Tag Archive for: Mac

New Mac Malware Hijacks Web Connections: What to Do

/in ,

“2018 is barely two weeks old, and already it looks like we’ve got new piece of macOS malware! Hooray :)”

That’s how Apple-focused security researcher Patrick Wardle opened a blog post on Jan. 11, detailing what Wardle calls “MaMi,” a stealthy DNS hijacker that reroutes your internet traffic to possibly malicious websites.

MaMi also has abilities that haven’t yet been activated: It can steal passwords, take screenshots, download files and programs, run other pieces of software and inject bogus security certificates.

Check If You’re Infected

To see whether your Mac was infected by MaMi, go to System Preferences, click on the Network section and check the IP address of your DNS server. If it’s “82.163.143.135” or “82.163.142.137,” then you’ll need to change it to something benign, such as Google’s 8.8.8.8 or 8.8.4.4 or OpenDNS’s 208.67.2222.222 or 208.67.220.220.

Notice we said “was” infected. The MaMi sample that Wardle found deleted itself after changing the DNS settings on his test machine, so even if you found a smoking-gun DNS setting, the malware that did it may be long gone.

How to Prevent Infection

To prevent infection by MaMi, use common sense. Every piece of Mac malware found in recent years has required user approval, presumably unwitting, to be installed.

So don’t authorize that Adobe Flash Player update, that video player you apparently need to see a clip of a naked celebrity, or that antivirus software that showed up in a pop-up window telling you your Mac was infected. Instead, hold off and get Mac antivirus software straight from the source.

It’s not yet known how MaMi (named after a text string Wardle found in the code) infects a Mac, though Wardle suspects “rather lame methods such as malicious email, web-based fake security alerts/popups or social-engineering type attacks.” But as of this writing, only one antivirus scanning engine in the online VirusTotal repository detects MaMi through the usual file-matching methods.

How MaMi Malware Works

DNS servers are the phone books of the internet. They match human requests with network addresses  so that, among other things, you can see this website in your web browser.

DNS hijacking sends a computer to a malicious DNS server that could, for example, send you to an evil version of Tom’s Guide that could infect you with even more malware.

It’s not clear how widespread MaMi is so far. Wardle was tipped off to it by a posting on a Malwarebytes forum, but didn’t explain how he located his own copy. Wardle did point to a website that automatically downloaded the binary to our computer when we connected. (We’re using a Windows PC, so the malware didn’t do anything to us.)

tomsguide.com

Mac Computers Hacked With ‘FruitFly’ Surveillance Malware

/in , ,

American Apple Mac computers have been hacked with FruitFly malware, Forbes reports.

The hack is thought to be for surveillance as hackers were able to jump into the webcams of the affected computers and take screenshots, though the FruitFly malware has the ability to take over the entire computer.

“This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware,” said Patrick Wardle, cybersecurity researcher, via Forbes. “Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.”

This isn’t the first time that FruitFly is making a hacking appearance. Earlier this year, it was used to target biomedical research centers.

“The only reason I can think of that this malware hasn’t been spotted before now is that it is being used in very tightly targeted attacks, limiting its exposure,” wrote Thomas Reed, MalwareBytes researcher. “Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.”

FruitFly is difficult to detect. Not much is known about the malware.

Coda Developer Panic Says Source Code for Several Apps Stolen via Handbrake Malware Attack

/in ,

In a blog post on Wednesday, Panic Inc. developer and co-founder Steven Frank disclosed that he downloaded a malware infected version of HandBrake earlier this month, which led to the theft of the source code for several of the company’s popular apps.

In early May, a mirror download server hosting the popular video coding app Handbrake was hacked, and an infected version of the Handbrake app took the place of the genuine article. The hacked version infected user’s machines with OSX.PROTON, which gave hackers root-access privileges to a Mac.

Hacker’s were able to access Frank’s Mac via the infected app, and collected his login credentials, including his git credentials. Frank assures Panic customers that the hacker’s did not access customer data or sync data.

In a case of extraordinarily bad luck, even for a guy that has a lot of bad computer luck, I happened to download HandBrake in that three day window, and my work Mac got pwned.

Long story short, somebody, somewhere, now has quite a bit of source code to several of our apps.

Before I continue, three important points:

  • There’s no indication any customer information was obtained by the attacker.
  • Furthermore, there’s no indication Panic Sync data was accessed.
  • Finally, our web server was not compromised.

(As a reminder, we never store credit card numbers since we process them with Stripe, and all Panic Sync data is encrypted in such a way that even we can’t see it. Read more.)

Panic offers several popular apps, including web editor Coda, FTP app Transmit, SSH client Prompt, and more. The attackers have demanded a large ransom, to be paid via Bitcoin. Panic does not intend to pay the ransom.

Panics warns customers to only download Panic’s apps from the Panic website or the Mac App Store, as the stolen source code could potentially be used to create malware-laden versions of the software packages.

Panic has been in contact with both Apple and the FBI, and Apple’s team is on the lookout for any stolen or malware-infested versions of the Panic apps. The FBI is investigating the matter.

Frank asks that customers notify the company if they see any unofficial Panic apps available in the wild. Such apps are likely to be infected with malware in an attempt to spread their evil payload.

We’ll be working overtime for the foreseeable future to keep an eye on this situation.

But we could also use your help.

If you see any cracked or otherwise unofficial versions of our apps in the wild, it’s safest to assume they are infected, and we ask that you please let us know. If you see our source show up somewhere, also let us know. And if you have information that could help with the investigation into this incident, definitely let us know.

MacTrast