Our initial indication of malicious activity was the PlistBuddy process creating a LaunchAgent, so let’s explore the significance of that. With the opening line of Silver Sparrow, “My father, James Witherspoon is a bigamist,” Tayari Jones unveils a breathtaking story about a man’s deception, a family’s complicity, and the teenage girls caught in the middle.

What does the “other woman” represent in the nightmares of women everywhere? The mere thought of an “other woman” existing is terrifying, horrifying, humiliating and for many, beyond imagination. What if the “other woman” had a child? What if she lived in the same town and neighborhood? What if the “other woman” was not a passing fancy, but existed in the husband’s life for decades – visiting her for dinner, giving her money to support herself. What if the husband’s friends and family knew about her? Is the “other woman” to blame? Is the child? How does the child of an “other woman” grow up emotionally healthy when she knows she is living in a shadow? When she knows that she is a secret? What kind of man, husband, father would live this sort of double life? And which family would he choose if his secret was exposed. Silver Sparrow explores the very complicated walls and paths drawn around the hidden life that a bigamist lives and that of his secret second wife and their child. While tools like osquery and antimalware controls have excellent visibility into the contents of LaunchAgents, some endpoint detection and response (EDR) tools have a hard time gaining visibility into LaunchAgents. EDR tooling tends to rely on process monitoring that offers a great deal of visibility into the creation—but not necessarily the contents—of a file. For example, an EDR tool might offer you the following shell command: cp /Volumes/TotesLegit.app/Resources/launcher.plist ~/Library/LaunchAgents/launcher.plist Silver Sparrow revolves around Dana Lynn Yarboro and Chaurisse Witherspoon, who are half-sisters, although only Dana knows this. By contrast, the output of the file command from the extraneous Mach-O binary in version 1 would look like the following: updater: Mach-O 64-bit x86_64 executable, flags: TimelineJones herself is a child of a second marriage, although “there is no scandal there,” she clarifies. “My father is not a bigamist. But I also say to people, ‘My father is not a bigamist that I know of. Just as your father is not a bigamist that you know of.’ That’s part of the mystery of fatherhood.” She has two sisters, but they lived “600 miles away”, while Jones grew up with their father. “I’ve always wondered what their lives were like; what they thought of me; what they thought of the family that I grew up in,” Jones says. “I wrote Silver Sparrow as a gift to my sisters.” The writing in here is beautiful: evocative, nuanced, and weighty. I found myself immersed in it, unable to turn away. There is so much said and unsaid, so many emotions on the surface, but also underneath. The relationships in here are complex and fraught with peril, and each person is doing the best they can given the circumstances, but it often isn't enough. Now, I can't believe that because you know.. the look of him.. he don't look like doodely squat with them big ole' Coke bottle glasses and he's short!" Chaurisse is meek and innocent. Her part of the story is amazing in its illumination. What one girl saw was totally different from what the other experienced. Jones writes different points-of-view in such a way that you want to re-read what the other sister experienced. What I loved most of this novel is when I read Chaurisse’s part, and what I thought as fact from Dana’s part becomes gray. I do love stories that show the messiness of life, the differences of perspective, the well-intentioned acts turning wrong. And this story provides that in spades. Look for a process that appears to be PlistBuddy executing in conjunction with a command line containing the following: LaunchAgents and RunAtLoad and true. This analytic helps us find multiple macOS malware families establishing LaunchAgent persistence.

