{"id":51355,"date":"2016-03-06T21:51:05","date_gmt":"2016-03-07T05:51:05","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=51355"},"modified":"2016-10-07T12:23:34","modified_gmt":"2016-10-07T19:23:34","slug":"mac-users-hit-by-rare-ransomware-attack-spread-via-transmission-bittorrent-app","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/mac-users-hit-by-rare-ransomware-attack-spread-via-transmission-bittorrent-app\/","title":{"rendered":"Mac Users Hit by Rare Ransomware Attack, Spread via Transmission BitTorrent App"},"content":{"rendered":"

 <\/p>\n

\"KeRanger<\/p>\n

Mac owners who use the open source Transmission BitTorrent client are being warned that a version of the installer was distributed via the app’s official website, infected with a new family of ransomware.<\/p>\n

It is believed that hackers managed to compromise the installer of Transmission version 2.90 on its download site on Friday, March 4, in order to spread ransomware that researchers at Palo Alto Research have dubbed “KeRanger.”<\/a><\/p>\n

The outcome is that if you were unfortunate enough to install Transmission 2.90 onto your Mac, your computer may now be the digital equivalent of ticking time bomb. Because KeRanger waits three days before awaking, encrypting your documents and data files, contacting its command-and-control servers, and demanding a one bitcoin (approximately $400) ransom be paid for your data’s safe return.<\/p>\n

According to the researchers, the KeRanger malware also attempts to encrypt Time Machine backup files, no doubt in an attempt to make it harder for victims to recover their precious data without paying the extortionists.<\/p>\n

And don’t imagine that OS X’s built-in Gatekeeper protection would have saved you, as it appears that the poisoned KeRanger app was signed with a valid Mac app development certificate.<\/p>\n

A message on the official Transmission website confirms the threat to users, and advises that they “immediately upgrade” to version 2.92:<\/p>\n

\"Transmission<\/p>\n

Everyone running 2.90 on OS X should immediately upgrade to 2.92, as they may have downloaded a malware-infected file. This new version will make sure that the “OSX.KeRanger.A” ransomware (more information available here) is correctly removed from you computer.<\/p><\/blockquote>\n

Palo Alto’s research team report that Apple has now revoked the digital certificates that the malware attack was abusing, and updated the rudimentary XProtect anti-virus protection built into the OS X\u00a0operating system. Furthermore, the malicious downloads have now been removed from the Transmission website.<\/p>\n

As MacRumors<\/em> reports<\/a>, the software is alerting users with a bright red warning when the app informs them that an update is available:<\/p>\n

\"Transmission<\/p>\n

Everyone running 2.90 on OS X should immediately upgrade to 2.91 or delete their copy of 2.90, as they may have downloaded a malware-infected file. Using \u201cActivity Monitor\u201d preinstalled in OS X, check whether any process named \u201ckernel_service\u201d is running. If so, double check the process, choose the \u201cOpen Files and Ports\u201d and check whether there is a file name like “\/Users\/\/Library\/kernel_service”. If so, the process is KeRanger\u2019s main process. We suggest terminating it with \u201cQuit -> Force Quit<\/p><\/blockquote>\n

Apple has since revoked the abused certificate and updated XProtect anti-virus signature, and Transmission Project has removed the malicious installers from its website. Intego’s malware research team has also updated its VirusBarrier anti-virus<\/a> definitions to detect\u00a0the ransomware, identified\u00a0as\u00a0OSX\/KeRanger<\/strong>.<\/p>\n

Quite how the Transmission installer package managed to become infected is as yet a mystery. One natural theory is that the attackers may have been able to exploit a security vulnerability on the website to update the binary, having recompiled its open source code after incorporating the malware.<\/p>\n

Reuters is reporting<\/a> that this is the first time Mac users have been threatened by ransomware \u2014 which is a commonly encountered threat on Windows computers.<\/p>\n

However, that’s not quite telling the whole story. Ransomware has admittedly rarely reared its ugly head on the OS X platform, but security researchers have been warning that there is no technical reason why extortionists might not target users of Apple’s operating system just as they have on Windows.<\/p>\n

For instance, in 2014 researchers\u00a0warned of Mac ransomware called “FileCoder,”<\/a> which they described as “unfinished.” More recently, last November, researcher Rafael Salema Marques produced a functional proof of concept of ransomware that he called Mabouia.<\/p>\n

\"Mabouia<\/p>\n

And two months earlier OS X security researcher Pedro Vila\u00e7a published the code of his own Mac ransomware as a warning of what was possible.<\/p>\n

Could this be the beginning of more ransomware attacks for Mac users? It would be a brave man who would bet against it.<\/p>\n

The fact is that ransomware has proven to be a successful way to extort money out of Windows users, and there is little doubt that online criminals will not be tempted to switch the threat to Mac users too \u2014 especially as there continue to be many Mac users who have fooled themselves into believing that they do not need to take basic security precautions, such as running Mac anti-virus software.<\/p>\n

It doesn’t matter if you are running Windows or OS X on your computer, the way to reduce the threat of ransomware blackmailing you for the safe return of your data is the same:<\/p>\n