Tag Archive for: Malware

A way to access Google accounts without a password by Hackers

/in ,

A recent discovery by security researchers has unveiled a new hacking technique that enables cyber criminals to infiltrate individuals’ Google accounts without requiring their passwords. CloudSEK, a security firm, conducted an analysis and identified a malicious form of malware that exploits third-party cookies to gain unauthorized access to users’ private data. This dangerous exploit is already being actively tested by various hacking groups.

The revelation of this exploit occurred in October 2023 when a hacker shared information about it on a Telegram channel. The hacker explained how accounts could be compromised through a vulnerability associated with cookies. Cookies are utilized by websites and browsers to track users and enhance their browsing experience.

Google authentication cookies play a crucial role in allowing users to access their accounts without repeatedly entering their login credentials. However, the hackers have discovered a method to retrieve these cookies, thereby bypassing the security measures of two-factor authentication.

To address this issue, Google Chrome, the world’s most widely used web browser with a market share exceeding 60% last year, is currently taking steps to crack down on third-party cookies.

“We routinely upgrade our defences against such techniques and to secure users who fall victim to malware. In this instance, Google has taken action to secure any compromised accounts detected,” Google said in a statement.

“Users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.”

The researchers who first uncovered the threat said it “underscores the complexity and stealth” of modern cyber-attacks.

“This exploit enables continuous access to Google services, even after a user’s password is reset,” Pavan Karthick M, a threat intelligence researcher at CloudSEK, wrote in a blog post detailing the issue.

“It highlights the necessity for continuous monitoring of both technical vulnerabilities and human intelligence sources to stay ahead of emerging cyber threats.”

The report, titled ‘Exploiting Undocumented OAuth2 Functionality for session hijacking: Malwares Compromising Google Accounts’, was authored by Pavan Karthick M., a threat intelligence researcher at CloudSEK.

Sophisticated Android malware ZooPark tracks all your phone activities

/in

An advanced type of malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps. “ZooPark” targets subjects in the Middle East and was likely developed by a state actor, according to Kaspersky Lab, which first spotted and identified it.

ZooPark has evolved over four generations, having started as simple malware that could “only” steal device account details and address book contacts. The last generation, however, can monitor and exfiltrate keylogs, clipboard data, browser data including searching history, photos and video from the memory card, call records and audio, and data from secure apps like Telegram. It can also capture photos, video, audio and screenshots on its own, without the subject knowing. To get the data out, it can silently make calls, send texts and execute shell commands.

Kaspersky — a company with its own spotty security history that has been banned by the US government — said that it has seen less than 100 targets in the wild. “This and other clues indicates that the targets are specifically selected,” Kasperky Lab’s Alexey Firsh told ZDNet. It also implies that the campaign is backed by a nation state, though the security firm didn’t say which.

How the Malware works

At the same time, Kaspersky suggested that the malware might not have been built in-house. “The latest version may have been bought from vendors of surveillance tools,” it wrote. “That wouldn’t be surprising, as the market for those espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.”

As is now known, a lot of those tools came from the US government itself. A group called Shadow Brokers famously stole exploits from the NSA — some of the zero day, unpatched variety — and eventually released them to the public. In other words, a hacking group was able to obtain malware from what should be the most secure agency in the world. That’s one of the reasons that security experts and companies like Apple don’t trust the US government with device backdoors.

Engadget

GravityRAT: the trojan with a unique trick for evading analysis

/in ,

GravityRAT, a malware allegedly designed by Pakistani hackers, has recently been updated further and equipped with anti-malware evasion capabilites, Maharashtra cybercrime officials said.

The RAT was first detected by Indian Computer Emergency Response Team, CERT-In, on various computers in 2017. It is designed to infiltrate computers and steal the data of users, and relay the stolen data to Command and Control centres in other countries. The ‘RAT’ in its name stands for Remote Access Trojan, which is a program capable of being controlled remotely and thus difficult to trace.

Maharashtra cybercrime department officials said that the latest update to the program by its developers is part of GravityRAT’s function as an Advanced Persistent Threat (APT), which, once it infiltrates a system, silently evolves and does long-term damage.

“GravityRAT is unlike most malware, which are designed to inflict short term damage. It lies hidden in the system that it takes over and keeps penetrating deeper. According to latest inputs, GravityRAT has now become self aware and is capable of evading several commonly used malware detection techniques,” an officer of the cybercrime unit said.

