Apple has issued the first of a new type of updates to its operating systems: Rapid Security Response. We discuss several new types of Mac malware, and we look at how Google’s cloud sync for its Authenticator app is insecure.
This week’s Intego Mac Podcast security headlines include: Apple has the first worldwide release of its Rapid Security Response updates to operating systems. Did it work? Google announces its immediate support for pass keys, which is macOS and iOS compatible. And its Google Authenticator app as a convenient new feature…that adds a lot of inconvenience. And we found a bevy of malware we need to catch you up on. Now here are the hosts of the Intego Mac podcast: veteran Mac journalist Kirk McElhearn and Intego’s Chief Security Analyst, Josh Long.
Kirk McElhearn 0:49
Good morning, Josh. How are you today?
Josh Long 0:51
I’m doing well. How are you, Kirk?
Kirk McElhearn 0:53
I’m doing okay. Should I say it? May the Fourth be with you?
Josh Long 0:58
That’s right. Yeah, this is going to be published on May 4. So May the Fourth be with you too? It’s feels so weird to say that.
Kirk McElhearn 1:05
Yeah. We’re seeing each other for the first time in two weeks. Last week, we did a pre-recorded episode because you were at the RSA Conference and RSA…What’s that stand for? Like? Really security? Active something? What does RSA stand for?
Josh Long 1:19
Rivest Shamir Adelman, those are the guys behind the RSA encryption algorithms.
Kirk McElhearn 1:26
So I guess the abbreviation is better for marketing than anything else.
Josh Long 1:30
Yeah. Well, RSA eventually became a company name. And now it’s also associated with this conference. But yeah, RSA Conference was really good this year.
Kirk McElhearn 1:40
I remember RSA back in the 90s, when you could use it in email apps on the Mac, am I correct to encrypt email? Is it that old?
Josh Long 1:48
Yeah. RSA has been around for a long time.
Kirk McElhearn 1:51
Should we think that some sort of encryption protocol that is decades old is still reliable?
Josh Long 1:57
Yeah. Yeah. Until we’re able to break today’s encryption using quantum computing technology, then yeah, it’s it’s still reliable.
Kirk McElhearn 2:07
That sounds so futuristic. Quantum computing technology we’ve talked about in the past. And I’ll link to an episode in the show notes where we were discussing quantum computing and what this means for passwords and cryptography in the future. How was the RSA Conference? What did you learn about what was everyone talking about this year?
Josh Long 2:24
It was good. Of course, they did talk a little bit about quantum. And this comes up pretty much every conference, like there’s at least some discussion of it. And the general consensus seems to be that this is probably not realistically coming within the next five, or maybe even 10 years. But it is something that is going to happen eventually. And so we need to be prepared for it. And so that’s why that kind of tends to get talked about every year. But the bigger topic, as you might guess, because of what we’ve been talking about a lot on the podcast for the last several months is AI, right? And how large language models like GPT are really changing the game in a lot of different ways. One of the things that was discussed was about how ChatGPT can be used to find zero-day vulnerabilities, you can actually put code into ChatGPT, for example, and say, Do you see any vulnerabilities here and it can potentially find zero-day vulnerabilities, things that have not yet been discovered. So if you are a bug hunter, and you want to find these things before everybody else does, you could potentially make some money with bug bounty programs just using ChatGPT. Again, you have to know enough to be able to shape those queries, right, and be able to turn that into a report that you can submit to the company. Still, pretty interesting idea.
Kirk McElhearn 3:49
I see a new career path for you, Josh. I know you really want to get a bug bounty. Really seriously.
Josh Long 3:57
It might be kind of fun. But honestly, right now, I don’t really have the time for it. But I’m sure there’s a lot of people out there who have gotten laid off by security companies. Just in the past week after RSA Conference, even companies that sponsored RSA Conference and had big parties there have just laid people off this week, shockingly. So maybe some of those people could make a little bit of side income.
Kirk McElhearn 4:21
I asked ChatGPT what were the main topics of this year’s RSA Conference? And the response was the main topics included cybercrime and cybersecurity, cloud computing, data protection, artificial intelligence and machine learning, identity and access management, DevOps and application security, cyber resilience and risk management, privacy and compliance and IoT security. That’s an awful lot from one conference.
