Trends Micro and this "zero day" exploit patch

[d_v_us]

Hey guys, can anyone shed some light on this issue for me. I currently have Aiprotect turned on....does this help should any of my Apple devices click on an "suspicious" imessage prior to them updating with the recent IOS patch the other day for the zero day exploit? Also, once I've patched my apple products...would that potentially "close" (or remove) the malware? And...what if any protection does Trend Micro running on my router help me in this instance.

 

[AndreiV]

AiProtect has nothing to do with your Apple products.

If you looked around the net you would know that Apple already released emergency patches for this exploit on Monday 13th.


Previous thread on this exploit.

The exploit is also model and OS dependant , not every device is vulnerable.

 

[d_v_us]

AiProtect has nothing to do with your Apple products.

If you looked around the net you would know that Apple already released emergency patches for this exploit on Monday 13th.


Previous thread on this exploit.

The exploit is also model and OS dependant , not every device is vulnerable.

Looks like you might have rushed to answer without fully reading my post? While I'm aware that Aiprotect doesnt specifically "protect" devices....its detects potential attacks for devices that connect correct? I have "looked around the net" Hopefully someone else can provide a more constructive input on all the areas I touched on since I mentioned that I've patched already?

 

[Tech9]

Also, once I've patched my apple products...would that potentially "close" (or remove) the malware?

It wasn't malware. It was an exploit, direct access to the device is needed.

 

[SomeWhereOverTheRainBow]

Looks like you might have rushed to answer without fully reading my post? While I'm aware that Aiprotect doesnt specifically "protect" devices....its detects potential attacks for devices that connect correct? I have "looked around the net" Hopefully someone else can provide a more constructive input on all the areas I touched on since I mentioned that I've patched already?

It wasn't malware. It was an exploit, direct access to the device is needed.

@Tech9 "nailed it."

 

[d_v_us]

It wasn't malware. It was an exploit, direct access to the device is needed.

@Tech9 "nailed it."

So although it wasnt malware....the exploit allowed malware to be injected right? Guys...no ones lookin for a fight here....just clear advice on Trends Micro capabilities and...once patched (ANY DEVICE OR OS)...does that take care of the possible threat had a user clicked on it Again...not an SME...total noob here ok?

 

[Tech9]

the exploit allowed malware to be injected right?

No. Exploit is when someone gets more permissions than expected. What is he going to do after is unknown.

 

[SomeWhereOverTheRainBow]

So although it wasnt malware....the exploit allowed malware to be injected right? Guys...no ones lookin for a fight here....just clear advice on Trends Micro capabilities and...once patched (ANY DEVICE OR OS)...does that take care of the possible threat had a user clicked on it Again...not an SME...total noob here ok?

Zero day is an exploit vulnerability on board the device. AI Protect has zero to do with repairing vulnerabilities on devices. It only monitors your internet traffic looking to block bad reputable actors and external threats.

 

[Tech9]

Again...not an SME...total noob here ok?

Here is an example of exploit - you can even test it for yourself and make someone look stupid:

Some of the fancy Chinese keypad locks only look very secure. If there is a relay inside, activated by the right key combination, you can attempt to exploit the lock with a powerful magnet. Relays are electro-mechanical devices and the contacts don't care much where the magnetic field is going to come from - the coil or your magnet. Did you get the idea? In this case you have to have physical assess to the lock. Carrying a magnet inside your pocket isn't a crime, bit it may allow you to enter someone's home without leaving a trace. Good locks use solid state components, they are "patched".

 

[SomeWhereOverTheRainBow]

Here is an example of exploit - you can even test it for yourself and make someone look stupid:

Some of the fancy Chinese keypad locks only look very secure. If there is a relay inside, activated by the right key combination, you can attempt to exploit the lock with a powerful magnet. Relays are electro-mechanical devices and the contacts don't care much where the magnetic field is going to come from - the coil or your magnet. Did you get the idea? In this case you have to have physical assess to the lock. Carrying a magnet inside your pocket isn't a crime, bit it may allow you to enter someone's home without leaving a trace. Good locks use solid state components, they are "patched".

In this case, you would hope AI Protect is being a good neighborhood watch and notices any strange traffic, but being a good neighborhood watch person does not equate to patching or replacing a broken lock. The neighborhood watch person won't even know there is something wrong with that lock.

 

[Tech9]

The old lady with cats may have heard something. She calling the police on you just because you carry a magnet is the "false positive".

 

[d_v_us]

Ok...I'm ready for another walk of shame....it just hit me today how I was trying to tie the Aiprotection tab (and all the tools within) with Apple devices and this latest patch. So...when ur at home and ur Apple devices are using wifi to makes calls, sms txts, etc.,....wouldn't that be a scenario where a potential exploit could be identified by the router (realizing that the signatures would have to be updated as well)? Remember...old noob here so be gentle.

FYI...I did see where there's a command line tool you can run to see if ur devices have been compromised.

 

[Tech9]

wouldn't that be a scenario where a potential exploit could be identified by the router?

Unlikely, unless something starts phoning home with a known to the router voice pitch. Think jailbroken iPhone or rooted Android. Exploits were used to give the users more control over the devices. The router doesn't care much - no harmful in/out activity. Your Antivirus program may recognize the tools used as malicious. I have directories excluded from scans for that reason.

 

[XIII]

FYI...I did see where there's a command line tool you can run to see if ur devices have been compromised.

You can use iMazing instead if you’re not comfortable working on the command line:

Detecting Pegasus Spyware with iMazing

imazing.com

 

[d_v_us]

Thanks everyone for all ur input...looks like I was trending down the wrong rabbit hole from the get go like AndreiV, Tech9 and others had mentioned initially

 

[d_v_us]

You can use iMazing instead if you’re not comfortable working on the command line:

Detecting Pegasus Spyware with iMazing

imazing.com

Uuugh...all you "Very Senior Members" have ur PMs turned off...sucks for me....so XIII...you can vouch for this imazing product then?

Spent all weekend getting up to speed on MVT, WSL, Python, Ubuntu only to see...there's a better way

Oh FYI...it's been confirmed....researchers have found malware hiding in WSL now....Doh

SNB might need ta start a Linux sub forum so I won't hijack this one?

 

[bennor]

Oh FYI...it's been confirmed....researchers have found malware hiding in WSL now....Doh

It should be noted the malware issue is not "hiding" in WSL. It is that malware was (per this link); "written primarily in Python and compiled in the Linux binary format ELF (Executable and Linkable Format) for the Debian operating system." From the TomHardware article you linked to:

The researchers said the malware was distributed via Executable and Linkable Format (ELF) files intended to run on Debian, a popular Linux distribution, and its derivatives. In some cases those files contained a payload intended for a target PC; in others they received a payload from remote command and control infrastructure.

 

[d_v_us]

Yep....providing the reading material for all to interpret right?

 

[XIII]

so XIII...you can vouch for this imazing product then?

For iOS backups: certainly.

For finding this malware? I don’t know. It did not find anything on my devices, just like Amnesty’s command line tool.

 

[d_v_us]

For iOS backups: certainly.

For finding this malware? I don’t know. It did not find anything on my devices, just like Amnesty’s command line tool.

Thank you sir....and as to not finding any malware...that's always a good thing