Hackers exploit MacKeeper flaw to spread OS X malware

[Arthur]

Malware spreading malware!

 

Hopefully there aren't any Edugeek's foolish enough to have installed MacKeeper in the first place?

 

Source: BAE Systems

 

Last month a new advisory was published on a vulnerability discovered in MacKeeper, a controversial app created by Ukrainian company ZeoBIT, now owned by Kromtech Alliance Corp.

 

As discovered by Braden Thomas, the flaw in MacKeeper's URL handler implementation allows arbitrary remote code execution when a user visits a specially crafted webpage.

 

The first reports on this vulnerability suggested that no malicious MacKeeper URLs had been spotted in the wild yet. Well, not anymore.

 

Since the proof-of-concept was published, it took just days for the first instances to be seen in the wild.

 

The attack this post discusses can be carried out via a phishing email that contains malicious URL.

 

Once clicked, the users running MacKeeper will be presented with a dialog that suggests they are infected with malware, prompting them for a password to remove this. The actual reason is so that the malware could be executed with the admin rights.

 

Once the password is specified, the malware will be downloaded, saved as /Users/Shared/dufh, and executed.

 

At this stage, the executable file dufh is a dropper. When run, it will dump an embedded executable and then launch it. The dropper will create a plist and update the LaunchAgents in order to enable an auto-start for the created executable ("RunAtLoad").

 

Backdoor functionality

The embedded executable is a bot that allows remote access.

 

It can perform the following actions:

 

• Open a pipe stream and execute shell commands
  
• Upload files to the C&C server
  
• Download files from the C&C server
  
• Set execution permissions and run downloaded files
  

The bot collects system information such as:

 

• List of all processes and their status
  
• Operating system name and version
  
• User name
  
• Availability of any VPN connections
  

 

http://i.imgur.com/C5e7Zwl.png

[rich_tech]

OS X is seemingly getting targetted a bit more these days

[Carter]

It has been known for a while now that MacKeeper is pretty much Malware in itself. I gave it a try some years ago and realized then that it was bad news for Macs. Would slow the computer down and just seemed to be software that didn't have a strong team behind it that I could trust.