One such technique is ‘sandboxing’, to isolate malware from critical programs on infected devices and provide an extra layer of security.

“The problem, however, is that malware needs to be detected before it can be sandboxed, and GravityRAT now has the ability to mask its presence. Typically, malware activity is detected by the ‘noise’ it causes inside the Central Processing Unit, but GravityRAT is able to work silently. It can also gauge the temperature of the CPU and ascertain if the device is carrying out high intensity activity, like a malware search, and act to evade detection,” another officer said.

Officials said that GravityRAT infiltrates a system in the form of an innocuous looking email attachment, which can be in any format, including MS Word, MS Excel, MS Powerpoint, Adobe Acrobat or even audio and video files.

“The hackers first identify the interests of their targets and then send emails with suitable attachments. Thus a document with ‘share prices’ in the file is sent to those interested in the stock market. Once it is downloaded, it prompts the user to enter a message in a dialogue box, purportedly to prove that the user is not a bot. While the users take this to be a sign of extra security, the action actually initiates the process for the malware to infiltrate the system, triggering several steps that end with GravityRAT sending data to the Command and Control server regularly,” an officer said.

The other concern is that the Command and Control servers are based in several countries. The data is sent in an encrypted format, making it difficult to detect exactly what is leaked.

Special Inspector General of Police (Cyber) Brijesh Singh of Maharashtra Police said, “We urge people to follow basic cyberhygiene like watching what they download, updating their anti-virus software and conducting cyber security reviews regularly.” CERT-In had issued an alert for it last year, with an advisory asking users to review cybersecurity measures and update anti-malware tools.

Facebook Password Stealing Apps Found on Android Play Store

/in

android malware

Even after many efforts made by Google last year, malicious apps always somehow manage to make their ways into Google app store.

Security researchers have now discovered a new piece of malware, dubbed GhostTeam, in at least 56 applications on Google Play Store that is designed to steal Facebook login credentials and aggressively display pop-up advertisements to users.

Discovered independently by two cybersecurity firms, Trend Micro and Avast, the malicious apps disguise as various utility (such as the flashlight, QR code scanner, and compass), performance-boosting (like file-transfer and cleaner), entertainment, lifestyle and video downloader apps.

Like most malware apps, these Android apps themselves don’t contain any malicious code, which is why they managed to end up on Google’s official Play Store.

Once installed, it first confirms if the device is not an emulator or a virtual environment and then accordingly downloads the malware payload, which prompts the victim to approve device administrator permissions to gain persistence on the device.

“The downloader app collects information about the device, such as unique device ID, location, language and display parameters,” Avast said. “The device’s location is obtained from the IP address that is used when contacting online services that offer geolocation information for IPs.”

How Android Malware Steals Your Facebook Account Password

As soon as users open their Facebook app, the malware immediately prompts them to re-verify their account by logging into Facebook. Instead of exploiting any system or application vulnerabilities, the malware uses a classic phishing scheme in order to get the job done.

These fake apps simply launch a WebView component with Facebook look-alike login page and ask users to log-in. Apparently, WebView code steals the victim’s Facebook username and password and sends them to a remote hacker-controlled server.

“This is most likely due to developers using embedded web browsers (WebView, WebChromeClient) in their apps, instead of opening the webpage in a browser,” Avast said.

Trend Micro researchers warn that these stolen Facebook credentials can later be repurposed to deliver “far more damaging malware” or “amass a zombie social media army” to spread fake news or generate cryptocurrency-mining malware.

Stolen Facebook accounts can also expose “a wealth of other financial and personally identifiable information,” which can then be sold in the underground markets.

Security firms believe that GhostTeam has been developed and uploaded to the Play Store by a Vietnamese developer due to considerable use of Vietnamese language in the code.

According to the researchers, the most users affected by the GhostTeam malware reportedly resides in India, Indonesia, Brazil, Vietnam, and the Philippines.

Besides stealing Facebook credentials, the GhostTeam malware also displays pop up adverts aggressively by always keeping the infected device awake by showing unwanted ads in the background.

All the apps have since been removed by Google from the Play Store after researchers reported them to the company. However, users who have already installed one such app on their devices should make sure they have Google Play Protect enabled.

