The Silver Sparrow

computer virus A computer virus is a type of malware that, when executed, replicates itself by modifying other computer programs and Code injection, inserting its own Computer language, code into those programs. If this replication succeeds, the affected areas ...

malware Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

that runs on

x86 x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel, based on the 8086 microprocessor and its 8-bit-external-bus variant, the 8088. Th ...

- and

Apple M1 Apple M1 is a series of ARM-based system-on-a-chip (SoC) designed by Apple Inc., launched 2020 to 2022. It is part of the Apple silicon series, as a central processing unit (CPU) and graphics processing unit (GPU) for its Mac desktops and no ...

-based

Macintosh Mac is a brand of personal computers designed and marketed by Apple Inc., Apple since 1984. The name is short for Macintosh (its official name until 1999), a reference to the McIntosh (apple), McIntosh apple. The current product lineup inclu ...

computers. Engineers at the cyber security firm Red Canary have detected two versions of the malware in January and February 2021.

Description

Two versions of the malware were reported. The first version (described as the "non-M1" version) is compiled for Intel x86-64. It was first detected in January 2021. The second version contains

code In communications and information processing, code is a system of rules to convert information—such as a letter, word, sound, image, or gesture—into another form, sometimes shortened or secret, for communication through a communicati ...

that runs natively on Apple's proprietary M1 processor, and was probably released in December 2020 and discovered in February 2021. The virus connects to a server hosted on

Amazon Web Services Amazon Web Services, Inc. (AWS) is a subsidiary of Amazon.com, Amazon that provides Software as a service, on-demand cloud computing computing platform, platforms and Application programming interface, APIs to individuals, companies, and gover ...

. The software includes a self-destruct mechanism. As of 23 February 2021, information about how the malware is spread and what system may be compromised is sparse. It is uncertain whether Silver Sparrow is embedded inside malicious advertisements, pirated software, or bogus

Adobe Flash Player Adobe Flash Player (known in Internet Explorer, Firefox, and Google Chrome as Shockwave Flash) is a discontinuedExcept in China, where it continues to be used, as well as Harman for enterprise users. computer program for viewing multimedia ...

updaters. Red Canary has theorized that systems could have been infected through malicious search engine results that might have directed them to download the code. The ultimate object of the malware's release is also still unknown. Silver Sparrow is the second malware virus observed to include M1-native code.

Impact

As of 23 February 2021, Internet security company Malwarebytes has discovered over 29,000 Macs worldwide running their anti-malware software to be infected with Silver Sparrow. Silver Sparrow infected Macs have been found in 153 countries as of February 17, with higher concentrations reported in the US, UK, Canada, France, and Germany, according to data from Malwarebytes. Over 39,000 Macs were affected in the beginning of March 2021. On 23 February 2021, a spokesperson of

Apple Inc. Apple Inc. is an American multinational corporation and technology company headquartered in Cupertino, California, in Silicon Valley. It is best known for its consumer electronics, software, and services. Founded in 1976 as Apple Comput ...

stated that "there is no evidence to suggest the malware they identified has delivered a malicious payload to infected users." Apple also revoked the certificates of the developer accounts used to sign the packages, thereby preventing any additional Macs from becoming infected.

References

2021 in computing Cyberattacks Cybercrime Hacking in the 2020s February 2021 crimes Computer security exploits MacOS malware {{Malware-stub