{"id":4104,"date":"2016-03-11T01:19:57","date_gmt":"2016-03-10T17:19:57","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4104"},"modified":"2016-03-11T01:20:09","modified_gmt":"2016-03-10T17:20:09","slug":"mac-os-x-ransomware-keranger-linux-encoder-trojan","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/03\/mac-os-x-ransomware-keranger-linux-encoder-trojan\/","title":{"rendered":"Mac OS X Ransomware KeRanger Is Linux Encoder Trojan"},"content":{"rendered":"<p>So there&#8217;s been a fair bit of noise this past week about the Mac OS X Ransomware, the first of its&#8217; kind called KeRanger. It also happens to be the first popular Mac malware of any form for some time.<\/p>\n<p>It&#8217;s also a lesson to all the Apple fanbois that their OS is not impervious and this was bundled with legit software (<a href=\"https:\/\/www.transmissionbt.com\/\">Transmission<\/a>) and bypassed the Gatekeeper protection as it was signed with a legit cert.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/ker-readme-1200-640x335.png\" alt=\"Mac OS X Ransomware KeRanger\" width=\"640\" height=\"335\" class=\"aligncenter size-medium wp-image-4105\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/ker-readme-1200-640x335.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/ker-readme-1200.png 780w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>It turns out, basically it&#8217;s just the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Linux.Encoder.1\">Linux Encoder Trojan<\/a> (the first Linux ransomware trojan) re-purposed for Macs, as well OS X is a *nix variant based on OpenBSD with a fancy window manager.<\/p>\n<blockquote><p>The world&#8217;s first fully functional OS X ransomware, KeRanger, is really a Mac version of the Linux Encoder Trojan, according to new research from Romanian security software firm Bitdefender.<\/p>\n<p>The infected OS X torrent update carrying KeRanger looks virtually identical to version 4 of the Linux Encoder Trojan that has already infected thousands of Linux servers this year.<\/p>\n<p>KeRanger spread via an infected version of an otherwise legitimate open source BitTorrent application, Transmission. The tainted version (2.90) was available for download between March 4 and March 5, 2016 and came signed with a legitimate developer certificate.<\/p>\n<p>Apple&#8217;s OS X ships with a security feature called Gatekeeper, allowing users to restrict which sources they can install applications from in order to minimize the likelihood of deploying a malicious app. The default setting allows users to install applications from the Mac App Store or applications that are digitally signed by a developer.<\/p>\n<p>By using a developer certificate to sign their wares, the crooks behind KeRanger were able to circumvent Apple&#8217;s GateKeeper control. Apple has since revoked the misused certificate, which was issued to a Turkish firm, so the immediate panic is over.<\/p>\n<p>However, similar attacks along the same lines might easily re-appear, so merely disallowing unsigned software from running on Macs is no defense.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>It&#8217;s a pretty nasty form of cyber-bullying, and well as we wrote before, if you do get hit there&#8217;s not a lot you can do. Even the <a href=\"https:\/\/www.darknet.org.uk\/2015\/10\/fbi-recommends-crypto-ransomware-victims-just-pay\/\">FBI Recommends Crypto Ransomware Victims Just Pay<\/a>. <\/p>\n<p>The developer cert used to sign the dodgy version of Tranmission has been revoked, but it just goes to show the system is not flawless and this could easily happen again.<\/p>\n<blockquote><p>KeRanger isn&#8217;t the first Mac malware with the capability to circumvent Gatekeeper. For example, three years ago the same trick was used in a trojan (KitM.A) found on computers belonging to Angolan civil rights activists, Bitdefender reports.<\/p>\n<p>&#8220;Once the infected installer is executed, the Trojan connects to the command and control centers via TOR and retrieves an encryption key,&#8221; explained Catalin Cosoi, chief security strategist at Bitdefender.<\/p>\n<p>&#8220;After encryption finishes, the KeRanger ransomware creates a file called README_FOR_DECRYPT.txt, which holds the information on how the victim should pay the ransom. The encryption functions are identical to those deployed by the Linux Encoder Trojan and have the same names.&#8221;<\/p>\n<p>Six months ago, only Windows and Android smartphone users needed to worry about ransomware, but that has changed more recently so that Linux server admins and even Mac users need to be wary of potential attack. Windows remains the target of the greatest number of different ransomware strains and the main locus of the problem, as it is for other types of malware.<\/p>\n<p>The developers behind the Linux Encoder malware have either expanded to OS X or have licensed their code to a cybercrime group specializing in OS X attacks, according to Bitdefender.<\/p><\/blockquote>\n<p>I&#8217;m pretty sure no one reading this site will get caught out by this kind of thing, but if you did well that mistake is gonna cost you over $400USD.<\/p>\n<p>Be wary, and do inform your Apple loving friends and family members that the bad guys feel like it&#8217;s worth targeting them now, the free-love, no anti-virus party is over.<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2016\/03\/09\/first_macosx_ransomware_actually_linux_port\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So there&#8217;s been a fair bit of noise this past week about the Mac OS X Ransomware, the first of its&#8217; kind called KeRanger. It also happens to be the first popular Mac malware of any form for some time. It&#8217;s also a lesson to all the Apple fanbois that their OS is not impervious [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So there's been a fair bit of noise this past week about the Mac OS X Ransomware, the first of its' kind called KeRanger.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[18,7],"tags":[4059,6385,104,629],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4104"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4104"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4104\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}