Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/7/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

First Fully Functional Mac Ransomware Contained Before It Could Cause Havoc

KeRanger slips by Apple's protections by piggybacking on legitimate BitTorrent client.

The first fully functional ransomware for Mac OS X has been discovered in the wild, but was contained before it did damage.

Although Kaspersky discovered a Mac ransomware sample in 2014, called FileCoder, it was incomplete. The new ransomware, "KeRanger," found by Palo Alto Networks' Unit 42, is completely capable. KeRanger bypasses Apple's Gatekeeper -- the tool that prevents unsigned code from running on Mac operating systems -- by piggy-backing on an infected version of Transmission, an open-source BitTorrent client, which is signed with a valid Mac application developer's certificate.  

How precisely the ransomware was signed and delivered is unclear. Most likely the certificate was stolen, says Ryan Olson, director of threat intelligence for Unit 42. The cert is owned by a Turkish company, but at this time, Palo Alto does not have much information about how the company was compromised, says Olson. 

It is possible that Transmission's official website was compromised, and that the legitimate Transmission installers were replaced by the recompiled malicious versions, researchers wrote.

When the victim machine downloads and installs the application, KeRanger waits for three days, doing nothing, before it initiates contact with its command-and-control server (via the Tor network).

"Most ransomware doesn't wait," says Olson. Keranger might behave differently because it piggybacks on a legitimate tool. As Olson explains, if a user downloaded Transmission and was immediately hit with a ransomware attack, it would be pretty easy to connect one with the other. The three-day wait would theoretically make it harder to identify the source of the infection...only it didn't work out that way. The Palo Alto team discovered KeRanger quickly, before it was able to do much damage. "They probably didn't expect anyone to find it so fast," says Olson.

If C2 communication is initiated, the server responds with an RSA public key and a text file with straightforward instructions for paying a ransom of 1 Bitcoin to retrieve files. (The instructions also include offers of "decrypt one file for free" and "if you have any questions -- you are welcome.")

KeRanger is attempting to not just encrypt standard files, but also Time Machine backups. It also may be trying to develop backdoor functionality. 

Although Olson says that KeRanger's ability to slip by Gatekeeper does indicate another hole in the walled garden of Apple's secure development environment, this is largely a positive story.

"The reason to not be scared is that the impact was low," says Olson. Apple, he says, responded quickly to the announcement, revoking the abused certificate and updating XProtect signatures.

"However, it’s important to note," says Thomas Reed, director of Mac offerings at Malwarebytes, "that if you have already run the infected copy of Transmission on your Mac, this will not prevent you from opening it again… your Mac will consider it safe at this point, since it has been successfully opened previously. That means this doesn’t help users who are already infected and who have a 3-day timer counting down.

"If you have downloaded the Transmission app recently, you should delete the app and restart your computer," says Reed. "This should prevent re-activation of the malware." 

"This represents an interesting twist in the tale of Mac malware," says James Maude, senior security engineer at Avecto, "as previously many strains first appeared hidden in pirated software on torrent sites. In this case the attackers seems to have targeted the torrent client itself rather than the downloads." 

"This incident appears particularly sophisticated, since it involves a compromise of a software developer's distribution site and an unrelated and likely stolen signing key," says Tod Beardsley, security research manager at Rapid7. "The fact that the compromise was discovered and mitigated in under a day means that the end users of Transmission are at fairly low risk.

"Transmission is a solid and mature open-source project," says Beardsley, "and I'm sure the maintainers are investigating how the website compromise happened in the first place in order to avoid getting Trojaned in the future."

Related stories:

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...