Josh Long 4:46
Yeah. Now are you actually asking ChatGPT proper? Because I thought it was trained only up to 2021.
Kirk McElhearn 4:53
I said this year’s RSA Conference.
Josh Long 4:56
But does it think that it’s that this year is 2021?
Kirk McElhearn 4:59
Well, ChatGPT is able to access things on the web, right?
Josh Long 5:02
Well, my understanding was that ChatGPT was trained up to 2021. If you’re using something like Bing AI, which is based on ChatGPT, that can check the current year, which is actually 2023.
Kirk McElhearn 5:15
Okay, so I’m using on the OpenAI website using ChatGPT. So basically, it was just saying, Well, this year’s RSA Conference was probably like every other year’s RSA Conference, and they covered all of these topics. And they were the same topics every year, because this is all you should talk about at a computer security conference.
Josh Long 5:32
To be fair, yeah, a lot of the same topics do tend to come up from year to year. But yeah, for sure AI was on everybody’s mind, it was in all kinds of side conversations as well. In any case, yeah, there were a lot of other things that were discussed. Patrick Wardle gave a presentation where he dove into some of his adventures reverse engineering some piece of malware. Most of the rest of the conference was not really Apple focused. But at least there were a couple of Apple-related sessions.
Kirk McElhearn 6:02
Speaking about Apple, we had something interesting that happened a couple of days ago, Apple released their first Rapid Security Response for MacOS, iOS and iPad OS. Now they’ve been beta testing this in the various beta builds of the operating systems and the Rapid Security Responses that they have used in the beta testing have been dummies, they haven’t been to fix anything, they’ve just been to test the process. But we got the first proper Rapid Security Response. And you know, what happened when a lot of people tried to install it, they got a dialog saying, “Unable to verify security response, iOS security response 16.4.1 (a) failed verification because you are no longer connected to the internet.” And this lasted for an hour or two, I think
Josh Long 6:45
This is the first time like you say that Rapid Security Responses have gone out to the entire world…
Kirk McElhearn 6:50
…a billion devices.
Josh Long 6:54
Yeah, before this, it was just to beta devices, devices that had opted into Apple’s beta program. So I mean, you know, giving Apple the benefit of the doubt on this, it’s not terribly shocking that if they’re trying to push out updates to that many devices at a time, that there could be a problem. Now, this is not too dissimilar to regular security updates that we get in the form of operating system updates on iOS, sometimes just security updates, but they generally come as a whole operating system update on macOS as well. However, we know that Apple tends to roll those things out over a period of weeks. Normally, at least on iOS, they do that for sure. I’ve even seen indications that they probably do that for macOS as well, because sometimes it can take a long time before you actually get the notification unless you go looking for it. However, the whole idea behind this is there’s some actively exploited vulnerability, presumably. And so Apple needs to get all the devices patched that they can in as quick as period of time as possible. Now, what’s kind of odd about this situation is that, again, this being the first time that they’ve actually done a Rapid Security Response for the general public, but they did not say anything about what the vulnerability was, or vulnerabilities that were patched. So we don’t actually know if it was actively exploited we, we can kind of assume that because why else would they need to put out a Rapid Security Response? But they didn’t explicitly say, and they didn’t say what was patched. My speculation on this is maybe this does apply to previous versions of macOS, for example. Maybe it also applies to other operating systems besides macOS, iOS, iPad OS. And they’re waiting until they patch everything before they announced what they patch.
Kirk McElhearn 8:48
Well, in your article on Intego. Mac security blog, you say that is for the most recent operating systems and older versions of the operating system don’t even support the Rapid Security Response feature. So what you’re suggesting is maybe there are bug fixes that they’re going to roll out in a normal security update for older operating systems, right. What I find interesting about this is, it was a very small update, I think, was 85 megabytes on my iPhone. The installation was extremely quick. Once after it did the whole preparing, which takes several minutes. Once I tapped on install, and it restarted, I got back to my phone’s lock screen in less than a minute. And, you know, we know that iOS updates can take five or 10 minutes. It’s a long process. While we were preparing this episode, I updated my MacBook Air. And well less than a minute before I got back to the login screen. So I guess one of the advantages here is that they’re bypassing the whole big update system, and they found a way to just update individual things. I’ve always suspected that when Apple does a full operating system update, they make a snapshot of the file system, which can take a long time depending on the device and that’s why it’s so slow. And if they found a workaround for this, I think that’s a good thing for security updates.
