hoakley March 4, 2021 Macs, Technology, Updates

Apple has pushed updates to XProtect and MRT

Apple has just pushed two updates, to the data files used by XProtect, bringing its version number to 2141 dated 4 March 2021, and to its malware removal tool MRT, bringing it to version 1.75, also dated 4 March 2021.

Apple doesn’t release information about what these updates add or change, and now obfuscates the identities of malware detected by XProtect using internal code names.

Changes found in the XProtect Yara definitions include removal of the signature for MACOS.7ef4bab (AdLoad variants, which had only been added in version 2140) and addition of those for MACOS.2afe6bd, MACOS.b5bd028 and MACOS.d98ded3.

Update: Phil Stokes has corrected my original list, and identified these three additions as being AdLoad (MACOS.2afe6bd), Bundlore (MACOS.b5bd028), and Genieo, MaxOfferDeal (MACOS.d98ded3).

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan, Sierra, High Sierra, Mojave, Catalina and Big Sur, available from their product page. If your Mac has not yet installed this update, you can force an update using SilentKnight, LockRattler, or at the command line.

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

I maintain lists of the current versions of security data files for Big Sur on this page, Catalina on this page, Mojave on this page, High Sierra on this page, Sierra on this page, and El Capitan on this page.

I am grateful to Phil Stokes at Sentinel Labs for decoding of the obfuscated malware names here.

11Comments

Add yours

1

Dakotamoons on March 4, 2021 at 8:58 pm

Thank you Howard, as always, for your alerts. Please keep them coming. I’ll run SilentKnight in a day or so to update both XProtect and MRT. I always wait a day or so on these, and always wait about two weeks on all OS updates just to be sure make sure no reports are coming in about the “cure being worse than the disease” or yet another “sudden” patch. Thank you so much for all you do.

LikeLiked by 1 person
- 2
  
  hoakley on March 4, 2021 at 11:55 pm
  
  Thank you. All looks good here.
  Howard.
  
  LikeLike
3

rfog y su etiqueta de anís del mono (@rfog42) on March 5, 2021 at 9:24 am

Strangely, my Gatekeeper never matches with your versions. I have 94, 8.0 and you list 181, 8.0. I never had that version.

Is there any way to update it?

LikeLiked by 1 person
- 4
  
  hoakley on March 5, 2021 at 10:34 am
  
  Thank you.
  No: you can’t update it yourself. This is because that database is apparently no longer used or updated. On Macs which have installed old updates, it’s frozen at the last update. On newer Macs, the macOS installer installs this very old version, and that’s what they’re stuck with. So it’s fine. I’ll explain more in an article tomorrow morning.
  Howard.
  
  LikeLike
  - 5
    
    rfog y su etiqueta de anís del mono (@rfog42) on March 7, 2021 at 9:56 am
    
    You are the best! Thanks. I’ve just read in your article.
    
    LikeLiked by 1 person
    - 6
      
      hoakley on March 7, 2021 at 10:23 am
      
      Thank you.
      Howard.
      
      LikeLike
7

markbot2zero on March 5, 2021 at 1:39 pm

Thank you, Howard.

The last time these two were updated, you mentioned that neither addresses the “Silver Sparrow” malware. I’m betting that these two don’t either, although Apple has neutralized it. In any case, I share these thoughts.

There’s an old saying among American investors:

“Beware the railroad analyst who can tell you the number of ties between Chicago and New York, but not when to sell Penn Central.”

Or to use another metaphor, sometimes we need to see the forest through the trees.

The “Silver Sparrow” malware discussion, such as it is, brings these to mind. There are a number of detailed analyses about how it works — and the primary point of interest/sex appeal seems to be that it contains native Apple Silicon binaries — but none revealing how you get it in the first place.

Don’t get me wrong — I love to learn about how malware works. It’s fascinating.

But lost in all the analyses is any explanation, or even educated speculation, of how the malware packages (in the case of “Silver Sparrow,” the prosaically named ‘updater.pkg’ and ‘update.pkg’) end up on Macs in the first place.

