Endpoint
3/7/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

First Fully Functional Mac Ransomware Contained Before It Could Cause Havoc

KeRanger slips by Apple's protections by piggybacking on legitimate BitTorrent client.

The first fully functional ransomware for Mac OS X has been discovered in the wild, but was contained before it did damage.

Although Kaspersky discovered a Mac ransomware sample in 2014, called FileCoder, it was incomplete. The new ransomware, "KeRanger," found by Palo Alto Networks' Unit 42, is completely capable. KeRanger bypasses Apple's Gatekeeper -- the tool that prevents unsigned code from running on Mac operating systems -- by piggy-backing on an infected version of Transmission, an open-source BitTorrent client, which is signed with a valid Mac application developer's certificate.  

How precisely the ransomware was signed and delivered is unclear. Most likely the certificate was stolen, says Ryan Olson, director of threat intelligence for Unit 42. The cert is owned by a Turkish company, but at this time, Palo Alto does not have much information about how the company was compromised, says Olson. 

It is possible that Transmission's official website was compromised, and that the legitimate Transmission installers were replaced by the recompiled malicious versions, researchers wrote.

When the victim machine downloads and installs the application, KeRanger waits for three days, doing nothing, before it initiates contact with its command-and-control server (via the Tor network).

"Most ransomware doesn't wait," says Olson. Keranger might behave differently because it piggybacks on a legitimate tool. As Olson explains, if a user downloaded Transmission and was immediately hit with a ransomware attack, it would be pretty easy to connect one with the other. The three-day wait would theoretically make it harder to identify the source of the infection...only it didn't work out that way. The Palo Alto team discovered KeRanger quickly, before it was able to do much damage. "They probably didn't expect anyone to find it so fast," says Olson.

If C2 communication is initiated, the server responds with an RSA public key and a text file with straightforward instructions for paying a ransom of 1 Bitcoin to retrieve files. (The instructions also include offers of "decrypt one file for free" and "if you have any questions -- you are welcome.")

KeRanger is attempting to not just encrypt standard files, but also Time Machine backups. It also may be trying to develop backdoor functionality. 

Although Olson says that KeRanger's ability to slip by Gatekeeper does indicate another hole in the walled garden of Apple's secure development environment, this is largely a positive story.

"The reason to not be scared is that the impact was low," says Olson. Apple, he says, responded quickly to the announcement, revoking the abused certificate and updating XProtect signatures.

"However, it’s important to note," says Thomas Reed, director of Mac offerings at Malwarebytes, "that if you have already run the infected copy of Transmission on your Mac, this will not prevent you from opening it again… your Mac will consider it safe at this point, since it has been successfully opened previously. That means this doesn’t help users who are already infected and who have a 3-day timer counting down.

"If you have downloaded the Transmission app recently, you should delete the app and restart your computer," says Reed. "This should prevent re-activation of the malware." 

"This represents an interesting twist in the tale of Mac malware," says James Maude, senior security engineer at Avecto, "as previously many strains first appeared hidden in pirated software on torrent sites. In this case the attackers seems to have targeted the torrent client itself rather than the downloads." 

"This incident appears particularly sophisticated, since it involves a compromise of a software developer's distribution site and an unrelated and likely stolen signing key," says Tod Beardsley, security research manager at Rapid7. "The fact that the compromise was discovered and mitigated in under a day means that the end users of Transmission are at fairly low risk.

"Transmission is a solid and mature open-source project," says Beardsley, "and I'm sure the maintainers are investigating how the website compromise happened in the first place in order to avoid getting Trojaned in the future."

Related stories:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.