Josh Long 10:06
Part of the idea of this whole thing being rapid is that, at least in theory, depending on what operating system component they’re patching, they may not necessarily need to restart the device. Maybe they always will on iOS, I’m not really sure about that. But at least on macOS, theoretically, we should be able to get some updates that don’t require a full device restart. But of course, it really does depend on what components they’re patching. If it’s a kernel vulnerability, well, they’re definitely going to require a restart for something like that. It’s definitely interesting that Apple is trying a new thing, and it didn’t go perfectly. But at least now, this is something that Apple has some experience with on a large scale much larger than the beta program. One other thing to note on this, if you are using an older, unsupported Mac that is running the latest operating system, make sure that you don’t have the Rapid Security Response updates installed automatically, because that may break Open Core Legacy Patcher patched Max, so Mac’s that are don’t officially support venture that are running Ventura through Open Core Legacy Patcher. Be careful about that. treat it just like you would any other operating system update, meaning Wait, and make sure that other people aren’t having problems before you upgrade. And if necessary, wait until there’s a new version of Open Core Legacy Patcher. Before installing the update.
Kirk McElhearn 11:34
Is it possible that this Rapid Security Response update was just a test, in other words, that they wanted to do a test on a billion devices.
Josh Long 11:43
I suppose it’s possible, I would hope that they’re not actually beta testing live with real devices.
Kirk McElhearn 11:51
The reason I asked is on Sunday, April 23 here in the UK, every single smartphone in the country at 3pm, give or take a minute or two received a Severe Alert Notification. Now this is a new system that is apparently used in a lot of different countries. It’s based on cell towers. So they don’t, they’re not sending a message to your phone number. They’re sending a message to phones within reach of cell towers. So potentially, if there’s a risk of flooding, or hurricanes or tornadoes, or volcanic eruptions, they’ll send messages to the people who are close to them. And so the whole country got this alert Sunday at 3pm. Give or take one or two minutes, one network didn’t send the alert. And that’s a bit of a problem. And that was the point of the beta test to see how people react, how it’s received. And it was a loud beep. If you were watching TV loud or listening to music, you might not have heard it. But you get a notification I got a notification on my Apple Watch as well for this.
Josh Long 12:48
Yeah, they’ve been doing this in certainly in the United States for for many years. I remember getting like Amber Alerts, for example, a child abduction alert, and they have a loud alarm type tone. And everybody’s phones in the room will go off at the same time if you’re if you’re in a meeting or a conference room with somebody. So this is something that has been available at least in the US for a while and so it sounds like that’s now going to be available across the UK as well.
Kirk McElhearn 13:19
Okay, we’re gonna take a break. When we come back, we’re gonna talk about new Mac malware and new iPhone malware and boy is there a lot of malware these days.
Voice Over 13:29
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego Mac Premium Bundle X9 includes VirusBarrier, the world’s best Mac anti-malware protection, NetBarrier, powerful inbound and outbound firewall security, Personal Backup, to keep your important files safe from ransomware, and much more to help protect, secure, and organize your Mac. Best of all, it’s compatible with macOS Ventura and the latest Apple silicon Macs. Download the free trial of Mac Premium Bundle X9 from intego.com today, when you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode show notes at podcast.intego.com. That’s podcast.intego.com, and click on this episode to find the special discount link exclusively for Intego Mac podcast listeners. Intego, world-class protection and utility software for Mac users made by the Mac security experts.
Kirk McElhearn 14:45
Okay, before we get to new Mac malware and iPhone malware, we have a couple of Google stories to talk about. We’ve mentioned in the past that Google Authenticator, which is an app that you use to generate two factor authentication codes, you’ve never been able to back this up or sync it so If you changed phones, you might lose all of your information for two factor codes. Well, Google has added account sync for authenticator. And this is just wonderful, isn’t it, Josh? Well,
Josh Long 15:10
Google didn’t do this quite right. For some reason.
