Mac PCs are unprotected against malware

Patrick Wardle is a former NSA staffer that turned to a security researcher, the expert explained that his main concern is that MAC OS X security tools in the market are trivial and easy to bypass.

One of the most known applications in Macs its Gatekeeper, but Patrick says that Gatekeeper can be easily misguided to run unsigned code, and according to him it is “easy to get around“ the Gatekeeper protections like XProtect anti-malware, sandboxing and kernel code-signing.

As a former NSA staffer, Patrick Wardle worked closely with Apple security team and describes them as a responsible team that always worked to improve security of their OS. The expert highlighted that what could make Apple better in terms of security would be using the same “bug bounty” as Google is doing, paying people that discover vulnerabilities,

“Google products have themselves, become more secure because of bug bounties,” “Introducing them seems to be a no brainer.”

In his research, Wardle found out that the recent fix for the “rootpipe” vulnerability it’s easy to get around, and developing his own malware he understood that no third-party anti-malware was able to detect it.

“The state of OS X malware is amateur, even basic,” “It relies on trivially detectable persistence mechanisms and generally relies on infecting users via social engineering tricks such as offering ‘free [but infected] copies of PhotoShop’.”

For someone working in the malware research field, I am sure that you noticed by now that anti-virus for Macs don’t use heuristics and behavioral analysis like in Windows, translating that to common language, means that if Mac doesn’t know the signature of the virus will not try to block.

“Until recently all Mac security software was downloaded over unencrypted http connections” trusting on Gatekeeper for the code verification, and yes Wardle found out a way to bypass it too.

Concluding, Apple can’t rest on their laurels of the past, the company needs to invest in keep up with security, because that was one of the reasons people started to buy their products (besides being in fashion). The more people buy Macs, the more crooks will invest time to evade Apple’s OS.

About the Author Elsio Pinto

Elsio Pinto is at the moment the Lead Mcafee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog http://high54security.blogspot.com/

Edited by Pierluigi Paganini

(Security Affairs – Mac OS X, malware)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.