This is a story of lies, deceit, secrets and need. More than that, there's no other way I can think of to go into this but to talk about the book.. so I'll toss the old spoiler alert on right now for those who need it. Below is what the book is about and my opinion. While we’ve observed legitimate software doing this, this is the first instance we’ve observed it in malware,” researchers said. “This is a deviation from behavior we usually observe in malicious macOS installers, which generally use preinstall or postinstall scripts to execute commands.” As we’ll explain in detail in the technical analysis, the Mach-O compiled binaries don’t seem to do all that much—at least not as of this writing—and so we’ve been calling them “bystander binaries.” The following image represents a high-level look at the two versions of Silver Sparrow malware. The story is narrated from the points of view of the 2 daughters, which I feel was the perfect mechanism for telling this story. As I came to know both Dana and Chaurisse, and began to understand the impact of their parents’ actions on them — physically, mentally, emotionally — I couldn’t help feeling deeply for them. For two teenagers to have to deal with not just a situation that neither of them chose, but also the fallout from it that changes their lives forever, it really made me detest the adults in their lives for their actions (and inactions). Of course, the character I hated the most in this story was the father, James Witherspoon — not just because of his cheating on his wife (which, as it turns out, was probably the least of his aggressions), but because the way he handled the entire situation, he repeatedly caused pain to both his families, which I found to be deplorable. The worst part was James’s nonchalant attitude toward the whole thing — it made me mad how he would constantly assert that he was “doing the best he could” and the fact that he agreed to “own up to his mistake” by providing for Gwen and Dana (as opposed to abandoning them, I suppose) should absolve him of all wrongdoing. But of course, it’s not that simple, as it becomes obvious from the way James treats Gwen and Dana throughout the entire story that he is exasperated with them, at times even making himself out to be the victim rather than the person who created this whole mess to begin with. Some may argue that James is a “flawed” man who made some mistakes, but since he did try to rectify them, he should at least be given some credit for that – while that may be true to some extent and perhaps in other circumstances, I might be more sympathetic, but the James Witherspoon presented as he was in this story made me feel nothing but disdain for him. That remains to be seen, but “this is significant because the M1 ARM64 architecture is young, and researchers have uncovered very few threats for the new platform,” researchers noted.LaunchAgents provide a way to instruct launchd, the macOS initialization system, to periodically or automatically execute tasks. They can be written by any user on the endpoint, but they will usually also execute as the user that writes them. For example, if the user tlambert writes ~/Library/LaunchAgents/evil.plist the tasks described in evil.plist will usually execute as tlambert. For more information, refer to Apple’s documentation. According to data provided by Malwarebytes, the Silver Sparrow activity cluster affected 29,139 macOS endpoints across 153 countries as of February 17, including high volumes of detection in the United States, the United Kingdom, Canada, France, and Germany. Our investigation uncovered two versions of Silver Sparrow malware, which we will refer to as “version 1” and “version 2” throughout this post (see the Indicators of Compromise section for a summary of indicators surrounding these two samples): As Dana Lynn grows, so does her awareness of James’s unusual role—James spends one day a week with her and her mother—and she realizes her place in James’s life is as his other daughter. She grows jealous of Chaurisse and the careless intimacy she has with James, and her curiosity leads her to seek out Chaurisse for a look, a chat, or a friendship. Dana engineers ways of encountering Chaurisse in various situations, and eventually, Dana comes to like her. a b c d e "Silver Sparrow macOS malware with M1 compatibility". Red Canary. 2021-02-18. Archived from the original on 2021-03-25 . Retrieved 2021-03-31.

At the midpoint, the novel splits into two and events are narrated from Chaurisse’s point of view. We see that although the girls have a father in common, what reallydraws them together is their deep, overlapping loneliness. Far from being idyllic, as Dana imagines, Chaurisse’s life has been burdened with its own share of pain. (Dana’s mother may have had to put up with being a “concubine”, but Chaurisse’s mother, pregnant at 14 after a drunken double “date”, asks Witherspoon on their wedding night: “James, did you rape me?”) And while the novel is driven by the question of whether the two sisters can ever accept the truth of one another, it is also propelled by shrewd observations about how they survive the unsteady terrain of young womanhood, that time when “a man looking at you can make you feel chopped into pieces”. This book is as moving, intimate and wise as An American Marriage on the topics of marriage, family and womanhood, and deserves similar acclaim. While out shopping Chaurisse meets a young girl and saves both of them from being caught shoplifting. The girl is named Dana, and Chaurisse grows infatuated with her believing she is a "silver" girl who is beautiful and leads a charmed life. The two become friends with the shy Dana eventually meeting and befriending Laverne as well. James 'wife' is named Laverne. Gwen accepts that James found Laverne first...and respects his wife's rights. After all, she has legal documents. ( I was laughing - thinking.... boy, that's all it takes - legal documents, huh.. - to be ok for your husband to have another wife and daughter? "ok, lol"!!! ). The dialogue is authentic- the story becomes more and more complex. It's heartrending, powerful, funny, and this entire book has a rich quality easily felt between the author and her historical knowledge of her generation --- growing up in Atlanta. I liked it!