Kirk McElhearn 15:14
What how is that possible that Google did something wrong?
Josh Long 15:18
Yeah, I know, right? Google doesn’t have the greatest track record for respecting user privacy. And well, in this case, they’ve done something worse than disrespecting your privacy, they’ve actually potentially compromised your security if you’re using this new feature. So first of all, Google Authenticator. There’s nothing wrong with using Google Authenticator, I actually recommend it, it works better for me than a lot of other authentication apps, and has the advantage that it’s very easy to move from one phone to another, just make sure that once you get your new phone set up that all your codes show up there, and you’re good to go. So what this new feature is, is that you can opt in to backing up your authenticator codes, these one time password, you know, codes that get generated, you can backup the seed that makes those one time codes possible to Google’s cloud. But the problem is, apparently, these two FA codes are not being transmitted with end to end encryption. And according to researchers, they’re likely visible to Google, when stored on Google servers.
Kirk McElhearn 16:30
Okay, this this sounds like someone didn’t do their homework. And they did like part of the job, but they didn’t finish it. So they’re not saying that Google can access your password. They’re saying that Google can access the seed, which is what’s used to generate the two factor code, right?
Josh Long 16:48
Yes. But if you have that seed, then you can take that and put it into any other authenticator app, and now be able to get a second factor code for that person’s account,
Kirk McElhearn 16:58
Right, you won’t have the password, but you could use this for a man in the middle attack, where you’re tricking someone into logging into their Google account. And you know, the seed for the second factor. And after you’ve recovered their password on, say, a phishing website, then the second factor once you take control of their account, (Theoretically.) Theoretically,
Josh Long 17:18
This is not something that people need to be terribly worried about. But my recommendation would be don’t turn on synching until Google fixes this. And they have kind of admitted that maybe they didn’t do this the best way that they could have, and so they’re planning to improve this process. In the meantime, there’s no reason for you to sync authenticator to Google’s cloud anyway, in my opinion, as long as you’ve got access to your old phone, when you’re setting up your new phone, and you can just back it up and transfer your data over, then there’s not really any reason to backup to Google’s cloud. Anyway. So Google
Kirk McElhearn 17:54
Authenticator isn’t just for logging into Google, you can use it as a two factor code generator for any website. Right?
Josh Long 18:01
Exactly. Yeah, anything that requires a one time code that gets generated, you know, these like six digit codes, right? You can use a password manager for this if your password manager has this built in one password, has this built in. (iCloud Keychain does too.) Yes, iCloud Keychain even does they didn’t use to but they have that as of last version, or two of iOS has that baked in now. Some password managers have it but it’s like one of those upsell things where you can only get your second factor code if you’re paying for a subscription to that service. Regardless of what password manager you use. You know, often when you’re setting up these second factor codes, they’ll give you like a QR code that you scan with whatever authenticator app you want to set up. You can actually do this with multiple apps. So you can set a one password and you can set a Google Authenticator if you want to have it in more than one place. That’s another reason why it may not make sense for you to back this up to Google’s cloud anyway, because if you’ve got it in, say, one password, if you lose access to Google Authenticator because you lost your phone, you’ve still got your one password database, and so you’re still going to have a way to get your two factor codes.
Kirk McElhearn 19:10
Okay. In other Google News, as of May 3, they have launched past keys for your Google account. We’ve discussed pass keys in the past, and I’ll link in the show notes to an episode where we talked about it to an article on the Intego Max security blog. And you can now convert your Google account to use a pass key you go into your security settings, you say use passkey I did it on my iMac with Safari. Press Touch ID saved the past key went to my iPhone to log into google it asked for a password. So we’re still not in the place where the past keys which are supposed to be saved to the iCloud Keychain actually get saved to the iCloud Keychain. Or is it that my iPhone wasn’t able to detect that I might have a past key. But in any case, past keys will prevent phishing will link to a Google security blog article called ready for this? So long passwords. Thanks for all the fish. I hope you understand the reference here. Pass keys are good. Use pass keys.
Josh Long 20:06
Yep, we’re still not like in a perfect spot yet, but at least like more companies are starting to adopt it. This is a good thing.
