{"id":6542,"date":"2017-02-07T14:30:24","date_gmt":"2017-02-07T22:30:24","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/02\/07\/news-366\/"},"modified":"2017-02-07T14:30:24","modified_gmt":"2017-02-07T22:30:24","slug":"news-366","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/02\/07\/news-366\/","title":{"rendered":"Mac malware, possibly made in Iran, targets U.S. defense industry"},"content":{"rendered":"

<\/p>\n

Credit to Author: Michael Kan | Date: Tue, 07 Feb 2017 12:50:00 -0800<\/strong><\/p>\n

Just because you\u2019re using a Mac doesn\u2019t mean you\u2019re safe from hackers. That\u2019s what two security researchers are warning, after finding a Mac-based malware that may be an attempt by Iranian hackers to target the U.S. defense industry.<\/p>\n

The malware, called MacDownloader, was found on a website impersonating the U.S. aerospace company United Technologies, according to a report<\/a> from Claudio Guarnieri and Collin Anderson, who are researching Iranian cyberespionage threats.<\/p>\n

The fake site was previously used in a spear-phishing email attack to spread Windows malware and is believed to be maintained by Iranian hackers, the researchers claimed.<\/p>\n

Visitors to the site are greeted with a page about free programs and courses for employees of the U.S. defense companies Lockheed Martin, Raytheon and Boeing.<\/p>\n

The malware itself can be downloaded from an Adobe Flash installer for a video embedded in the site. The website will provide either Windows or Mac-based malware, depending on the detected operating system.<\/p>\n

A screenshot of the fake site.\u00a0<\/p>\n

The MacDownloader malware was designed to profile the victim’s computer, and then steal credentials by generating fake system login boxes and harvesting them from Apple’s password management system, Keychain.<\/p>\n

However, the malware is of shoddy quality and is “potentially a first attempt from an amateur developer,” the researchers said.<\/p>\n

For instance, once the malware is installed, it will generate a fake Adobe Flash Player dialog box, only to then announce that adware was discovered on the computer and that it will attempt to clean it up.<\/p>\n

“These dialogues are also rife with basic typos and grammatical errors, indicating that the developer paid little attention to quality control,” the researchers said.<\/p>\n

In addition, the malware failed to run a script to download additional malicious coding onto the infected Mac. \u00a0<\/p>\n

But despite the shoddy quality, the malware still managed to evade detection on VirusTotal, which aggregates antivirus scanning engines.<\/p>\n

The researchers found other circumstantial evidence that the malware is linked to Iran. An exposed server that the MacDownloader agent uploaded showed wireless networks called “Jok3r” and “mb_1986.” Both of these names have ties to previous Iranian hacking groups, including one known as Flying Kitten<\/a>, which is suspected of targeting U.S. defense contractors and political dissidents.<\/p>\n

In an email, Anderson said a colleague also observed MacDownloader targeting a human rights activist.<\/p>\n

The danger is that many human rights supporters, especially in Iran, are dependent on Apple devices, the researchers said. “While this [malware] is neither sophisticated nor full-featured, its sudden appearance is concerning given the popularity of Apple computers,” they wrote in their report.<\/p>\n

Mac malware is fairly rare, according to security researchers. That’s because hackers tend to attack Windows-based devices, because of their popularity.<\/p>\n

However, Mac-based malware is still popping up here and there. Last month, researchers found another kind designed to spy<\/a> on biomedical research centers. A separate Mac-based Trojan was found<\/a> months earlier, targeting the aerospace industry.\u00a0<\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

\n
\n

Just because you\u2019re using a Mac doesn\u2019t mean you\u2019re safe from hackers. That\u2019s what two security researchers are warning, after finding a Mac-based malware that may be an attempt by Iranian hackers to target the U.S. defense industry.<\/p>\n

The malware, called MacDownloader, was found on a website impersonating the U.S. aerospace company United Technologies, according to a report<\/a> from Claudio Guarnieri and Collin Anderson, who are researching Iranian cyberespionage threats.<\/p>\n