• Grant Harrington On Twitter: Installed @1password Beta 7 For Mac Download
• Grant Harrington On Twitter: Installed @1password Beta 7 For Mac Pro

​ Month in Review: Apple Security in February 2018 Posted on March 6th, 2018 by February brought to light four families of Mac malware: Intego discovered OSX/Shlayer, two RATs were found, and a popular Mac software download site distributed Trojanized versions of Firefox, OnyX, and Deeper. Meanwhile: a single Telugu character allowed pranksters to crash iOS devices and Macs, Apple's T2 chip brings security improvements to the new iMac Pro, and a government contractor claims it can unlock any iOS device. Read on for these stories and more! New Mac Malware: OSX/Shlayer Discovered by Intego In mid-February, Intego researchers discovered OSX/Shlayer, an interesting new twist on a classic malware attack. OSX/Shlayer comes in the form of a fake Flash Player installer, but what's unusual is that it leverages code-signed shell scripts to do its dirty work.

Grant Harrington On Twitter: Installed @1password Beta 7 For Mac Download

Intego researchers found OSX/Shlayer spreading via BitTorrent file sharing sites, appearing as a fake Flash Player update when a user attempted to select a link to copy a torrent. Of course, readers who don't search for torrents should still be wary; fake Flash Player alerts can be found in many places on the Web. OSX/Shlayer is both a Trojan horse—meaning that it masquerades as something that it's not, in this case a Flash Player installer—and a dropper, meaning that its main purpose is to download a secondary infection. Intego observed variants of OSX/Shlayer downloading and installing OSX/MacOffers or OSX/Bundlore adware onto infected Macs. Intego VirusBarrier was the first anti-virus software to detect this malware; its three variants are detected as OSX/Shlayer.A, OSX/Shlayer.B, and OSX/Shlayer.C. VirusBarrier also detects the secondary adware infections. For more details about OSX/Shlayer, shell scripts, and code signing, see our featured article: New Mac Malware: OSX/Coldroot RAT Coincidentally, the same weekend that Intego researchers discovered OSX/Shlayer, Patrick Wardle smelled a RAT.

In preparation for a talk at an upcoming security conference, Wardle searched VirusTotal for a sample of malware that attempts to directly modify a macOS database file (TCC.db) to grant itself special permissions. He found a sample that was undetected by all 60 of VirusTotal's anti-virus engines but that nevertheless looked suspicious to a trained researcher's eye.

Grant Harrington On Twitter: Installed @1password Beta 7 For Mac Pro

Wardle discovered that the sample was a previously undetected RAT—a remote administration tool designed to be installed with malicious intent, without the user's knowledge. Evidently developed in 2016 and 2017, the malware had kept a low profile until Wardle's discovery.