Endpoint

3/7/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

First Fully Functional Mac Ransomware Contained Before It Could Cause Havoc

KeRanger slips by Apple's protections by piggybacking on legitimate BitTorrent client.

The first fully functional ransomware for Mac OS X has been discovered in the wild, but was contained before it did damage.

Although Kaspersky discovered a Mac ransomware sample in 2014, called FileCoder, it was incomplete. The new ransomware, "KeRanger," found by Palo Alto Networks' Unit 42, is completely capable. KeRanger bypasses Apple's Gatekeeper -- the tool that prevents unsigned code from running on Mac operating systems -- by piggy-backing on an infected version of Transmission, an open-source BitTorrent client, which is signed with a valid Mac application developer's certificate.  

How precisely the ransomware was signed and delivered is unclear. Most likely the certificate was stolen, says Ryan Olson, director of threat intelligence for Unit 42. The cert is owned by a Turkish company, but at this time, Palo Alto does not have much information about how the company was compromised, says Olson. 

It is possible that Transmission's official website was compromised, and that the legitimate Transmission installers were replaced by the recompiled malicious versions, researchers wrote.

When the victim machine downloads and installs the application, KeRanger waits for three days, doing nothing, before it initiates contact with its command-and-control server (via the Tor network).

"Most ransomware doesn't wait," says Olson. Keranger might behave differently because it piggybacks on a legitimate tool. As Olson explains, if a user downloaded Transmission and was immediately hit with a ransomware attack, it would be pretty easy to connect one with the other. The three-day wait would theoretically make it harder to identify the source of the infection...only it didn't work out that way. The Palo Alto team discovered KeRanger quickly, before it was able to do much damage. "They probably didn't expect anyone to find it so fast," says Olson.

If C2 communication is initiated, the server responds with an RSA public key and a text file with straightforward instructions for paying a ransom of 1 Bitcoin to retrieve files. (The instructions also include offers of "decrypt one file for free" and "if you have any questions -- you are welcome.")

KeRanger is attempting to not just encrypt standard files, but also Time Machine backups. It also may be trying to develop backdoor functionality. 

Although Olson says that KeRanger's ability to slip by Gatekeeper does indicate another hole in the walled garden of Apple's secure development environment, this is largely a positive story.

"The reason to not be scared is that the impact was low," says Olson. Apple, he says, responded quickly to the announcement, revoking the abused certificate and updating XProtect signatures.

"However, it’s important to note," says Thomas Reed, director of Mac offerings at Malwarebytes, "that if you have already run the infected copy of Transmission on your Mac, this will not prevent you from opening it again… your Mac will consider it safe at this point, since it has been successfully opened previously. That means this doesn’t help users who are already infected and who have a 3-day timer counting down.

"If you have downloaded the Transmission app recently, you should delete the app and restart your computer," says Reed. "This should prevent re-activation of the malware." 

"This represents an interesting twist in the tale of Mac malware," says James Maude, senior security engineer at Avecto, "as previously many strains first appeared hidden in pirated software on torrent sites. In this case the attackers seems to have targeted the torrent client itself rather than the downloads." 

"This incident appears particularly sophisticated, since it involves a compromise of a software developer's distribution site and an unrelated and likely stolen signing key," says Tod Beardsley, security research manager at Rapid7. "The fact that the compromise was discovered and mitigated in under a day means that the end users of Transmission are at fairly low risk.

"Transmission is a solid and mature open-source project," says Beardsley, "and I'm sure the maintainers are investigating how the website compromise happened in the first place in order to avoid getting Trojaned in the future."

Related stories:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.