Hackers Infect macOS with New DazzleSpy Backdoor in Watering
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-8526 | Use-After-Free Local Privilege Escalation in Apple macOS CVE-2019-8526 is a use-after-free (CWE-416) memory-corruption flaw in Apple macOS that can be triggered by a low-privileged application already running on the target Mac, with no user interaction required. Successful exploitation lets an attacker gain elevated privileges beyond those of the triggering application, making it a local privilege escalation vector that is typically chained with other flaws. The issue is fixed in macOS Mojave 10.14.4, so users and organizations running earlier macOS builds are affected. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2023-04-17, confirming exploitation in the wild, though ransomware use is unknown and no public proof-of-concept is known. Related reporting on macOS watering-hole attacks delivering the DazzleSpy backdoor underscores active macOS targeting, but the provided data does not confirm a direct link to this specific CVE. Do: Upgrade affected Macs to macOS Mojave 10.14.4 or a later macOS release per Apple's instructions (CISA's required action), and inventory for any machines stuck on older builds using About This Mac or 'sw_vers -productVersion'. Because the flaw requires local execution, prioritize multi-user, shared, or high-risk Macs. Given confirmed in-the-wild exploitation, hunt for signs of post-exploitation on previously unpatched systems, keeping in mind macOS backdoor campaigns (e.g., DazzleSpy) reported against Mac users. | 7.8 | <1% | KEV |
| massmacOS install base exceeds 100M active devices; likely millions of Macs were, or remain, on vulnerable pre-10.14.4 builds | |
| CVE-2021-1789 | Type Confusion RCE in Apple WebKit (iOS, macOS, Safari, tvOS, watchOS) CVE-2021-1789 is a type confusion flaw (CWE-843) in the WebKit engine that powers Safari and web views across Apple's platforms, fixed through improved state handling. An attacker triggers it by getting a victim to open or view maliciously crafted web content, for example via a crafted link in an email or a compromised webpage. Successful exploitation leads to arbitrary code execution in the context of the application rendering the content, and the CVSS 3.1 score of 8.8 reflects high confidentiality, integrity and availability impact with network attack vector and user interaction required. Everyone running affected Apple software below the February 2021 patch levels is exposed — iOS/iPadOS before 14.4, macOS Big Sur before 11.2, macOS Catalina/Mojave without Security Update 2021-001, tvOS before 14.4, watchOS before 7.3, and Safari before 14.0.3 — as well as WebKitGTK users on Fedora per the CPE data. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-05-04) and was used as a macOS zero-day in watering-hole attacks on Hong Kong pro-democracy users, deploying the DazzleSpy backdoor; EPSS estimates a 14.5% chance of exploitation in the next 30 days. Do: Update to iOS/iPadOS 14.4, macOS Big Sur 11.2 (or apply Security Update 2021-001 on Catalina/Mojave), Safari 14.0.3, tvOS 14.4 and watchOS 7.3; on Fedora, apply the available webkitgtk package update. Because this flaw is in CISA KEV and used in targeted watering-hole attacks, prioritize patching internet-facing and high-risk user fleets. Confirm inventory shows no Apple devices below these patch levels and that users are not relying on outdated Safari builds on unsupported macOS versions. | 8.8 | 14% | KEV |
| masshundreds of millions of Apple devices (iPhone, iPad, Mac, Apple TV, Apple Watch) plus WebKitGTK-based Linux browsers/apps | |
| CVE-2021-30869 | Type Confusion in Apple iOS, iPadOS and macOS Allows Kernel Code Execution CVE-2021-30869 is a type confusion flaw (CWE-843) in the kernel of Apple's iOS, iPadOS, and macOS operating systems, addressed with improved state handling. It is triggered locally when a user runs a malicious application, which can then leverage the memory-type confusion to escape the app sandbox context. Successful exploitation gives the attacker arbitrary code execution with kernel privileges, effectively full control of the device. Users of iPhone, iPad, and Mac running versions released before the January 2021 fixes are affected. Apple has confirmed exploits exist in the wild, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and news reporting linked exploitation to targeted attacks against macOS users in Hong Kong. Do: Upgrade to iOS 14.4 (or iOS 12.5.5 for older devices), iPadOS 14.4, or macOS Big Sur 11.2, and apply Security Update 2021-001 Catalina or Security Update 2021-001 Mojave (Security Update 2021-006 Catalina also addresses the issue) on Macs. Because exploitation requires running a malicious application, remove untrusted apps and warn users against installing software from unverified sources while patching. This flaw is on the CISA KEV list, so federal and KEV-committed organizations must apply the updates per vendor instructions; no public proof-of-concept is known. | 7.8 | 4% | KEV |
| masshundreds of millions of devices (Apple's active installed base of iPhones, iPads, and Macs is on the order of 1 billion devices, and pre-patch OS versions were… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | fightforhk.com | November 4, 2021. Separately, a fraudulent website called "fightforhk[.]com" was also registered for the purpose of luring liberation |
Full article458 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 25, 2022
A previously undocumented cyber-espionage malware aimed at Apple's macOS operating system leveraged a Safari web browser exploit as part of a watering hole attack targeting politically active, pro-democracy individuals in Hong Kong.
Slovak cybersecurity firm ESET attributed the intrusion to an actor with "strong technical capabilities," calling out the campaign's overlaps to that of a similar digital offensive disclosed by Google Threat Analysis Group (TAG) in November 2021.
The attack chain involved compromising a legitimate website belonging to D100 Radio, a pro-democracy internet radio station in Hong Kong, to inject malicious inline frames (aka iframes) between September 30 and November 4, 2021. Separately, a fraudulent website called "fightforhk[.]com" was also registered for the purpose of luring liberation activists.
In the next phase, the tampered code acted as a conduit to load a Mach-O file by leveraging a remote code execution bug in WebKit that was fixed by Apple in February 2021 (CVE-2021-1789). "The exploit used to gain code execution in the browser is quite complex and had more than 1,000 lines of code once formatted nicely," ESET researchers said.
The success of the WebKit remote code execution subsequently triggers the execution of the intermediate Mach-O binary that, in turn, exploits a now-patched local privilege escalation vulnerability in the kernel component (CVE-2021-30869) to run the next stage malware as a root user.
While the infection sequence detailed by Google TAG culminated in the installation of an implant called MACMA, the malware delivered to visitors of the D100 Radio site was a new macOS backdoor that ESET has codenamed DazzleSpy.
The malware provides attackers "a large set of functionalities to control, and exfiltrate files from, a compromised computer," the researchers explained, in addition to incorporating a number of other features, including —
- Harvesting system information
- Executing arbitrary shell commands
- Dumping iCloud Keychain using a CVE-2019-8526 exploit if the macOS version is lower than 10.14.4
- Starting or terminating a remote screen session, and
- Deleting itself from the machine
Among other interesting findings about the attacks is that once the malware obtains the current date and time on a compromised computer, it converts the obtained date to the Asia/Shanghai time zone (aka China Standard Time), before sending it to the command-and-control server.
"This campaign has similarities with one from 2020 where LightSpy iOS malware (described by Trend Micro and Kaspersky) was distributed the same way, using iframe injection on websites for Hong Kong citizens leading to a WebKit exploit," the researchers said. That said, it's not immediately clear if both the campaigns were orchestrated by the same group.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/01/hackers-infect-macos-with-new-dazzlespy.html