Date:02/09/16
The security firm ESET warned last month that a new Mac OS X malware started doing the rounds. The threat, dubbed OSX/Keydnap, is capable of stealing the content of the OS X keychain and maintaining a permanent backdoor on the infected system.
At the time, researchers were uncertain how Keydnap had been distributed, but they suspected that cybercriminals used spam messages and downloads from untrusted websites. In reality, it turns out that the malware has also been distributed from a legitimate website.
According to ESET, cybercriminals compromised the official Transmission site and replaced the legitimate application with a malicious version. Experts believe the malware was available for download as Transmission v2.92 between August 28 and August 29.
Users who downloaded the app in this timeframe can determine if they are infected by checking if certain files associated with the malware can be found on their system. Indicators of compromise (IoC) are available on ESET's website.
This was not the first time Mac malware had been served from the Transmission website. In March, Palo Alto Networks warned that a piece of ransomware dubbed KeRanger, which is believed to be based on Linux.Encoder, was delivered via the official Transmission installer.
ESET has found several similarities between KeRanger and Keydnap, such as the fact that both malicious apps were signed with legitimate code-signing certificates that allowed them to bypass Apple’s Gatekeeper feature. Researchers also noticed similarities in the code, including the path and parameter used for the command and control (C&C) URL resource.
The version of Keydnap delivered via the Transmission website is version 1.5. Compared to the version analyzed by ESET last month, it includes a standalone Tor client that allows it to reach its C&C server over the Tor network without needing a separate Tor2Web relay. It also includes a new command that allows cybercriminals to set a different URL for the C&C server.
Site of BitTorrent App "Transmission" Again Used to Deliver OS X Malware
The security firm ESET warned last month that a new Mac OS X malware started doing the rounds. The threat, dubbed OSX/Keydnap, is capable of stealing the content of the OS X keychain and maintaining a permanent backdoor on the infected system.At the time, researchers were uncertain how Keydnap had been distributed, but they suspected that cybercriminals used spam messages and downloads from untrusted websites. In reality, it turns out that the malware has also been distributed from a legitimate website.
According to ESET, cybercriminals compromised the official Transmission site and replaced the legitimate application with a malicious version. Experts believe the malware was available for download as Transmission v2.92 between August 28 and August 29.
Users who downloaded the app in this timeframe can determine if they are infected by checking if certain files associated with the malware can be found on their system. Indicators of compromise (IoC) are available on ESET's website.
This was not the first time Mac malware had been served from the Transmission website. In March, Palo Alto Networks warned that a piece of ransomware dubbed KeRanger, which is believed to be based on Linux.Encoder, was delivered via the official Transmission installer.
ESET has found several similarities between KeRanger and Keydnap, such as the fact that both malicious apps were signed with legitimate code-signing certificates that allowed them to bypass Apple’s Gatekeeper feature. Researchers also noticed similarities in the code, including the path and parameter used for the command and control (C&C) URL resource.
The version of Keydnap delivered via the Transmission website is version 1.5. Compared to the version analyzed by ESET last month, it includes a standalone Tor client that allows it to reach its C&C server over the Tor network without needing a separate Tor2Web relay. It also includes a new command that allows cybercriminals to set a different URL for the C&C server.
Views: 490
©ictnews.az. All rights reserved.
Similar news
- Cellphone Use May Raise Cancer Risk
- Australian police pushes cyber safety education
- Vietnam aims to lead in e-government
- Senate Website Gets Hacked
- US builds net for cyber war games
- Japan enacts anti-computer virus law
- India passes law vs e-waste
- Anonymous Declares War On The City Of Orlando
- Microsoft highlights evolving dangers as online identity data proliferates
- Consumers want internet security to be provided by banks
- Government facilities targets of cyber attack
- South Korean web attacks might been war drill
- Sri Lanka to Establish National Passport Database to Increase Border Security
- Hi-tech crime agencies set to employ information security professionals
- Phone hacking and online campaign bring down the News of the World
