{"id":57,"date":"2017-06-23T22:07:45","date_gmt":"2017-06-23T20:07:45","guid":{"rendered":"https:\/\/www.cyril-bras.fr\/?p=57"},"modified":"2017-06-23T22:20:36","modified_gmt":"2017-06-23T20:20:36","slug":"oceanlotus-nouvelle-version-de-porte-derobee-pour-macosx","status":"publish","type":"post","link":"https:\/\/www.cyril-bras.fr\/?p=57","title":{"rendered":"OceanLotus nouvelle version de porte d\u00e9rob\u00e9e pour MACOSX"},"content":{"rendered":"<figure id=\"attachment_59\" aria-describedby=\"caption-attachment-59\" style=\"width: 81px\" class=\"wp-caption alignleft\"><a href=\"https:\/\/researchcenter.paloaltonetworks.com\/unit42\/\"><img loading=\"lazy\" class=\"wp-image-59\" src=\"https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/unit42_400x400.jpg\" alt=\"\" width=\"81\" height=\"81\" srcset=\"https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/unit42_400x400.jpg 240w, https:\/\/www.cyril-bras.fr\/wp-content\/uploads\/2017\/06\/unit42_400x400-150x150.jpg 150w\" sizes=\"(max-width: 81px) 100vw, 81px\" \/><\/a><figcaption id=\"caption-attachment-59\" class=\"wp-caption-text\">Unit 42<\/figcaption><\/figure>\n<p><strong>Palo-Alto<\/strong> a publi\u00e9 un article de Unit 42 [1] qui traite d&rsquo;une nouvelle d\u00e9clinaison (juin 2017) de la porte d\u00e9rob\u00e9e OceanLotus [2] qui affecte les syst\u00e8mes MAC OS. Cette nouvelle mouture, cible particuli\u00e8rement des victimes au Vietnam et reste faiblement d\u00e9tect\u00e9e par les Antivirus quand il y en a un d&rsquo;install\u00e9&#8230; Ce que les analystes ont d\u00e9couvert concerne une am\u00e9lioration notable du code et de la fa\u00e7on de proc\u00e9der.<\/p>\n<p>La charge est incluse dans un fichier zip. Lors de la d\u00e9compression, il s&rsquo;agit en fait de l\u2019ex\u00e9cution de la charge qui pr\u00e9sente une fois lanc\u00e9e un document word qui est alors ouvert comme un leurre. Une fois la machine compromise cette derni\u00e8re contacte un serveur de command and control qui permet une utilisation \u00e0 la demande par les pirates.<\/p>\n<blockquote><p>Most macOS malware in the wild today are not very complex, but threat actors have been quickly improving their tradecraft. The increased level of sophistication and complexity may be indicative of increased targeting of macOS hosts looking to the future.<\/p><\/blockquote>\n<p>La conclusion du rapport met en avant le fait que l&rsquo;on observe une augmentation du degr\u00e9 de sophistication et de complexit\u00e9 des codes malveillants ce qui conduira vers l&rsquo;accroissement du ciblage de machines sous MAC OS dans le futur.<\/p>\n<hr \/>\n<ol>\n<li><a href=\"https:\/\/researchcenter.paloaltonetworks.com\/2017\/06\/unit42-new-improved-macos-backdoor-oceanlotus\/\">https:\/\/researchcenter.paloaltonetworks.com\/2017\/06\/unit42-new-improved-macos-backdoor-oceanlotus\/<\/a><\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/oceanlotus-os-x-malware-disguises-itself-as-adobe-flash-update\/\">https:\/\/www.intego.com\/mac-security-blog\/oceanlotus-os-x-malware-disguises-itself-as-adobe-flash-update\/<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Palo-Alto a publi\u00e9 un article de Unit 42 [1] qui traite d&rsquo;une nouvelle d\u00e9clinaison (juin 2017) de la porte d\u00e9rob\u00e9e OceanLotus [2] qui affecte les syst\u00e8mes MAC OS. Cette nouvelle&hellip; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[19,15],"_links":{"self":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/57"}],"collection":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=57"}],"version-history":[{"count":6,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/57\/revisions"}],"predecessor-version":[{"id":64,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=\/wp\/v2\/posts\/57\/revisions\/64"}],"wp:attachment":[{"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=57"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=57"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cyril-bras.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}