Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/7/2017
12:30 PM
Thomas Reed
Thomas Reed
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

OSX.Dok: New & Sophisticated Mac Malware Strikes

Phishing-deployed malware can capture account credentials for any website users log into.

A surprisingly sophisticated new piece of Mac malware, called OSX.Dok, uses sophisticated means to monitor—and potentially alter—all HTTP and HTTPS traffic to and from the infected Mac. This means that the malware is capable, for example, of capturing account credentials for any website users log into, which offers many opportunities for theft of cash and data.

The malware was discovered by Check Point, in the form of a file named Dokument.zip, which was found being emailed to victims in phishing emails. Victims primarily have been located in Europe.

This “document” is, of course, actually an application. The app will obscure the entire screen with a fake update notification.

Image Source: Malwarebytes
Image Source: Malwarebytes

If the user clicks Update All and provides an admin password, the malware will finish installing, though it will take some time.

Among other things, two files will be installed in the user’s LaunchAgents folder to redirect this traffic. These are named com.apple.Safari.pac.plist and com.apple.Safari.proxy.plist. These files will help the malware redirect all web traffic through a malicious proxy server.

Once all this is complete, the malware deletes itself, leaving behind few obvious signs of its presence beyond the two deceptively-named launch agents.

Removal
Removing the two aforementioned LaunchAgents files is sufficient to disable the malware, but there are many leftovers and modifications to the system that cannot be as easily reversed, including:

  • Changes to the sudoers file
  • Installation of an untrustworthy root certificate
  • Installation of a legitimate LaunchAgents file named homebrew.mxcl.tor.plist
  • Installation of numerous legitimate command-line tools, consisting of tens of thousands of files

Malwarebytes Breach Remediation for Mac will detect the important components of this malware as OSX.Dok, disabling the active infection. However, when it comes to the other changes, which introduce vulnerabilities and potential behavior changes that are not easily reversed, additional measures will be needed. For people who don’t know their way around in the Terminal and the arcane corners of the system, it would be wise to seek the assistance of an expert, or erase the hard drive and restore the system from a backup made prior to infection.

The impact on business could be severe, as it could expose information that could allow an attacker to gain access to company resources. For example, consider the potential damage if an infected employee visited an internal company page providing instructions for how to connect to the company VPN and access internal company services. The malware would have sent all that information to the malicious proxy server.

If you have been infected by this malware in a business environment, you should consult with your IT department, so they can be aware of the risks and begin to mitigate them.

Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to be infected by it.

Read the full post on Malwarebytes Labs

Thomas Reed is a self-trained developer and Apple security expert, and is director of Mac offerings at Malwarebytes. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9351
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the a...
CVE-2020-9352
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
CVE-2020-9353
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML ...
CVE-2020-9354
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. pat...
CVE-2020-9355
PUBLISHED: 2020-02-23
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.