Play Protect security feature uses machine learning and app usage analysis to remove (i.e. uninstall) malicious apps from users Android smartphones in an effort to prevent any further harm.

Although malicious apps floating on the official app store is a never-ending concern, the best way to protect yourself is always to be vigilant when downloading apps, and always verify app permissions and reviews before you download one.

Moreover, you are strongly advised to keep a good antivirus app on your mobile device that can detect and block such threat before they infect your device, and most importantly, always keep your device and apps up-to-date.

The Hacker News

New Bluetooth vulnerability can hack a phone in 10 seconds

/in ,

More than 5.3 billion devices with Bluetooth signals are at risk of a malware attack newly identified by an internet of things security company.

If you’re not keeping count, that’s most of the estimated 8.2 billion devices that use Bluetooth, which allows for our gadgets to connect and communicate wirelessly. Nearly every connected device out there has Bluetooth capability. Your phones, laptops, speakers, car entertainment systems — the list goes on and on to even the most mundane gadgets.

Because those devices can connect to others effortlessly, Bluetooth has left an open attack point for hackers, according to researchers at Armis Labs. The attack method, which they’re calling BlueBorne, is especially dangerous because it can spread without the victim doing anything or noticing it.

In a lot of cases, malware depends on people clicking on a link they shouldn’t have, or downloading a virus in disguise. With BlueBorne, all hackers need to spread malware is for their victims’ devices to have Bluetooth turned on, said Nadir Izrael, Armis’ chief technology officer.

And once one device has been infected, the malware can spread to other devices nearby with the Bluetooth turned on. By scattering over the airwaves, BlueBorne is “highly infectious,” Armis Labs said.

“We’ve run through scenarios where you can walk into a bank and it basically starts spreading around everything,” Izrael said.

The attack echoes the way the WannaCry ransomware spread earlier this year. WannaCry allegedly used the NSA’s EternalBlue vulnerability and infected computers on the same network, even though they never downloaded the virus. That ransomware infected hundreds of thousands of computers within several hours.

Ben Seri, Armis Labs’ head of research, fears that BlueBorne will lead to a similar massive outbreak. In several trials testing out BlueBorne, researchers were able to create botnets and install ransomware using Bluetooth, all under the radar of most protection.

“Imagine there’s a WannaCry on Bluetooth, where attackers can deposit ransomware on the device, and tell it to find other devices on Bluetooth and spread it automatically,” said Michael Parker, the company’s vice president of marketing.

BlueBorne is a collection of eight zero-day vulnerabilities that Armis Labs discovered. Zero-day vulnerabilities are security flaws that are found before developers have a chance to fix them. That kind of exploit lets hackers execute malware remotely, steal data and pretend to be a safe network as a “man in the middle” attack.

It does this by taking advantage of how your Bluetooth uses tethering to share data, the company said. It’s able to spread through “improper validation,” Izrael said. The vulnerability affects devices on most operating systems, including those run by Google, Microsoft and Apple.

The three companies have released patches for the vulnerability. Apple confirmed that BlueBorne is not an issue for its mobile operating system, iOS 10, or later, but Armis noted that all iOS devices with 9.3.5 or older versions are vulnerable. Microsoft released a patch for its computers in July, and anybody who updated would be protected automatically, a spokesman said. Google said Android partners received the patch in early August, but it’s up to the carriers to release the updates. Pixel devices have already received the updates.

Of the 2 billion devices using Android, about 180 million are running on versions that will not be patched, according to Armis.

The concern is the multitude of devices that will not be getting updates. Google, Microsoft and Apple are tech titans that regularly update their products for security. But updates might not be as frequent for single-purpose smart devices like your smart refrigerator or a connected television.

Of the potentially impacted devices, Armis Labs estimated that 40 percent are not going to be patched. That’s more than 2 billion devices that will be left vulnerable to attacks, they warned.

“We’re looking at a forever-day scenario for many of these devices,” Parker said.

You can turn off your Bluetooth to prevent attacks if you won’t receive the patch, Armis advised.

cnet

TNT parcels ‘backed up to ceiling’ in wake of massive cyberattack

/in ,

Parcels are backing up at TNT depots in their thousands after the company admitted it is still struggling to deal with the aftermath of June’s cyber-attack that crippled IT systems around the world.

