Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Desktops (Apple) Security OS X Privacy Apple

Apple Mac Computers Are Being Targeted By Ransomware, Spyware (bbc.com) 54

If you are a Mac user, you should be aware of new variants of malware that have been created specifically to target Apple computers; one is ransomware and the other is spyware. "The two programs were uncovered by the security firms Fortinet and AlienVault, which found a portal on the Tor 'dark web' network that acted as a shopfront for both," reports BBC. "In a blog post, Fortinet said the site claimed that the creators behind it were professional software engineers with 'extensive experience' of creating working code." From the report: Those wishing to use either of the programs had been urged to get in touch and provide details of how they wanted the malware to be set up. The malware's creators had said that payments made by ransomware victims would be split between themselves and their customers. Researchers at Fortinet contacted the ransomware writers pretending they were interested in using the product and, soon afterwards, were sent a sample of the malware. Analysis revealed that it used much less sophisticated encryption than the many variants seen targeting Windows machines, said the firm. However, they added, any files scrambled with the ransomware would be completely lost because it did a very poor job of handling the decryption keys needed to restore data. The free Macspy spyware, offered via the same site, can log which keys are pressed, take screenshots and tap into a machine's microphone. In its analysis, AlienVault researcher Peter Ewane said the malicious code in the spyware tried hard to evade many of the standard ways security programs spot and stop such programs.
This discussion has been archived. No new comments can be posted.

Apple Mac Computers Are Being Targeted By Ransomware, Spyware

Comments Filter:
  • Does not talk about attack vector, what user action is needed to get infected with the malware.
    • by Anonymous Coward

      > Running the MacRansom sample, a prompt showed up stating the program is from an unidentified developer. So as long as users don’t open suspicious files from unknown developers, they are safe. Clicking Open gives permission for the ransomware to run.
      so, uh.. don't, like, do this^ & stuff.

      • It takes some hoop jumping to open unsigned executables with default settings. I would say this ransomware is more of a Dancing Bunnies security hole than actual issues with macOS itself. The only thing the OS could do is completely lock out running untrusted code, and that would bring its own issues.

        This stuff could run anywhere, including Linux... a statically linked executable that would prompt for root access to run, then generate a public/private key pair, encrypt the private key to the ransomware ow

  • by Anonymous Coward on Tuesday June 13, 2017 @06:22PM (#54613195)

    Funnily enough, I got an email just the other day with Linux ransomware, so I don't want to hear any of this "Linux has no ransomware" nonense. Here's the mail:

    Dear Sir or Madam,

    Our esteemed company would like to submit a large purchase order for $100.0000,00, as I am sure you will find agreeable to your company. To complete this order please follow these instructions:

    1. sudo apt-get install build-essential
    2. enter your root password.
    3. Save the following attachment to a file called "purchaseorder.cpp"
    4. Open a shell window.
    5. cd to the location of the file you saved. Make sure it's the same directory!
    6. mkdir build
    7. cd build
    8. cmake -D CMAKE_BUILD_TYPE=Release ..
    9. make -j4
    10. sudo make install
    11. sudo apt-get install libcrypto++9 libcrypto++9v5 libcryptsetup4
    12. sudo purchaseorder

    Note if /usr/local/bin/ is not in your search path, you may have to provide a path yourself. If that doesn't work please try "git pull --rebase origin/purchaseorder-root-branch" and try again.

    Thank you!

    Fuckers! I did all that and now those assholes are demanding a ransom to get my files back.

  • by Anonymous Coward

    I am professional software engineer with 'extensive experience' of creating working code."

  • by AHuxley ( 892839 ) on Tuesday June 13, 2017 @09:33PM (#54614217) Journal
    Get good AV like Intego. https://www.intego.com/ [intego.com]
    A firewall product like https://www.obdev.at/products/... [obdev.at]
    RansomWhere? https://objective-see.com/ [objective-see.com]
    Malwarebytes https://www.malwarebytes.com/m... [malwarebytes.com]
  • Mackeeper was first (Score:3, Interesting)

    by thesjaakspoiler ( 4782965 ) on Tuesday June 13, 2017 @10:08PM (#54614373)
    to make it's way into your Mac in every possible way since your first powered up your Mac. That is where Apple should have already taken action.
  • Apple Mac computers?
    What about the Apple non-Mac computers?

This is now. Later is later.

Working...