protect themselves:
There’s no need for panic. Apple, Cisco, Aon, and Allianz recently launched a security insurance system that confirms Apple’s platforms can be more secure.
However, as the scale and number of threats intensify, it makes sense to follow good security practices as you go about your Mac life, particularly if you use your system to handle confidential, financial, or enterprise data.
Google+? If you use social media and happen to be a Google+ user, why not join AppleHolic’s Kool Aid Corner community and get involved with the conversation as we pursue the spirit of the New Model Apple?
Got a story? Please drop me a line via Twitter and let me know. I’d like it if you chose to follow me there so I can let you know about new articles I publish and reports I find.