Adobe Genuine Software Bubble Osx Software And Infect
Adobe Genuine Software Bubble Osx Code Signing Certificates

Weve talked about the weaknesses in macOS security on a number of previous occasions, and weve also talked about some of the common and not-so-common threats that are out there in the wild, too.

SentinelOne protects hundreds of thousands of Macs and our telemetry paints a very clear picture, a picture that has changed vastly even in the last two to three years.

But people can only argue from what they know, so lets share a little knowledge.

This argument is often swiftly followed by the claim that had these users only followed Apples advice, or common sense or some other prescription about what users should and should not do on a computer, then they would not have ended up with malware on their (or their companys) Macs.

The fact they didnt do the former and ended up with the latter Well, only themselves to blame.

I also dont believe this attitude is representative of Apple itself, if you look at the kind of things that Apples own security tools try to detect.

In case you know someone tempted, point them to the following sobering reality.

Adobe Genuine Software Bubble Osx Software And Infect

Knowing this, malware authors lure victims with promises of expensive or popular software and infect them with malware, usually instead of, but sometimes as well as, providing whatever was promised in the lure.

But playing the blame game ignores, rather than solves, the security issue.

If users are committing crimes, surely we want them to be punished in appropriate ways by the proper authorities, not by malware authors.

Some users are looking for genuine software to solve a problem, but they will rapidly encounter all kinds of sites with misleading cues and confusing download buttons, particularly if they are using a browser without some kind of advertising or pop up blocker.

In this example, the Later button re-pops the alert while the Install button treats the user to one variant or another of OSX.Shlayer.

However, when the user is referred from Google, the original content is replaced with the fake App Store and the lure to download the malware.

In the last 18 months or so, weve seen the return of OSX.Dok, unknown actors behind the GMERA malware campaign and plenty of LazarusAppleJeus campaigns targeting cryptocurrency exchanges and crypto wallet users to name just a few.

At present, we have yet to see this particular threat active in the wild or validated it for its efficacy against Mac targets, but the fact that such offerings are being made suggests cyber criminals are aware of the value of infecting macOS users: Dont leave money on the table by focusing only on Windows, the message states.

XProtect and MRT.app are now regularly updated, and theres no doubt that they are both far more comprehensive than theyve ever been before.

Adobe Genuine Software Bubble Osx Code Signing Certificates

They are built on old technology Yara Rules, path lists, code signing certificates that require having already seen a threat before writing a signature to stop it.

It certainly isnt as big a problem as it is on the Windows platform, but its way past the point where anyone with any reasonable knowledge of whats going on in the wild would deny it.

Its been proven beyond argument that no matter the platform, the only effective way to do enterprise security is to stop chasing malware samples and start detecting malware behaviors.

If youd like to see how SentinelOne can help protect your enterprise, contact us today or request a free demo.