Posted on August 6, 2020
Undercover is a new software system from Orbicule Inc. That traces the location of missing and stolen Macs. It costs $29.99 for a single user license, or $44 for a household license, and requires. The Macintosh (mainly Mac since 1998) is a family of personal computers designed, manufactured, and sold by Apple Inc. Since January 1984. The original Macintosh is the first successful mass-market personal computer to have featured a graphical user interface, built-in screen, and mouse. Apple sold the Macintosh alongside its popular Apple II, Apple III, and Apple Lisa families of computers. From the Apple menu in the corner of your screen, choose About This Mac. You should see the macOS name, such as macOS Big Sur, followed by its version number. If you need to know the build number as well, click the version number to see it. Which macOS version is the latest? When the thief connects to the Internet on your missing Mac, you will receive an Anti-Theft Location Report with an iSight photo of the thief directly on your iPhone. Hidden is theft tracking software for Mac OS X that works to help you recover your stolen MacBook Pro (or MacBook Air, MacBook, and any other Mac OS X machine really). It works by laying dormant on your Mac until you visit the Hidden website and mark your computer as stolen, this then activates the tracking software.
In June, security researchers discovered a new variant of Mac malware: ThiefQuest (also known as EvilQuest, EffectiveIdiot, and Mac.Ransom.K).
ThiefQuest created a flurry of excitement in the Mac security community, because it appeared to be something extremely rare: honest-to-goodness ransomware for macOS. However, after further analysis, it turned out to be something even more interesting: an evolving hybrid threat that combines ransomware, spyware, and data theft capabilities.
Distribution method
ThiefQuest is being distributed through malicious installer files for pirated apps, including the DJ app Mixed In Key, the music production app Ableton, and the firewall app Little Snitch. It should be noted that all of these apps are legitimate software, and that their developers have nothing to do with ThiefQuest — only the pirated versions of the apps contain malicious components.
If a trojanized installer is not signed with an Apple Developer ID, users will see a warning when they click on it, but they will have the option to ignore this warning and launch the app anyway.
ThiefQuest as ransomware
ThiefQuest, at first glance, appears to be ransomware for macOS. When its ransomware functionality is triggered, ThiefQuest begins encrypting files on the infected system, and eventually directs the victim to a simple ransom note on their Desktop. The note informs the user that they have been infected, and instructs them to send $50 in bitcoin to an anonymous Bitcoin wallet address.
However, there are several reasons to suspect that the ransomware functionality of ThiefQuest isn't really its primary purpose at all.
First of all, ThiefQuest doesn't appear to take encryption all that seriously. It uses a weak standard to encrypt the compromised machine's files — a fact that allowed malware researchers at SentinelOne to build a working decryptor tool within weeks of the new malware's discovery.
Secondly, as security researcher Phil Stokes points out, ThiefQuest demands a relatively paltry ransom (just $50 USD), and offers no way for a victim to contact the bad guys to inform them that the ransom has been paid. In addition, researchers have noticed that the Bitcoin wallet address given in several different samples is identical, meaning that if one of the ransomware's victims did decide to pay, there would be no way for anyone to know which infected computer had actually paid the ransom. Cheap photoshop cs5 for mac. As Stokes wryly notes, that generic Bitcoin wallet address has seen a grand total of zero transactions — meaning that whatever else it may be, ThiefQuest is not exactly a model of persuasive ransomware!
A final oddity of this 'ransomware' is that it appears to leave an infected computer mostly intact: even after it is active, victims can still access and use their systems.
All of this means that if ThiefQuest is only ransomware and nothing more, then things don't add up. It's either very badly designed ransomware, or it's something else — perhaps something that was never intended as ransomware in the first place — with the half-baked ransomware functionality serving as a distraction.
ThiefQuest as spyware and data exfiltration malware
Upon closer inspection, the security researchers analyzing ThiefQuest discovered that it was indeed much more than just shoddy ransomware!
In his detailed two-part analysis, Patrick Wardle notes that the malware's code contains evidence of spyware functionality. Bullet shield mac os. There is a command that starts up a keylogger, and then records keypresses on the system and passes them on to several other functions, which allows the captured data to be outputted as formatted strings.
Wardle also found that ThiefQuest is designed to steal certain types of files from its victims. Once activated, the malware's data exfiltration functionality creates an inventory of the directories and files on the infected machine, and then searches for files that fall into certain sensitive categories (in particular, certificates, cryptocurrency wallets, and keys). If ThiefQuest finds files of interest, it will send their contents back to its command and control server.
ThiefQuest can also contact its C&C server to receive malicious payloads, which can then be executed on the infected machine. The malware appears to support both in-memory payload execution and, as a backup, on-disk execution. In addition, ThiefQuest is able to execute commands given to it by the remote server, and it can also retrieve encoded files and download them onto a compromised system.
In short, whatever failings ThiefQuest may have in the ransomware department, it more than makes up for them with the sophistication and power of its spyware and data exfiltration capabilities!
Other notable features
ThiefQuest has a few other interesting features that are worth mentioning.
Once launched, the malware checks to see if it's running in a virtual machine (VM) or not. VMs are virtualized operating systems that run in specialized software on a host computer, sort of an 'OS within an OS'. Security researchers use virtual machines to study malware safely, so this VM check may indicate that ThiefQuest is attempting to avoid analysis.
