{"id":14007,"date":"2013-04-26T08:59:08","date_gmt":"2013-04-26T15:59:08","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=14007"},"modified":"2016-10-06T12:05:55","modified_gmt":"2016-10-06T19:05:55","slug":"new-targeted-attack-against-uyghur-mac-users-hitting-the-news","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-targeted-attack-against-uyghur-mac-users-hitting-the-news\/","title":{"rendered":"New Targeted Attack Against Uyghur Mac Users Has Been Hitting the News"},"content":{"rendered":"

A new targeted attack against Uyghur Mac users has been hitting the news. The threat is similar to OSX\/CallMe.A<\/a>\u00a0we reported earlier this year and is already detected by Intego VirusBarrier<\/a>.<\/p>\n

The new sample use the same Word vulnerability, CVE-2009-0563, patched by Microsoft on June 9th, 2009<\/a>.\u00a0It drops a backdoor for PowerPC and Intel Macs that masquerades as a Real Player Updater, just like another variant seen on VirusTotal on February 19th, 2013<\/a>.\u00a0When triggered, it seeks persistence using launchd<\/em> and can even relaunch itself with superuser privileges, abusing sudo<\/em> command and its grace period.<\/p>\n

The malicious binary is a port of Tiny SHell for OS X. It also sends the infected user’s Contact information, the AddressBook “Me” card, to its C&C server (this behavior require user interaction since the introduction of OS X Mountain Lion’s new Privacy features).<\/p>\n

All these facts indicate the attack is specifically targeting people:<\/p>\n