Kirk McElhearn 20:13
Okay, we’ve got malware, we’ve got new Mac malware. Let’s start with Atomic Stealer. It has nothing to do with the Pittsburgh football team, I assume.
Josh Long 20:23
No, it doesn’t. As you might guess, stealer malware targets, certain types of things on your system that might be very attractive for a bad guy to remove and exfiltrate from your system. So that could include for example, your key chains so they can steal your passwords that you’ve saved your apple keychain. Of course, all of the typical browser things they want everything that you can autofill and your they want your passwords your cookies, because of course session cookies allow you to just be able to get in too many types of different accounts if you have that cookie stored on your computer. And so if you can steal it, and put it on an on a bad guy’s computer, now that bad guy can be logged in as you typically these stealer malware are looking for things like Bitcoin wallets and other cryptocurrency wallets. Um, so basically, yeah, it’s your typical steal or malware out there in the wild, bad guys are actually selling this stealer malware via a dedicated telegram channel, apparently.
Kirk McElhearn 21:27
And I’m pretty sure that if people were using Intego Virus Barrier, they are protected from this malware. Correct?
Josh Long 21:32
Yeah, if you’ve got all the latest definitions installed, you will be protected from this malware.
Kirk McElhearn 21:38
Okay, the next one we have is RustBucket. And this is used by a BlueNoroff a subgroup of the Lazarus Group. What are the all these names? It’s just like, you know, can it just be like, I don’t know Smith and Smith, right? The subgroup of of World Corp, Inc, something like that.
Josh Long 21:58
Yeah, AAPT groups have a lot of different names. And of course, Lazarus group is just one of like, half a dozen names, at least of that particular group. And so BlueNoroff is a subgroup of Lazarus Group, apparently. So the names that are the most catchy tend to be the ones that news outlets tend to use and pick up on. So
Kirk McElhearn 22:16
I’ll tell you RustBucket, it makes me think of, you know, an old Dodge Dart that a friend of mine had in the 70s.
Josh Long 22:22
Right. RustBucket also is capable of gathering system information from an infected Mac, it comes in the form of a Trojan Horse, an app that’s called internal PDF viewer. Interestingly, this app isn’t signed. So this is the kind of thing that like they either have some other way of getting it to execute for the first time on your system, or they trick you into, you know, right clicking it and opening it to run it for the first time. So when you run this internal PDF viewer, what it does is it displays a PDF to the user. So you think that it’s doing its job and showing you the PDF that it’s supposed to show you. In the meantime, it’s also installing some other malware on your system, and downloading additional payloads. So whatever that might be, whatever the attacker, whatever the threat actor wants to put on your system, they put that on the server, they make it available to download. And it all happens in the background. So you get further infected by whatever other payloads they want to put on your computer, which could do whatever they want, whatever anything malware can do.
Kirk McElhearn 23:31
Okay, we have a couple of stories from Medium called the “Dark Side of the Mac App Store”. We’re not going to spend too much time on this, because this is something we want to cover in more detail in the future. But there’s a security researcher who has been sort of anonymous for a while, and he has been closely monitoring the Mac App Store and has made a disturbing discovery.
Josh Long 23:51
Yes, you might have heard the name “privacyis1st” or he goes by “privacy1st” on medium. His real name is Alex Kleber. And he is a security researcher based in Germany. And he is on a mission to expose malicious and scammy apps in the Mac App Store. Because this is an ongoing problem, as we’ve mentioned many times before, just because something is in the App Store and has been vetted by Apple doesn’t necessarily mean that it’s not a scam app. And so Alex has been recently reporting on a bunch of GPT, lookalike apps, things that are using the same logo or very similar logo and color scheme to OpenAI as official logo. And they’re charging a lot of money for things that you can get free access to. And they’re also violating a bunch of other apps or policies, for example, having multiple developer accounts that are actually all the same company, and multiple apps that are identical to each other but just released on are different names.
