Ex-NSA hacker made four pieces of state-created Mac malware run his own code
Summary
Security researcher and former NSA hacker Patrick Wardle has demonstrated a way to modify state-created Mac malware to run his own code instead of the payloads from the government servers. The sophistication of the malware makes re-purposing it attractive to other attackers, including other governments … ArsTechnica reports that Wardle made the argument during a conference presentation. Wardle was able to make other tweaks to his repurposed pieces of code so they would bypass malware mitigations built in to macOS. For instance, because the Xprotect malware scanner is based on file signatures, changing a single byte of reused code is sufficient for it to completely escape detection. The feat allowed him to use well-developed and fully featured applications to install his own malicious payloads, obtain screenshots and other sensitive data from compromised Macs, and carry out other nefarious actions written into the malware.
Classifications
AskAI Classifications
LabelsLinked Companies