Frustrated customers trying to get news of their undelivered parcels have been told by TNT’s UK staff that consignments at its East Midlands hub are “going up to the ceiling” as international shipments are still having to be processed by hand.

TNT was one of thousands of big businesses and other organisations hit by the ransomware attack known as “NotPetya” at the end of June. At least 2,000 individuals and organisations worldwide were affected by the attack, which began in the Ukraine.

Most organisations were up and running again within days and hours. But the full scale of the attack’s impact and resulting losses to some big businesses are only now starting to emerge.

On Monday the consumer group Reckitt Benckiser, the maker of Durex and Nurofen, blamed the same IT attack for a 2% fall in second quarter like-for-like sales. TNT’s parent company, FedEx, has already been forced to warn the New York stock exchange that its earnings would be “materially” down as a result of the attack.

The company said last week the problem has affected TNT operations around the world, pushing down its share more than 3%. It admitted that it did not have insurance to cover the attack.

“Customers are still experiencing widespread service and invoicing delays, and manual processes are being used to facilitate a significant portion of TNT operations and customer service functions,” FedEx said.

“We cannot yet estimate how long it will take to restore the systems that were impacted, and it is reasonably possible that TNT will be unable to fully restore all of the affected systems and recover all of the critical business data that was encrypted by the virus.”

Peter Blohm, an antique dealer from Aberystwyth, is one of those caught up the TNT chaos. He has been trying to find out what happened to a consignment of art that left Switzerland on the 11 July and was due to be delivered a day or so later. “TNT tell me they have had no computer systems since the end of June and there is no estimate for when their systems will be fixed,” he told the Guardian.

“This means there are many thousands of parcels which have like mine been waiting for weeks to be processed by hand with pen and paper. The staff sound harassed, but cannot estimate when my parcel will be delivered, because they simply do not know.”

A TNT spokeswoman said on Monday that there was no update to the statement issued last week. A customer care phone line to TNT’s main UK hub was not working on Monday, adding to the frustration of customers.

Earlier this month the Danish shipping group Maersk said it was too early to predict the financial impact of the cyberattack that hit the shipping giant’s computers and delayed cargoes. Other firms affected include the advertising firm WPP, French construction materials company Saint-Gobain, and Russian steel and oil firms Evraz and Rosneft.

Graham Cluley, an independent cybersecurity expert, said the final bill for the attack could be huge. “There’s no such thing as 100% security, but this malware outbreak has disrupted a number of large multinationals for weeks, hitting their systems, and in some cases financial outlook, for six,” Cluley said.

“I really hope that more companies are recognising the benefits of adopting a layered approach to security, examining closely how they have set up their networks, and taking steps to ensure that they are able to recover quickly should disaster strike.”

The Guardian logo

Mac Computers Hacked With ‘FruitFly’ Surveillance Malware

/in , ,

American Apple Mac computers have been hacked with FruitFly malware, Forbes reports.

The hack is thought to be for surveillance as hackers were able to jump into the webcams of the affected computers and take screenshots, though the FruitFly malware has the ability to take over the entire computer.

“This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware,” said Patrick Wardle, cybersecurity researcher, via Forbes. “Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.”

This isn’t the first time that FruitFly is making a hacking appearance. Earlier this year, it was used to target biomedical research centers.

“The only reason I can think of that this malware hasn’t been spotted before now is that it is being used in very tightly targeted attacks, limiting its exposure,” wrote Thomas Reed, MalwareBytes researcher. “Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.”

FruitFly is difficult to detect. Not much is known about the malware.

This cheap password-stealing malware just added to your security headaches

/in ,

A new form of credential-stealing malware — complete with slick marketing and support from its authors — is available for as little as $7, providing wannabes with a worryingly easy entry point into the world of cybercrime.

First appearing a month ago, Ovidiy Stealer is regularly updated by its Russian-speaking authors and the malware has hit targets around the world including the UK, the Netherlands, India, and Russia.

Despite its low price of 450-750 Rubles ($7-13), the malware comes with code designed to avoid analysis and detection.

Uncovered by researchers at Proofpoint, the malware is spread via a number of methods, including malicious email attachments, file-hosting websites, and even within software packages.

It comes with functionality to target multiple applications, but buyers are able to purchase a version of the malware which only focuses on a single browser if they so wish.