Legal

And then Jones gives Bunny Chaurisse Witherspoon her narration. Chaurisse begins her narration telling the reader that her story begins with her mother, Laverne, marring James Witherspoon at age fourteen years old. James and Laverne were babies when they got married, thrown into the adult world. Laverne and James struggled through adolescence with an unexpected and unintended pregnancy. Laverne is a sympathetic character, a woman who had to grow up too fast. She too is a devoted mother. James, in his duplicity, is not a likable character, although Jones doesn’t write him as truly evil, more hapless, and a bit shifty. Jones writes him as a complicated character who loves both of his daughters. Dana and Chaurisse are the same age, however both girls do not possess the same level of knowledge about each other or about their father. Dana and her mother know all about Chaurisse and her mother; they live in their shadow. Every choice and step that Dana and her mother take is tempered by whether Chaurisse and her mother will be there or choose to do something similar. Dana is truly a “second”. Chaurisse and her mother have no idea that Dana exists. But Chaurisse “gets” her father on a daily basis, she lives with him and has the intimacy of a father-daughter relationship. Dana does not have any of this. Her father, while a weekly visitor, is a mystery and almost an intangible. Both versions of Silver Sparrow have an extraneous Mach-O binary that appears to play no additional role in their execution. Though we haven’t observed Silver Sparrow delivering additional malicious payloads yet, its forward-looking M1 chip compatibility, global reach, relatively high infection rate, and operational maturity suggest Silver Sparrow is a reasonably serious threat, uniquely positioned to deliver a potentially impactful payload at a moment’s notice. Given these causes for concern, in the spirit of transparency, we wanted to share everything we know with the broader infosec industry sooner rather than later. Mysterious malware found on 30,000 Macs". www.consumeraffairs.com. 2021-02-22 . Retrieved 2021-02-23.

September 2, 2020: version.json file seen during malware version 2 execution submitted to VirusTotal ( source) The missile uses its INS/GPS for conducting its midcourse trajectory. Homing, up to target destruction, is performed by using its scene-matching technology or Anti-Radiation capability, overcoming any GPS jamming scenario. Dana’s narration is heartbreaking. Tayari Jones does a fantastic job of character development. My heart broke for Dana. What pressure to put on a little girl. Dana’s mom Gwen is a bit murky. She is a character who is difficult to understand in that she knew he was married when she began the affair; yet she is a devoted momma. She works hard and does all she can do to help Dana make the best of her life and her future. The extent to which that has warped her is palpable as Dana recalls all the times her mum, Gwen, has taken her to spy on – Gwen prefers “surveil” – James’s public family. “We didn’t do damage to anyone but ourselves,” she explains. Still, the knowledge she holds over her half-sister electrifies the novel’s second half, which is narrated by Chaurisse, still unaware of her father’s double life. The girls have by then met at a science fair and become pals, with plain, academically unremarkable Chaurisse eager for some of Dana’s cool to rub off on her. She thinks of Dana as a “silver girl”, popular and smart, likening her to a “Barbie doll dipped in chocolate” when she first sees her.

Need Help?

At the heart of it all are the two girls whose lives are at stake, and like the best writers, Jones portrays the fragility of her characers with raw authenticity as they seek love, demand attention, and try to imagine themselves as women. For some reason I was disappointed when the narrative voice changed from Dana to Chaurisse. The situation that both girls were put in was a result of their father's decision-making and Dana's mothers poor judgment. Also curious, the malware comes with a mechanism to completely remove itself, a capability that’s typically reserved for high-stealth operations. So far, though, there are no signs the self-destruct feature has been used, raising the question of why the mechanism exists.