{"id":21033,"date":"2013-11-13T07:56:42","date_gmt":"2013-11-13T15:56:42","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=21033"},"modified":"2016-10-07T12:19:46","modified_gmt":"2016-10-07T19:19:46","slug":"new-osx-crisis-business-cards-gone-wild","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-osx-crisis-business-cards-gone-wild\/","title":{"rendered":"New OSX\/Crisis or Business Cards Gone Wild"},"content":{"rendered":"

In these days of computer conspiracies, the Mac is not left out.\u00a0A new variant of Remote Control System<\/em>, Hacking Team’s spyware, landed on VirusTotal<\/a> with a detection rate of 0 out of 47 scanners.<\/p>\n

RCS<\/em>, also known as\u00a0OSX\/Crisis<\/a>, is an expensive rootkit used by governments during targeted attacks<\/a>. It collects audio, pictures, screenshots, keystrokes and report everything to a remote server. It’s known to be delivered through grey market exploits<\/a>.<\/p>\n

The dropper filename, Biglietto Visita<\/em>, is Italian for business card. Like OSX\/Crisis.A, the code is in a dedicated section<\/a> and uses\u00a0low-level system calls<\/a> to deploy the spyware: a backdoor and its encrypted configuration, an image, a scripting addition and the kernel extensions.<\/p>\n

To avoid antivirus detection, the backdoor is now obfuscated using MPress packer. We can use gdb<\/a> or Volatility<\/a> to dump the unpacked binary. Complete analysis is in progress, as it is another story to put the symbols in place, but here you have an excerpt of the decrypted configuration file:<\/p>\n

\"OSX\/Crisis.B<\/p>\n

As you can see, our infected machines have good reasons to communicate with 176.58.121.242 (we also have packet captures to decrypt<\/a>). At the time of this writing, this Linode UK host is online and moderates unwanted targets quickly (remote uninstall).<\/p>\n

As is, the backdoor do not trigger the social-engineering privilege escalation, or load the kernel extensions.<\/p>\n

Should you feel concerned by government targeted attacks, or recently received a 200k\u20ac<\/a> business card, then look for those files in your Home folder<\/a> and your Startup Disk:<\/p>\n