macOS, Windows, Linux all targeted by new cross-platform exploit

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

macOS variant, Apple Silicon

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

The new “SysJoker” backdoor can reportedly attack multiple operating systems, including macOS, Windows, and Linux.

On January 11, researchers from Intezer revealed they had found SysJoker, a backdoor that was originally discovered to be attacking Linux. Shortly after, variants of the same backdoor were uncovered that went after Windows and macOS.

Global Tech News Daily

The find is unusual, as it is rare to discover malicious code that can attack multiple platforms at once. Typically, malware is produced to attack a specific vulnerability in one platform only, rather than produced in a similar way for multiple platforms simultaneously.

According to the researchers in a technical analysis, SysJoker is thought to have been initiated in an attack in the second half of 2021. Security researcher Patrick Wardle performed the analysis of macOS variant, as Intezer concentrated on the Windows version.

Global Tech News Daily

The code is found to be a universal binary covering Intel and arm64 builds, meaning it could run on Apple Silicon as well as older Macs with Intel chips. The code is signed, albeit with an ad-hoc signature.

When initially run, the software copies itself to the user’s Library as an update for macOS, which is used to persist on the infected system.

After being run, the malware then attempts to download a file form a Google Drive account, and is able to pull and run an executable, depending on the commands from a designated control server. Other commands include unzipping a downloaded executable, and to change the permissions of the unzipped executable to allow it to run.

The Windows analysis indicates it operates in practically the same way, namely pretending to be an update, contacting a remote server to download a payload and to receive other commands, and to execute the code on the target system.

It seems that the backdoor is starting to be flagged by antivirus engines, after being identified by the researchers.

As for its purpose, Intezer hasn’t witnessed a second-stage or command sent by the attacker, which points to it having a highly specific purpose, and therefore likely to be from an “advanced actor.” It is thought the goal is “espionage,” though there is the possibility of ransomware attacks to be made as a follow-up stage.

Detecting SysJoker

Intezer has published a list of indicators that a system has been attacked, including what files are created and the LaunchAgent that allows the code to persist.

The files and directories created by SysJoker include:

  • /Library/MacOsServices
  • /Library/MacOsServices/updateMacOs
  • /Library/SystemNetwork
  • /Library/LaunchAgents/com.apple.update.plist

The persistence code is under the path LibraryLaunchAgents/com.apple.update.plist. If the files are found on a Mac, it is advised to kill off all related processes and delete the files.

It is unclear how a user may become a victim of SysJoker at this time.

News Related

OTHER NEWS

Apple TV+ announces 'Slow Horses' spy drama to stream in April

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple, Broadcom win new damages trial in $1.1B Caltech patent case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Creative TiKTok user converts an iBook G3 into iPad case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. By ... Read more »

Michigan toddler dials 911 on Apple Watch

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Best deals Feb. 4: $70 off Powerbeats Pro, $220 27-inch 2K monitor, $40 400GB microSD card, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Friday’s ... Read more »

iMac Pro, AirPods Pro 2, and hands-on with Universal Control on the AppleInsider podcast

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. On ... Read more »

MacBook Pro, Pro Display XDR will automatically dim when hot

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Second class action suit targets Powerbeats Pro battery life, charging issues

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Amazon Prime raising annual subscription to $139

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple cuts commission by 3% for Dutch apps using third-party payments

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Following ... Read more »

Victrola Revolution Go review: a portable record player perfect for budding music enthusiasts

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Take ... Read more »

UK woman orders iPhone 13 Pro Max, gets a $1 bottle of hand soap instead

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Microsoft tracking increasingly sophisticated Mac trojan that delivers adware

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Microsoft’s ... Read more »

Apple releases trailer for 'Lincoln's Dilemma,' coming to Apple TV+ on Feb. 18

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Glenn Close joins the cast for season 2 of 'Tehran' on Apple TV+, premiering May 6

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Lowest price ever: Apple 24-inch iMac dips to $1,149 for a limited time only

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

AirTags with disabled anti-stalking speakers briefly surface on eBay, Etsy

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple's December quarter was its best yet for iPhone sales in India

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple’s ... Read more »

iPad delivery estimates remained extended as Apple prioritizes iPhone 13

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. New ... Read more »

Senate Judiciary advances bill that would force Apple to allow iOS side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Putting Face ID unlock with masks to the test in iOS 15.4 & how to set it up

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. In ... Read more »

Best deals Feb. 3: AirPods Pro w/ MagSafe $180, $550 off 55-inch LG OLED, 30% off an Eero router, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Thursday’s ... Read more »

Apple TV+ picks up four Bafta film nominations

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Judge dismisses proposed iPhone water resistance class action suit

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Second Israeli firm developed & sold exploit to break into iPhones remotely

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Apple opens 'reimagined' new Abu Dhabi retail store

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

South Korea says Apple's alternative payment plan 'lacks detail'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. South ... Read more »

Battle of the super yachts: Jeff Bezos' Y721 versus Steve Jobs' 'Venus'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple urges lawmakers to reject bill that would force it to allow side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Facebook rebuilding ad platform due to App Tracking Transparency, data laws

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Meta ... Read more »

Apple's board recommends voting against all shareholder proposals

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Unsurprisingly, ... Read more »

How AppleInsider staff continue to work from home, two years later

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. All ... Read more »

Apple Watch Series 7 has a fast charging problem

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. One ... Read more »

Apple TV+ has a TikTok and its first challenge promotes 'The Afterparty'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Compared: Jabra Elite 4 Active vs AirPods vs AirPods Pro

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Jabra’s ... Read more »

Connecticut man caught placing an AirTag for stalking

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Amazon launches Apple Watch sale, offering lowest prices in 30 days

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Just ... Read more »

Best deals Feb. 2: $100 off every AirPods Max color, $400 off Vizio 65-inch 4K 120Hz AirPlay TV, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. In ... Read more »

Qualcomm gets another chance to validate patents in Apple lawsuit

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. iPhone ... Read more »

Apple TV+ announces 'Dear Edward' drama from creator of 'Friday Night Lights'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. “Friday ... Read more »