Still think Mac is secure?

Over the past week, researchers have been investigating a new botnet consisting of compromised computers, all running the Mac OS. From what I can tell, this is a rather simplistic attack, where malware has been added to popular pirated software which users then installed and ran.

The Flaw

The major flaw here is the overwhelming overconfidence of Mac users, in my humble opinion. Many Mac users do not consider their computers to be at risk for infection, because Macs are rarely attacked. They seem to believe that this is because Macs are inherently more secure, rather than a result of the lower market share of the Operating System.

As a result of this attitude, many Mac users have not bothered to install/configure/update the basic software necessary to protect a computer, especially when downloading as untrustworthy software as pirated applications. The consequence of this is of course, that their computers were compromised.

The consequences

Compromised computers that have been added to the botnet in question have been used in Distributed Denial of Service attacks against various web sites, as the attackers behind this botnet rent the network out to third parties. Additionally, as the software accesses the administrator-level credentials for the computer, it is possible that attackers may be able to access and/or retrieve sensitive data from compromised systems.

More Information

• Name: OSX.Trojan.iServices.A, OSX/iWorkS-A, OSX.iWorkServices.A


• Infection Vector: Trojan Horse contained in pirated Mac OS software


• Article on Techtree


• Intego alert on this virus


• Removal utility from Securemac.com

What To Do if you have been Hacked or Infected

Although I am writing this primarily for home computer users, many of the same principles apply for business networks. However, in a business environment, your IT department should handle cleaning the infection and checking the network for additional problems.

The Symptoms

How do you know if your computer has been compromised? It may be obvious - your computer might be displaying the incorrect pages when you browse the web, or it may be more subtle - your computer may be running slowly. I have had some friends tell me recently that their web-based accounts were hacked, but had not been accessed from any computer other than their own (possible keylogger).

Cleansing

The first step is to remove any and all hostile software that may be on your computer. This includes viruses if you have been infected, and backdoors if you have been hacked. If your computer is compromised, assume that your antivirus software was compromised as well. Uninstall it. From a clean (unaffected) computer, download the latest version of Avast Antivirus, AVG, or whatever antivirus software you have a license for, and burn the software onto a CD. From the CD, install the software on the affected computer. Update the software, run a full scan, reboot, scan again, until you are clear.

Securing

Once your computer is clean, you will need to secure the computer so this does not happen again. Download and install a high end firewall application (if you are looking for something free, Zone Alarm is one of the best free firewalls). Also, find and install a quality anti-spyware application.

Mitigation

Now that your computer is cleaned up and secured, it is time to mitigate the damage that could have been caused by the compromise. The first step is to secure your network. If you have any computers on the same network as the compromised computer, uninstall and reinstall the antivirus software, and rescan those systems to make sure any viruses were not transferred between systems. Also, any external backup media you use MUST be scanned before it is reused.
Finally, change all of your passwords on the compromised system, as well as all passwords that you used while using that computer. This includes all web-based e-mail systems such as GMail, social networks like Facebook and MySpace, your bank if you use online banking, etc. If your PIN number for any of your credit cards was on the computer, change the pin number. If any of your credit card numbers were stored on the computer, notify the banks that issued the cards.

Onion Security

Onion Security is a methodology for securing a network in layers, like an onion. This type of security approach helps keep the network insulated against attacks.

The problem

You have a medium to large network, consisting of internal workstations and externally accessible servers. There are multiple vectors of attack available to a determined attacker.
Most networks rely on security measures such as perimeter firewalls to protect the entire network. In an environment where new vulnerabilities are being discovered daily, such an approach is ineffective. If you rely on a firewall, for example, and a network user visits a compromised web site, and is infected by a virus, the attacker now has a way around the perimeter defenses. Once the perimeter is breached, what protects the remaining resources on the network?

The Solution

Onion security is implemented by securing every resource on the network. This includes strong perimeter security measures as well as strong internal protection. Of course, every workstation and server should have effective and up to date anti-virus software, but in addition each workstation should have it’s own software based firewall. Most of the workstations on your network do not need to be able to communicate directly with one another. The firewalls should limit communication between workstations, and only allow communication with servers. This should help limit the spread of viruses and intrusions to the network.
Access to server resources such as shared files should also be limited. Financial information should only be accessible to users in the Finance department, for example, and marketing files should only be accessible to marketing personnel. In this way, a compromise can be further controlled. If a marketing computer is compromised, for example, the attacker cannot access anything from the finance department. This provides yet another layer of protection.