SC Magazine, 2011-09-23
A Mac OS X trojan, disguised as a PDF file, is duping users into loading a backdoor onto their machines, according to researchers at F-Secure.
The trojan is emulating a tactic used for years in delivering malware to Windows systems, by which a PDF file containing a seemingly legitimate extension and icon is employed.
But, this targeting of the Mac OS is rather unusual, Chet Wisniewski, senior security adviser at Sophos, told SCMagazineUS.com on Friday. Up to this point, most Mac malware has tried to push fake anti-virus products on users, but this is one of the first strains that is using this type of social engineering.
"The PDF lure is a good trick to get people to install the trojan," he said. "You think you're opening a document, when you're installing malware."
Mikko Hypponen, chief research officer at F-Secure, told SCMagazineUS.com on Monday that attacks on the Mac OS are still a rare occurence. However, he said it is getting more common, though attacks on OS X are still nowhere near the amount of activity on Windows XP. "In fact, we see more new Android malware than Mac OS X malware," he said.
Once a user is tricked into loading the malware by clicking on the PDF, which contains Chinese language, a trojan dropper installs a backdoor program. From that point, the attacker can gain full control of the user's system.
Usually, backdoors are employed to communicate with a remote command-and-control (C&C) server, which is capable of instructing the payload to siphon off data from the infected computer back to the attackers. However, F-Secure found that the C&C server is a bare Apache installation, not yet capable of communicating with the backdoor.
McAfee, in its own blog post on Sunday, rated the threat as "low risk" because it is not taking advantage of any vulnerability. The PDF file does not actually contain a trojan, and merely acts a decoy so additional "rogue" services can be installed without the user's knowledge.
The good news, McAfee said, is that a properly configured Mac will mitigate the malicious installer.
No matter the level of risk, the threat to the Mac OS may be an indication of things to come, Wisniewski said.
"This exploit could be a one-off, but our suspicion is that the model has been established, and we will see more criminal gang activity," he said.
Clearly, though, the sky is not falling. Windows iremains the preferred target of cybercriminals, who create tens of thousands of new malware threats each day for the platform.
SecurityWeek, 2011-09-23
Yesterday, Cody Kretsinger, a 23-year-old from Phoenix, Arizona was arrested and charged with conspiracy and the unauthorized impairment of a protected computer, according a federal indictment.
How did the Feds track down the alleged LulzSec member? It turns out that a VPN service reportedly used to mask his online identify and location was the one who handed over data to the FBI.
According to the federal indictment (embedded below), Kretsinger registered for a VPN account at HideMyAss.Com under the user name “recursion”. Following that, the indictment said that Kretsinger and other unknown conspirators conducted SQL injection attacks against Sony Pictures in attempt to extract confidential data.
According to a blog post from HideMyAss, they realized that LulzSec members had been utilizing its service after seeing leaked IRC chat logs. The company said it took no action after discovering the hackers had been using its services to hide, saying, there was no evidence to suggest wrongdoing and nothing to identify which accounts they were using.
“At a later date it came as no surprise to have received a court order asking for information relating to an account associated with some or all of the above cases,” they wrote in the post this morning. “As stated in our terms of service and privacy policy our service is not to be used for illegal activity, and as a legitimate company we will cooperate with law enforcement if we receive a court order (equivalent of a subpoena in the US).”
The blog post, titled “Lulzsec fiasco” also added the following: “Our VPN service and VPN services in general are not designed to be used to commit illegal activity. It is very naive to think that by paying a subscription fee to a VPN service you are free to break the law without any consequences. This includes certain hardcore privacy services which claim you will never be identified, these types of services that do not cooperate are more likely to have their entire VPN network monitored and tapped by law enforcement, thus affecting all legitimate customers.”
You can be sure that HideMyAss is not the only provider to be hit with subpoenas and essentially being forced to hand over user data. It’s likely the FBI and other officials are digging deep and requesting similar information from other VPN providers and online services such as Pastebin, Twitter, and other tools and web services commonly used by hackers.
