Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/7/2017
12:30 PM
Thomas Reed
Thomas Reed
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

OSX.Dok: New & Sophisticated Mac Malware Strikes

Phishing-deployed malware can capture account credentials for any website users log into.

A surprisingly sophisticated new piece of Mac malware, called OSX.Dok, uses sophisticated means to monitor—and potentially alter—all HTTP and HTTPS traffic to and from the infected Mac. This means that the malware is capable, for example, of capturing account credentials for any website users log into, which offers many opportunities for theft of cash and data.

The malware was discovered by Check Point, in the form of a file named Dokument.zip, which was found being emailed to victims in phishing emails. Victims primarily have been located in Europe.

This “document” is, of course, actually an application. The app will obscure the entire screen with a fake update notification.

Image Source: Malwarebytes
Image Source: Malwarebytes

If the user clicks Update All and provides an admin password, the malware will finish installing, though it will take some time.

Among other things, two files will be installed in the user’s LaunchAgents folder to redirect this traffic. These are named com.apple.Safari.pac.plist and com.apple.Safari.proxy.plist. These files will help the malware redirect all web traffic through a malicious proxy server.

Once all this is complete, the malware deletes itself, leaving behind few obvious signs of its presence beyond the two deceptively-named launch agents.

Removal
Removing the two aforementioned LaunchAgents files is sufficient to disable the malware, but there are many leftovers and modifications to the system that cannot be as easily reversed, including:

  • Changes to the sudoers file
  • Installation of an untrustworthy root certificate
  • Installation of a legitimate LaunchAgents file named homebrew.mxcl.tor.plist
  • Installation of numerous legitimate command-line tools, consisting of tens of thousands of files

Malwarebytes Breach Remediation for Mac will detect the important components of this malware as OSX.Dok, disabling the active infection. However, when it comes to the other changes, which introduce vulnerabilities and potential behavior changes that are not easily reversed, additional measures will be needed. For people who don’t know their way around in the Terminal and the arcane corners of the system, it would be wise to seek the assistance of an expert, or erase the hard drive and restore the system from a backup made prior to infection.

The impact on business could be severe, as it could expose information that could allow an attacker to gain access to company resources. For example, consider the potential damage if an infected employee visited an internal company page providing instructions for how to connect to the company VPN and access internal company services. The malware would have sent all that information to the malicious proxy server.

If you have been infected by this malware in a business environment, you should consult with your IT department, so they can be aware of the risks and begin to mitigate them.

Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to be infected by it.

Read the full post on Malwarebytes Labs

Thomas Reed is a self-trained developer and Apple security expert, and is director of Mac offerings at Malwarebytes. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...