Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/7/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

First Fully Functional Mac Ransomware Contained Before It Could Cause Havoc

KeRanger slips by Apple's protections by piggybacking on legitimate BitTorrent client.

The first fully functional ransomware for Mac OS X has been discovered in the wild, but was contained before it did damage.

Although Kaspersky discovered a Mac ransomware sample in 2014, called FileCoder, it was incomplete. The new ransomware, "KeRanger," found by Palo Alto Networks' Unit 42, is completely capable. KeRanger bypasses Apple's Gatekeeper -- the tool that prevents unsigned code from running on Mac operating systems -- by piggy-backing on an infected version of Transmission, an open-source BitTorrent client, which is signed with a valid Mac application developer's certificate.  

How precisely the ransomware was signed and delivered is unclear. Most likely the certificate was stolen, says Ryan Olson, director of threat intelligence for Unit 42. The cert is owned by a Turkish company, but at this time, Palo Alto does not have much information about how the company was compromised, says Olson. 

It is possible that Transmission's official website was compromised, and that the legitimate Transmission installers were replaced by the recompiled malicious versions, researchers wrote.

When the victim machine downloads and installs the application, KeRanger waits for three days, doing nothing, before it initiates contact with its command-and-control server (via the Tor network).

"Most ransomware doesn't wait," says Olson. Keranger might behave differently because it piggybacks on a legitimate tool. As Olson explains, if a user downloaded Transmission and was immediately hit with a ransomware attack, it would be pretty easy to connect one with the other. The three-day wait would theoretically make it harder to identify the source of the infection...only it didn't work out that way. The Palo Alto team discovered KeRanger quickly, before it was able to do much damage. "They probably didn't expect anyone to find it so fast," says Olson.

If C2 communication is initiated, the server responds with an RSA public key and a text file with straightforward instructions for paying a ransom of 1 Bitcoin to retrieve files. (The instructions also include offers of "decrypt one file for free" and "if you have any questions -- you are welcome.")

KeRanger is attempting to not just encrypt standard files, but also Time Machine backups. It also may be trying to develop backdoor functionality. 

Although Olson says that KeRanger's ability to slip by Gatekeeper does indicate another hole in the walled garden of Apple's secure development environment, this is largely a positive story.

"The reason to not be scared is that the impact was low," says Olson. Apple, he says, responded quickly to the announcement, revoking the abused certificate and updating XProtect signatures.

"However, it’s important to note," says Thomas Reed, director of Mac offerings at Malwarebytes, "that if you have already run the infected copy of Transmission on your Mac, this will not prevent you from opening it again… your Mac will consider it safe at this point, since it has been successfully opened previously. That means this doesn’t help users who are already infected and who have a 3-day timer counting down.

"If you have downloaded the Transmission app recently, you should delete the app and restart your computer," says Reed. "This should prevent re-activation of the malware." 

"This represents an interesting twist in the tale of Mac malware," says James Maude, senior security engineer at Avecto, "as previously many strains first appeared hidden in pirated software on torrent sites. In this case the attackers seems to have targeted the torrent client itself rather than the downloads." 

"This incident appears particularly sophisticated, since it involves a compromise of a software developer's distribution site and an unrelated and likely stolen signing key," says Tod Beardsley, security research manager at Rapid7. "The fact that the compromise was discovered and mitigated in under a day means that the end users of Transmission are at fairly low risk.

"Transmission is a solid and mature open-source project," says Beardsley, "and I'm sure the maintainers are investigating how the website compromise happened in the first place in order to avoid getting Trojaned in the future."

Related stories:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.