hoakley October 12, 2023 Macs, Technology, Updates

Apple has just released updates to XProtect and XProtect Remediator

Apple has just released an update to XProtect Remediator security software (Catalina or later), bringing it to version 114, and to XProtect (for all macOS from El Capitan or so) bringing it to version 2173.

Apple doesn’t release information about what security issues these updates might add or change. However, XProtect’s Yara definitions add three new detection rules, for MACOS.SOMA.A, MACOS.SOMA.C and MACOS.ADLOAD.WSS, which presumably detects a variant of Adload malware. Thanks to Stuart Ashenbrenner for identifying the two variants of ‘Soma’ as what’s generally known as AtomicStealer. XProtect Remediator gains another scanning module for what Apple terms RedPine. There are no changes in the Bastion rules for the behavioural version of XProtect (Ventura and Sonoma only).

You can check whether these updates have been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan to Sonoma available from their product page. If your Mac has not yet installed these updates, you can force them using SilentKnight, LockRattler, or at the command line.

If you want to install these as named updates in SilentKnight, their labels are XProtectPayloads_10_15-114 and XProtectPlistConfigData_10_15-2173.

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

I maintain lists of the current versions of security data files for Sonoma on this page, Ventura on this page, Monterey on this page, Big Sur on this page, Catalina on this page, Mojave on this page, High Sierra on this page, Sierra on this page, and El Capitan on this page.

Updated 2020 12 October 2023 with identification of SOMA.

15Comments

Add yours

1

James Steffy on October 12, 2023 at 7:58 pm

I just installed Sonoma on my MacBook Air (15-inch, M2, 2023) yesterday afternoon. Afterward I ran SilentKnight to inspect the version numbers of the various components and was surprised to see that MRT had not been installed. Just a few minutes ago, I ran SilentKnight again just for the heck of it and was surprised to see that not only had XProtect and XPR been updated to versions 2173 and 114, respectively, but that the previously missing MRT (version 1.93) had magically appeared, apparently having come along for the ride together with Apple’s silent update of XProtect and XPR. Go figure.

LikeLiked by 2 people
- 2
  
  hoakley on October 12, 2023 at 8:19 pm
  
  Yes, it’s curious, but Apple hasn’t killed MRT altogether. For Macs still running Mojave and earlier, it’s the only malware removal tool, alongside XProtect for detection. From Catalina onwards, it has been superseded by XProtect Remediator, which includes a scanning module to replicate MRT’s features.
  So what happens now is that macOS comes without MRT, but if you ask Apple’s servers for software updates, they’ll give you a free copy. There is some sense in that, as MRT can be used to do other things besides remove malware – Apple used it to remove a vulnerable web server installed with an old version of Zoom, for instance. So if really needed to, it could still issue a new version of MRT to address a serious problem across all Macs.
  The version of MRT installed now is 18 months old, and probably isn’t even run on more recent macOS.
  Howard.
  
  LikeLiked by 1 person
3

Stuart Ashenbrenner on October 12, 2023 at 8:14 pm

Thank you as always for these Howard. I’ve been looking at those SOMA rules. It looks like they cover two variants of, what’s being referred to as, AtomicStealer. I see others calling it AMOS, or SOMA backwards, but it seems like a crude acronym for Atomic Stealer. (ex: Variant A: 33b57db0774fb077d5597bb5e0338352b01008dc, Variant C: 78e08e549bfa00d6d5a471fa3832d4f12c5e3a75)

LikeLiked by 1 person
- 4
  
  hoakley on October 12, 2023 at 8:20 pm
  
  Thank you – that’s very helpful. I’ll amend the article, with credit.
  Howard.
  
  LikeLike
5

artiste212 on October 13, 2023 at 1:21 am

Thanks again, Howard, for always alerting us about these updates. It’s a pleasure to run Silent Knight and know I’m protected (as much as possible, that is).

LikeLiked by 1 person
- 6
  
  hoakley on October 13, 2023 at 9:42 am
  
  Thank you.
  Howard.
  
  LikeLike
7

JM on October 17, 2023 at 4:04 am

Hello, and thank you for all your articles. Do security and anti-malware updates actually still go out for all the MacOS versions back to El Capitan?! That would be excellent, if Im reading right…

LikeLiked by 1 person
- 8
  
  hoakley on October 17, 2023 at 7:29 am
  
  Updates to XProtect are still released for all versions of macOS that can install them, as stated above. MRT hasn’t been updated for well over a year, and it looks unlikely ever to be updated in the future. There are, of course, no security updates to older and unsupported versions of macOS itself, so their vulnerabilities remain.
  I hope that’s clear.
  Howard.
  
  LikeLike
  - 9
    
    JM on October 17, 2023 at 10:15 am
    
    Ah, I was conflating security updates with XProtect and XProtect Remediator. The internet says Apple provides features and security updates in the latest OS, and security updates only in the previous 2 versions. I was getting excited when you said XProtect updates go back to El Capitan, thinking that implied security updates. But if I understand you correctly, that just means anti-malware updates. Still, I guess it’s something. Security updates would mean more like addressing vulnerabilities in the system software, I’m guessing. Although I would think those vulnerabilities would sometimes be exploited via malware. Not just theoretical musings, but trying to assess how vulnerable my older Macs are, and what, if anything, I should do about it. Anyway, thank you for answering!
    
    LikeLiked by 1 person
    - 10
      
      hoakley on October 17, 2023 at 12:22 pm
      
      Perhaps it’s time for me to write an article clarifying these issues. Maybe for Friday morning – I’ll see.
      Howard.
      
      LikeLike
11

JM on October 17, 2023 at 5:51 pm

Hey, that’s thoughtful of you to even consider, thanks. If Apple didn’t make such darn good long lasting hardware we wouldn’t have these issues 🙂

LikeLiked by 1 person
12

Myob on October 18, 2023 at 9:08 pm

“Perhaps it’s time for me to write an article clarifying these issues. Maybe for Friday morning – I’ll see.
Howard.”

For what it’s worth, I’d like to read, in your comprehensive way*, your current thoughts/clarification on this too, and I think, so would many others.

*In the meantime, a simple search here at eclecticlight will get one informative results. The visitor comments can be useful too.

LikeLiked by 3 people
- 13
  
  hoakley on October 18, 2023 at 9:27 pm
  
  Friday morning it is, then. All poised ready, but you can have fun with VM shared folders first, tomorrow morning!
  Howard.
  
  LikeLiked by 1 person
  - 14
    
    Myob on October 18, 2023 at 10:32 pm
    
    Looking forward to each and every bit. Thank you.
    
    “What moves those of genius, what inspires their work is not new ideas, but their obsession with the idea that what has already been said is still not enough.”
    Eugene Delacroix
    
    LikeLiked by 1 person
    - 15
      
      hoakley on October 19, 2023 at 1:14 pm
      
      Thank you – that’s a lovely Delacroix quote too.
      Howard.
      
      LikeLike

·Comments are closed.

Share this:

Related