If the malware is able to find passwords in its targeted applications, it will send them to the gang using it, putting the victim and their organisation at risk of compromise, especially if the same password is used across multiple accounts.

Ovidiy Stealer is openly sold on a domain which boasts support and features — including the ability to view statistics and logs of infected machines — to potential customers. Payment for the malware is taken by RoboKassa, the Russian equivalent of PayPal.

In order to help drive sales in the competitive criminal world of malware, the developers include statistics and detail plans for future releases of Ovidiy Stealer.

ovidiy-stealer-reviews.png
Reviews help Ovidiy Stealer look appealing to potential buyers.Image: Proofpoint

While Ovidiy Stealer isn’t advanced, the marketing and advertising around it, combined with a low price, could make it very attractive to wannabe cybercriminals who might not otherwise have the expertise to get involved.

“Ovidiy Stealer highlights the manner in the cybercrime marketplace drives innovation and new entrants and challenges organizations that must keep pace with the latest threats to their users, their data, and their systems,” said Proofpoint researchers.

While many cybercriminal operations are run by highly sophisticated gangs which do not sell their products to outsiders, there’s a growing market for ‘cybercrime-as-a-service’ schemes which provide low-level criminals with all the tools they need to get started, in return for a cut of the profits.

ZDNet

‘Petya’ ransomware attack: what is it and how can it be stopped?

/in ,

Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom.

It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers.

The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit.

Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped?

What is ransomware?

Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it.

How does it work?

When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files.

How does the “Petya” ransomware work?

The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint.

Is there any protection?

Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads.

For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine”doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network.

Why is it called “Petya”?

Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance.

Where did it start?

The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments.

How far has it spread?

The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware.

Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight.

So is this just another opportunistic cybercriminal?

It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files.

Who is behind the attack?

It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money.

“This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”.

Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine.

What should you do if you are affected by the ransomware?

The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter.

If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date.

The Guardian logo

Coda Developer Panic Says Source Code for Several Apps Stolen via Handbrake Malware Attack

/in ,

In a blog post on Wednesday, Panic Inc. developer and co-founder Steven Frank disclosed that he downloaded a malware infected version of HandBrake earlier this month, which led to the theft of the source code for several of the company’s popular apps.

In early May, a mirror download server hosting the popular video coding app Handbrake was hacked, and an infected version of the Handbrake app took the place of the genuine article. The hacked version infected user’s machines with OSX.PROTON, which gave hackers root-access privileges to a Mac.

Hacker’s were able to access Frank’s Mac via the infected app, and collected his login credentials, including his git credentials. Frank assures Panic customers that the hacker’s did not access customer data or sync data.

In a case of extraordinarily bad luck, even for a guy that has a lot of bad computer luck, I happened to download HandBrake in that three day window, and my work Mac got pwned.

Long story short, somebody, somewhere, now has quite a bit of source code to several of our apps.

Before I continue, three important points:

  • There’s no indication any customer information was obtained by the attacker.
  • Furthermore, there’s no indication Panic Sync data was accessed.
  • Finally, our web server was not compromised.

(As a reminder, we never store credit card numbers since we process them with Stripe, and all Panic Sync data is encrypted in such a way that even we can’t see it. Read more.)

Panic offers several popular apps, including web editor Coda, FTP app Transmit, SSH client Prompt, and more. The attackers have demanded a large ransom, to be paid via Bitcoin. Panic does not intend to pay the ransom.

Panics warns customers to only download Panic’s apps from the Panic website or the Mac App Store, as the stolen source code could potentially be used to create malware-laden versions of the software packages.

Panic has been in contact with both Apple and the FBI, and Apple’s team is on the lookout for any stolen or malware-infested versions of the Panic apps. The FBI is investigating the matter.

Frank asks that customers notify the company if they see any unofficial Panic apps available in the wild. Such apps are likely to be infected with malware in an attempt to spread their evil payload.

We’ll be working overtime for the foreseeable future to keep an eye on this situation.

But we could also use your help.

If you see any cracked or otherwise unofficial versions of our apps in the wild, it’s safest to assume they are infected, and we ask that you please let us know. If you see our source show up somewhere, also let us know. And if you have information that could help with the investigation into this incident, definitely let us know.

MacTrast