In addition, ThiefQuest checks the processes currently running on the system and looks for well-known security products; if it finds one of these, the malware will attempt to shut it down in order to prevent detection.
Finally, ThiefQuest appears to be under active development. New variants have already appeared since the malware was first discovered and analyzed, and one of the new samples even appears to call out Wardle by name — it contains an encrypted string which, when decoded, reads 'Hello Patrick'. Whatever else you can say about them, ThiefQuest's authors appear to have a sense of humor!
How to avoid infection
ThiefQuest is a serious and potentially dangerous hybrid threat for macOS. But there are several simple things you can do to stay safe:
1Say no to piracy
At the time of writing, all samples of ThiefQuest discovered 'in the wild' have been found in pirated versions of popular software. Such pirated apps are often distributed through forums and on filesharing sites. The best way to prevent a ThiefQuest infection is to avoid pirated software and the websites that distribute it. Ethical and legal considerations aside, pirated apps are one of the most common infection vectors used by Mac malware — reason enough to stay far away from them.
2
Follow app safety guidelines
Make sure you're following best practices for running apps safely on your Mac. Only download apps from the Mac App Store, or directly from the website of an app developer that you know and trust. In addition, pay attention to the alert dialogs shown by macOS. If your Mac warns you that an app hasn't been signed with a valid Apple Developer ID, then don't install that app!
2Use an anti-malware tool
Mac users should always run a reputable, regularly updated malware detection tool as an added precaution. Such tools are equipped to detect newer malware variants like ThiefQuest, and in addition will help keep you safe from Potentially Unwanted Programs, keyloggers, and other security and privacy threats. If you don't have this kind of protection on your system yet, MacScan 3 is available as a 30-day trial download (and has already been updated with definitions for multiple variants of ThiefQuest).
ThiefQuest is a fascinating piece of malware from a security research standpoint, and a prime example of the continuing evolution of Mac malware. But it's also a potentially serious threat to Mac users — so if you have additional questions about how to keep yourself safe from ThiefQuest, or deal with a possible infection, please feel free to reach out to us and ask for help.
Online Store
Search
Simple program for your Apple MacBook, MacBook Air, MacBook Pro or any other Mac enables it to call home if stolen. It takes only 2 minutes to install and you never have to know it is there.
'Mac Calls Home' software is reliable solution to track and recover your stolen Mac in nine out of ten cases. It could be used for Mac desktops but we feel that it is the best solution for Apple laptops like Apple MacBook, MacBook Pro, MacBook Air, PowerBook or iBook as long as it has Panther (10.3.x) or newer Mac OS X installed on it, fully compatible with Snow Leopard.
Program will not give itself away to a thief until it's too late.
Once network is available - program will report current IP address to our server and if there is enough time will silently take a snapshot using built-in iSight camera
Single License Annual fee: $14.98/year
How it WorksInstallationFAQ
Once program registered on our server - your information (email, name) will be entered in our database.
Program will be compiled with that information and it will take your snapshot (if iSight camera is available).
All collected information will remain on-file on our server.
Principle 5 0. Gameboy 3d emulator. Program runs every time you Mac is booted. It will run in initial waiting mode and background mode after that (taking virtually no CPU power).
If your Mac is ever stolen - program activates reporting based on login errors or your report of your Mac being stolen.more info..
Mac calls Home will actively seek the network connection once your Mac is stolen and when network becomes available will submit a report.
Normal everyday use of your Mac will not trigger any information collection or submission.
HIGHLIGHTS:
- You could try it first and purchase license later. Unlicensed product will NOT trigger alert on our system.
- Program runs everytime Mac boots-up and it is not giving itself away by any visible means.
- If any user logged normally - program will sleep quietly.
- If program detects login error(s) or if this Mac has been reported stolen - it starts collecting information and reports to the server when network becomes available.
- If one bad login reported - program will report it to our server when Internet becomes available
- Our server collects data and if valid Serial Number found in report - server notifies Mac owner of the last IP location. Your Mac Serial Number will also be included in 'Stolen Macs Database'.
- Mac owner will have a chance to confirm/deny theft. If Mac was not stolen - all collected information immediately deleted from the server.
- If our server collected data from any Mac and there was no response from the owner - information will be deleted in 30 days.
- No forms to fill-out in order to track your stolen Mac - program activates automatically.
- Program is very easy to install and very easy to un-install.
- Program is not dependent on any special framework - it works on Macs out of the box.
Total messages: 17
The Thief Mac Os Download
https://drivestrike.com/ is a great solution that provides Remote Wipe, Remote Lock which makes it so that a thief can't use the stolen laptop because it is a firmware lock. Check it out - their pricing is better too..The Thief Mac Os 11
Wow..riveting. Get a life, people.Sorry for the loss. You can find your MacBook S/N on the box or call Apple with order number. But I do not know if it'll help.
The Thief Mac Os X
I wish I knew about this software 2 weeks ago. My Mac was stolen. Well, the good news is- this will be the first thing to install on my new MacBook ;) thanks! It sounds really great! Just a question- have you any experience or idea how seriously police would take this information you have in case?The Thief Mac Os Catalina
