Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/7/2017
12:30 PM
Thomas Reed
Thomas Reed
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

OSX.Dok: New & Sophisticated Mac Malware Strikes

Phishing-deployed malware can capture account credentials for any website users log into.

A surprisingly sophisticated new piece of Mac malware, called OSX.Dok, uses sophisticated means to monitor—and potentially alter—all HTTP and HTTPS traffic to and from the infected Mac. This means that the malware is capable, for example, of capturing account credentials for any website users log into, which offers many opportunities for theft of cash and data.

The malware was discovered by Check Point, in the form of a file named Dokument.zip, which was found being emailed to victims in phishing emails. Victims primarily have been located in Europe.

This “document” is, of course, actually an application. The app will obscure the entire screen with a fake update notification.

Image Source: Malwarebytes
Image Source: Malwarebytes

If the user clicks Update All and provides an admin password, the malware will finish installing, though it will take some time.

Among other things, two files will be installed in the user’s LaunchAgents folder to redirect this traffic. These are named com.apple.Safari.pac.plist and com.apple.Safari.proxy.plist. These files will help the malware redirect all web traffic through a malicious proxy server.

Once all this is complete, the malware deletes itself, leaving behind few obvious signs of its presence beyond the two deceptively-named launch agents.

Removal
Removing the two aforementioned LaunchAgents files is sufficient to disable the malware, but there are many leftovers and modifications to the system that cannot be as easily reversed, including:

  • Changes to the sudoers file
  • Installation of an untrustworthy root certificate
  • Installation of a legitimate LaunchAgents file named homebrew.mxcl.tor.plist
  • Installation of numerous legitimate command-line tools, consisting of tens of thousands of files

Malwarebytes Breach Remediation for Mac will detect the important components of this malware as OSX.Dok, disabling the active infection. However, when it comes to the other changes, which introduce vulnerabilities and potential behavior changes that are not easily reversed, additional measures will be needed. For people who don’t know their way around in the Terminal and the arcane corners of the system, it would be wise to seek the assistance of an expert, or erase the hard drive and restore the system from a backup made prior to infection.

The impact on business could be severe, as it could expose information that could allow an attacker to gain access to company resources. For example, consider the potential damage if an infected employee visited an internal company page providing instructions for how to connect to the company VPN and access internal company services. The malware would have sent all that information to the malicious proxy server.

If you have been infected by this malware in a business environment, you should consult with your IT department, so they can be aware of the risks and begin to mitigate them.

Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to be infected by it.

Read the full post on Malwarebytes Labs

Thomas Reed is a self-trained developer and Apple security expert, and is director of Mac offerings at Malwarebytes. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.