It’s rare to find malware that is designed to compromise the infrastructure of a Mac operating system, but in our recent blog post we discuss a malicious form of malware dubbed Fruitfly has recently emerged designed to do exactly this.
As the write up mentions, in most cases, malware designed to compromise Mac OS was simply a proof of concept to show that the underlying architecture was fundamentally insecure and eliminate the false sense of security that Mac users sometimes have.
Fruitfly was first discovered by accident, as explained in a previous Hacker News article , but the malware has been researched more deeply and some startling information has been discovered.
How It Works
The underlying coding of the malware relies on the legacy application Perl, which is discussed in detail in a Malwarebytes Lab’s blog pos t earlier this year. Once executed, the malware connects to a command and control server. From that server a hacker can then remotely view, control and lock the Mac computer. This includes the ability to remotely control the webcam in iMacs and take and store photos without the user suspecting.
How It’s Delivered
Like most malware, Fruitfly is delivered via phishing emails where the user clicks on an unknown attachment, and is also delivered through malicious websites via drive-by downloads, or watering hole attacks. Once delivered, the software becomes essentially a remote surveillance tool.
How to Protect Your Machine
As mentioned in the write up, this particular exploit existed for years before being noticed. Now, Apple has released a patch to fix Fruitfly and prevent the code from being executed. If you update your Mac OS to the latest version, this exploit will no longer be able to connect to the command and control server, rendering the malware useless.
So SpiceHeads, now I’m curious to know if you have seen any interesting updates or further research that has been done around Fruitfly? Are there any similar Mac OS threats that could be more than a proof of concept that you have been following updates on lately?
