12 Apple security threats - why Macs are not invulnerable

Affecting Mac, Windows and Linux, BadBunny was an OpenOffice macro worm, this was is still remembered for using Ruby scripts to drop pornographic images of a man in a bunny suit. Probably rarely if ever encountered in the wild, BadBunny looked like a proof-of-concept plaything as much as a serious attack.

This notorious attack lured Mac users using a fake CODEC (bizarrely offered as a Windows ActiveX control) allowing users to view a pornographic video. Also turned up in the form of Jahlav and turned out to be connected to the infamous RSPlug Mac malware from 2007. The Estonian group behind most of these attacks (including on Windows users) was eventually ‘downed’ by the FBI that year in Operation Ghostclick.

By 2010, cybercriminals were experimenting with many of the same techniques tried against Windows, including ‘Boonana’ which at first appeared to be a re-packaging of the Facebook Koobface Trojan from 2008. Using Java to aid cross-platform nefariousness, Boonana was eventually identified as a new attack that used the same interest in spreading via social media and YouTube, then a much more recent phenomenon.

A curiosity that marked the first time Macs had been targeted by the same sorts of fake anti-virus scams then flooding the PC world, MacDefender was a simple con trick. The malware posed as a security app users were invited to install an app that detected non-existent security threats users needed a paid license to rid themselves of. Notable because its creators had gone to come trouble to create a convincing Mac interface.

Aimed by Chinese hackers at Uighur activists, this launched as a simple booby-trapped email attachment in order to take remote control of target Macs. Several attacks at the time used this technique since when it has continued to be tried on a small and targeted basis by Chinese groups against specific groups, hence the ‘APT’ moniker.

Nobody knows for sure how many Apple computers were infected by the Flashback Trojan, but up to a million seems likely, making it by far the most significant Mac malware ever. Flashback installed as a drive-by attack posing as a Flash player install which reminded everyone of similar scams on Windows. This was the moment and the year when the perception of Aople security changed – even Oxford University and its students struggled with it.

Publicised by Malwarebytes, this cross-platform attack was a simple Javascript con that interfered with the browser in order to persuade users to fork out $300 to make it stop. The only way to get rid of it was the instigate the ‘reset Safari’ option.  Far from complex but still a warning that simple tricks can work as well as sophisticated ones. 

Arguably the most serious security issue to affect Apple,  the company’s iCloud data storage service was hit by a small flurry of apparent breaches in 2014, culminating in a targeted attack on celebrity accounts dubbed ‘Celebgate’ in which incredibly embarrassing images of Hollywood celebrities and actors were leaked to the Internet.  Apple had a habit of denying its systems had been breached. Regardless, users started paying attention to the personal data gathered by cloud services, or just turning them off.

 WireLurker is undoubtedly the most serious rival-world attack on iOS devices and came hard on the heels of a similar proof-of-concept attack called Masque, itself serious enough for the US Government to warn its workers about it.  Masque only worked if users were tricked into installing an app from a third-party store but the Chinese WireLurker infected any iOS devices via USB from an infected Mac.

Discovered by a security researchers rather than criminals, but concerning nonetheless, Thunderstrike and  Dark Jedi were proof-of-concept attacks  designed to undermine Mac computers using firmware backdoors. Thunderstrike required physical access to the Mac using a Thunderbolt peripheral, whereas Dark Jedi didn’t but did demand a lot of firmware smarts.  Both issues were patched by Apple.

Distributed through Cydia repositories in China, KeyRaider is a severe warning to users of Jailbroken iOS devices of the risks they take. A previously unknown piece of malware that by mid-2015 had "stolen over 225,000 valid Apple accounts and thousands of certificates, private keys, and purchasing receipts," said Palo Alto. "Some victims have reported that their stolen Apple accounts show abnormal app purchasing history and others state that their phones have been held for ransom."

After years attacking Windows users, ransomware finally hit the Mac in the form of KeRanger, hiding inside the Transmission open source BitTorrent client. Detected by Palo Alto, KeRanger was fully-functioning, Mac-specific ransomware with no compromises, written to target and encrypt files on OS X systems. The number of victims? Probably small. The dent to Mac invulnerability? Somewhat greater.