Re:New malware found on 30k Macs has security pros stumped
by lamontcg on Saturday February 20, 2021 @04:11PM
(#26208026)
Its like scam/phishing e-mails with typos in them. Most widescale hacking is lowest effort looking for lowest hanging fruit. If you hack enough servers for your purposes without worrying about checksum randomization then worrying about it is just wasted effort. And you want targets with excessively shitty security postures or else you might actually get tracked down and busted.
Re:New malware found on 30k Macs has security pros stumped
by mpeg on Saturday February 20, 2021 @08:39PM
(#26210022)
Actually not as easy as you’d think to do that, criminals don’t upload malware payloads to their own servers, they use hacked websites (old Wordpress installs, etc) to spread the binaries.
Could they do this? Sure, but it would be a lot more complex than the current method of just finding any target where they can upload files, and the payloads do change very often anyway (sometimes daily) so there is no real need for them to change dynamically
Re:New malware found on 30k Macs has security pros stumped
by jjeaff on Saturday February 20, 2021 @03:48PM
(#26207811)
Lucky for us, most criminals are lazy.
Re:New malware found on 30k Macs has security pros stumped
by thaumasiotes on Saturday February 20, 2021 @04:00PM
(#26207921)
I don't think this comes from them being lazy. I think this comes from them not being aware of (1) the defense; and (2) the mitigation. It's an example of security through obscurity.
Re:New malware found on 30k Macs has security pros stumped
by monocasa on Saturday February 20, 2021 @05:22PM
(#26208533)
Or even if they know about the defense and the mitigation, it is additional work. In my work in the formal economy I rarely get to ship the technically best and most complete solution but instead a compromise 'MVP' that'll receive more work only if the problem proves to demand it. I expect the same holds true in the informal economy.
It seems to me like it trivial to create a webserver which says "serve the same binary, but put a random ASCII string in bytes 40-48". Or make malware installer which says, "write out the executable file to disk, but put a random value in bytes 80-88". Sure, it won't help against good YARA rule, but it seems really easy to do, and it will frustrate researchers, and even defeat some endpoint protection software, like [0] and [1].
[0] https://help.symantec.com/cs/ATP_3.2/ATP/v106632175_v1273003...
[1] https://docs.mcafee.com/bundle/network-security-platform-9.2...