Kirk McElhearn 25:01
I don’t think there’s anything wrong with someone saying that app is powered by GPT. We’ll link in the show notes to the Medium articles. Any company can tap into OpenAI’s API. And in fact, I have an OpenAI account. And I’ve been playing around with ChatGPT. And I want to say it cost pennies, but it’s not even pennies. It’s pennies of pennies. It’s like, it’s like a 100th of a cent for every query, it’s really, really cheap. So if anyone’s charging what these companies are charging, it’s overpriced. Now, once this became public, at the end of last year, a lot of companies started building websites, where you could access the features from ChatGPT. And you’d pay $50 A month or $100 a month. If you really want to use these features go to OpenAI.com and create an account. I don’t want to say it’s free, but you’ll spend a couple bucks a month to generate everything that you need. So part of the scam here is that their overpricing? But I don’t think it’s wrong that they say that they’re using GPT.
Josh Long 26:00
No, that is not necessarily wrong, as long as that’s a true statement. And they actually are using it. But they’re using all sorts of different methods of manipulating the Appstore algorithms so that they can rank really highly. One of these apps was ranked number four in the business category in the Mac App Store, for example. They’re stuffing a bunch of fake reviews, all the typical scammy stuff. So do you really want to be trusting these apps with your data? You know, with whatever your querying GPT about a it’s better to use an official trusted app or use the GPT website, the official OpenAI website and the real ChatGPT.
Kirk McElhearn 26:45
I just asked the OpenAI website to give me tweets promoting Joshua Long @theJoshMeister on Twitter security researcher. Know what’s it going to say the security world is better with @theJoshMeister check out Joshua Long’s research to learn more about the latest security trends, or stay ahead of the game with security research from @theJoshMeister follow Joshua Long for the latest security news. I second that follow @theJoshMeister on Twitter, follow @Intego on Twitter as well.
Josh Long 27:13
Yep. All right. Thanks for the promo.
Kirk McElhearn 27:18
Yes, we were having fun before we started recording looking at some of the things that ChatGPT Well, GPT and OpenAI can do. And it is actually quite impressive. We have talked about this a lot. Recently, I think IBM just announced they’re laying off 7000 people in this sort of middle management content creation level that automation is going to replace very quickly. So if you’ve got a job creating content, like reports and texts and things like that, in business, your job may be in danger.
Josh Long 27:45
Bringing this back to RSA Conference, there were a couple of keynote presentations where the presenter asked the audience do you feel like your job is at risk because of things like ChatGPT, and very few people in the audience actually raised their hands that thought their job was at risk. So it does depend, it depends on what exactly you’re doing as your job. But also, if you feel threatened right now, then I would say, learn to use the technology, right? Learn how you can use it to your advantage and also learn about its weaknesses. So if a potential employer or maybe your boss was looking to fire you and replace you with an AI bot, if they’re not very well informed about these things, you can educate them on what kinds of things AI can do very well. And the things that it just does not do a good job of and consider becoming an AI Wrangler, right.
Kirk McElhearn 28:42
AI Sherpa, I think AI Sherpa. (Okay, yeah.) So the AI Sherpa is the person who takes the AI content, does the fact checking corrects the writing and the text and the tone and everything to make it adapt to your business. Because GPT is going to make texts that all sound the same. And if every company uses this, every company’s marketing will sound the same. So you have to learn how to, you have to learn how to customize this to match your company’s marketing plan, your company’s tone, et cetera.
Josh Long 29:12
There’s several websites where you can input any block of text and say “did GPT generate this?” and it will tell you whether it did or not. Obviously, this is something that a lot of teachers are using to make sure that their kids aren’t just cheating and putting something into a bot to try to get an answer and fill out an entire report. Of course, anybody can use this to identify whether something you’ve written was written by GPT as well. So just be aware of that.
Kirk McElhearn 29:40
Okay, that’s enough for this week. Until next week, Josh, stay secure.
Josh Long 29:44
All right, stay secure.
Voice Over 29:47
Thanks for listening to the Intego Mac Podcast—the voice of Mac security—with your hosts, Kirk McElhearn and Josh Long. To get every weekly episode, be sure to follow us on Apple Podcasts, or subscribe in your favorite podcast app. And, if you can, leave a rating, a like, or a review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode podcast.intego.com The Intego website is also where to find details on the full line of Intego security and utility software: intego.com.
If you like the Intego Mac Podcast Podcast, be sure to rate and review it on Apple Podcasts. 
