Security researchers discovered a strain of Mac malware utilizing right-to-left override in somewhat the same way...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
Windows malware does. Can you detail this evasion technique (both for Mac and Windows machines)? How can enterprises spot such malware?
Ask the Expert
Have questions about enterprise threats for expert Nick Lewis? Send them via email today! (All questions are anonymous)
It is important to note that an enterprise can spot new malware using the same tools it always has, regardless of the malware strain. While there might be advanced malware that bypasses security detection tools, it would need to be part of an advanced attack and know exactly which security tools are in use and how to bypass each one.
In the case of OSX/Janicab.A, malware authors are trying to bypass the OS X Gatekeeper, a feature that requires applications to be signed with a valid digital certificate. If the application is not signed, an error warning is displayed.
Due to their success, malware authors are starting to use the same tools and techniques on OS X systems as they have used in the past to bypass Windows antimalware tools. Historically, even in attacks on Linux and UNIX systems, attackers are trying to create directories or executables that are not easily visible when users initiate the attack. By using an alternative encoding scheme on the file name, such as having a significant number of spaces in the name of the file, attackers are obfuscating visibility and improving their success rates.
To successfully detect OSX/Janicab.A and other malware, I suggest that every enterprise check for character sets or language settings that are not standard in its organization, monitor for revoked Apple ID software signing certificates, use standard antimalware tools and leverage behavioral-based detection. Enterprises could also benefit from scanning for file names that are formatted in non-standard ways, then investigating should an anomaly appear.
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
Locky ransomware has, again, changed tactics by moving to using LNK files for distribution. Expert Nick Lewis explains how enterprises can adjust ...continue reading
Hajime malware was discovered to have links to the Mirai botnet that launched powerful DDoS attacks last year. Expert Nick Lewis explains how Hajime ...continue reading
Drammer, or a deterministic Rowhammer attack, was found to be more effective on ARM-based mobile devices. Expert Nick Lewis explains the issue with ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.