And some of the wording is a bit odd, e.g.:

https://www.techrepublic.com/article/mysterious-malware-infects-30000-mac-computers/

“Based on data from Malwarebytes, the malware dubbed Silver Sparrow by researchers at Red Canary, has so far [2/17/21] landed on 29,139 macOS machines across 153 countries…”

“Landed on” Macs? They make it sound like the Sparrow flew down from outer space of its own volition.

Also, it is amazing to me that Malwarebytes can specify the number of Macs infected so precisely. (Do they publish their methodology?) On 2/23/21 the company upped that claim to a total of 39,080, including 25,331 in the United States. (Oh, my beloved country. We’re also the world leader in COVID infections — is there a pattern here?) And then, astonishingly, it claimed that “…we do not know how these files were delivered to the user.”

Really? Of nearly 40,000 infections, Malwarebytes can’t say how even a SINGLE ONE was “delivered” to a user? And neither, apparently, can any other Mac security company?

Pardon me, but I have to suggest that if these outfits can demonstrate, down to the last bit, byte, and NAND gate, how a piece of malware infects a Mac, but not how it got on that Mac in the first place, they are about as useful as a broker who enthusiastically sells you a stock destined to tank three weeks later.

As we say in America, “An ounce of prevention is worth a pound of cure.” But I suppose if a company’s revenue stream comes from selling the pound of cure, there’s little incentive to disclose that ounce of prevention.

I’m left to guess that “Silver Sparrow” — in reality just another ho-hum Mac Trojan, perhaps a tad more sophisticated than most — was delivered the tried and true, old-fashioned way: via a fake Adobe Flash installer. (Yes, they’re still out there — I just encountered one yesterday.) Some poor person (or 40,000+ of them) was gulled into downloading it, double-clicking it, providing an administrator password, and getting infected. Wash, rinse, repeat. Do we never learn?

Now that Flash has gone the way of the bustle and spats — you can’t even download it from Adobe anymore — the malware development community, bless their malevolent souls, is eventually going to have to come up with a different transmission “vector,” with which to rope the 40K+ unwary Mac users out there.

And that I can’t wait to see.

–Mark

LikeLiked by 1 person
- 8
  
  hoakley on March 5, 2021 at 5:37 pm
  
  Thank you.
  Although I can’t speak for Malwarebytes, the detection figures that are usually quoted in such cases are the number of Macs which have run their anti-malware software and detected the signature of that particular malware. Because this is based on unique detection signatures, it’s normally considered very reliable, but tells you nothing about how the malware gets there in the first place. There are occasional false positives, but those tend to be relatively unusual and quickly noticed.
  Howard.
  
  LikeLike
9

markbot2zero on March 9, 2021 at 8:02 pm

Thank you, Howard.

I look forward to the day when Mac malware is treated with a bit more scientific discipline, and a bit less “FUD.”

Until then, if I could make an analogy in honor of your medical career, perhaps we could say of “Silver Sparrow”:

aetiology: idiopathic

“Arstechnica” also reports the 30,000 infection figure for “Silver Sparrow.” I’m gratified to see that among some 300 comments below the article (many of which, unfortunately, rehash old arguments about the relative security merits of Mac vs. PC) a few echo my concerns, including this from “Cheshire Cat”:

“All this bitching about Macs getting malware, and not a bit of information on how those got infected.”

Finally, let me take this opportunity to issue a SHOUT OUT to author, blogger, and developer Phil Stokes. I’m glad to see his name mentioned here. Phil writes useful articles for Sentinel One, such as this:

He is also the creator of a nifty anti-malware program called “DetectX Swift”:

I’m a paid up licensee of the “Pro” version, which I hope encourages him to develop it further.

–Mark

LikeLiked by 1 person
10

markbot2zero on March 9, 2021 at 8:05 pm

My apologies, WordPress doesn’t like URLs enclosed in brackets and I keep forgetting that fact.

Phil Stokes’ article:

https://www.sentinelone.com/blog/macos-security-so-how-do-macs-get-infected-with-malware/

and anti-malware program, DetectX Swift:

https://sqwarq.com/detectx/

–Mark

LikeLiked by 1 person
- 11
  
  hoakley on March 9, 2021 at 11:52 pm
  
  Thank you. Yes, WordPress throws a wobbly at < and >, which it interprets in their XML context.
  Howard.
  
  LikeLike

·Comments are closed.

Share this:

Related