Endpoint
3/7/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

First Fully Functional Mac Ransomware Contained Before It Could Cause Havoc

KeRanger slips by Apple's protections by piggybacking on legitimate BitTorrent client.

The first fully functional ransomware for Mac OS X has been discovered in the wild, but was contained before it did damage.

Although Kaspersky discovered a Mac ransomware sample in 2014, called FileCoder, it was incomplete. The new ransomware, "KeRanger," found by Palo Alto Networks' Unit 42, is completely capable. KeRanger bypasses Apple's Gatekeeper -- the tool that prevents unsigned code from running on Mac operating systems -- by piggy-backing on an infected version of Transmission, an open-source BitTorrent client, which is signed with a valid Mac application developer's certificate.  

How precisely the ransomware was signed and delivered is unclear. Most likely the certificate was stolen, says Ryan Olson, director of threat intelligence for Unit 42. The cert is owned by a Turkish company, but at this time, Palo Alto does not have much information about how the company was compromised, says Olson. 

It is possible that Transmission's official website was compromised, and that the legitimate Transmission installers were replaced by the recompiled malicious versions, researchers wrote.

When the victim machine downloads and installs the application, KeRanger waits for three days, doing nothing, before it initiates contact with its command-and-control server (via the Tor network).

"Most ransomware doesn't wait," says Olson. Keranger might behave differently because it piggybacks on a legitimate tool. As Olson explains, if a user downloaded Transmission and was immediately hit with a ransomware attack, it would be pretty easy to connect one with the other. The three-day wait would theoretically make it harder to identify the source of the infection...only it didn't work out that way. The Palo Alto team discovered KeRanger quickly, before it was able to do much damage. "They probably didn't expect anyone to find it so fast," says Olson.

If C2 communication is initiated, the server responds with an RSA public key and a text file with straightforward instructions for paying a ransom of 1 Bitcoin to retrieve files. (The instructions also include offers of "decrypt one file for free" and "if you have any questions -- you are welcome.")

KeRanger is attempting to not just encrypt standard files, but also Time Machine backups. It also may be trying to develop backdoor functionality. 

Although Olson says that KeRanger's ability to slip by Gatekeeper does indicate another hole in the walled garden of Apple's secure development environment, this is largely a positive story.

"The reason to not be scared is that the impact was low," says Olson. Apple, he says, responded quickly to the announcement, revoking the abused certificate and updating XProtect signatures.

"However, it’s important to note," says Thomas Reed, director of Mac offerings at Malwarebytes, "that if you have already run the infected copy of Transmission on your Mac, this will not prevent you from opening it again… your Mac will consider it safe at this point, since it has been successfully opened previously. That means this doesn’t help users who are already infected and who have a 3-day timer counting down.

"If you have downloaded the Transmission app recently, you should delete the app and restart your computer," says Reed. "This should prevent re-activation of the malware." 

"This represents an interesting twist in the tale of Mac malware," says James Maude, senior security engineer at Avecto, "as previously many strains first appeared hidden in pirated software on torrent sites. In this case the attackers seems to have targeted the torrent client itself rather than the downloads." 

"This incident appears particularly sophisticated, since it involves a compromise of a software developer's distribution site and an unrelated and likely stolen signing key," says Tod Beardsley, security research manager at Rapid7. "The fact that the compromise was discovered and mitigated in under a day means that the end users of Transmission are at fairly low risk.

"Transmission is a solid and mature open-source project," says Beardsley, "and I'm sure the maintainers are investigating how the website compromise happened in the first place in order to avoid getting Trojaned in the future."

Related stories:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.