{"id":65707,"date":"2017-05-01T16:14:14","date_gmt":"2017-05-01T23:14:14","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=65707"},"modified":"2024-05-16T12:58:28","modified_gmt":"2024-05-16T19:58:28","slug":"osxdok-can-read-encrypted-web-traffic-open-a-backdoor","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/osxdok-can-read-encrypted-web-traffic-open-a-backdoor\/","title":{"rendered":"OSX\/Dok Can Read Encrypted Web Traffic, Open a Backdoor"},"content":{"rendered":"

\"Dok<\/p>\n

Security researchers last Friday discovered a new piece of Mac malware, named OSX\/Dok, that affects all versions of OS X, including the latest macOS Sierra. Once installed, OSX\/Dok\u00a0is able to intercept all of your web traffic, even that which is transmitted over HTTPS.<\/p>\n

Hidden alongside Dok, Intego’s malware research team found another variant of the\u00a0malware, called “Bella,” which is very similar on the surface but installs a Remote Access Trojan (RAT) on infected Macs. Intego VirusBarrier<\/a>\u00a0with up-to-date malware definitions will detect and eradicate\u00a0each component as OSX\/Dok.A<\/strong> and OSX\/Dok.B<\/strong> respectively.<\/p>\n

What is the infection vector?<\/h3>\n

OSX\/Dok\u00a0is spread through phishing campaigns and was\u00a0seen posing as an email with questions about tax returns, written in German. According to Check Point<\/a> researchers, OSX\/Dok mostly targets European Mac users, which we will note\u00a0appears\u00a0accurate as these phishing emails have not been reported in other languages.<\/p>\n

\"\"

Image credit: Check Point. Sample of the phishing email spreading the malware.<\/p><\/div>\n

The phishing email contains a Dokument.zip file that, when opened, shows a file named “Dokument,” which\u00a0uses an old Preview application icon that has not been used since OS X 10.9 Mavericks (and a poor quality one at that).<\/p>\n

\"\"<\/p>\n

Compared to the actual Preview app icon used up until OS X 10.9 Mavericks, you can see in the above image that the quality is very poor. To savvy Mac users, this is an instant giveaway that something is amiss. On Macs running OS X 10.10 Yosemite or newer, the icon for Preview has actually changed, so it becomes even easier to spot the fake.<\/p>\n

Where does\u00a0OSX\/Dok.A install?<\/h3>\n

When the Dokument file is opened, a fake warning is displayed while the malware application AppStore.app is placed in the \/Users\/Shared\/ folder.<\/p>\n

\"\"<\/p>\n

Now in its new location, OSX\/Dok\u00a0will execute itself and give all users on the system permission to run the malware, delete the original application copy, and then place itself in the Login Items to ensure it gets a chance to install its payload.<\/p>\n

\"\"<\/p>\n

OSX\/Dok then displays a full screen message, stating that a security issue has been identified and updates are required. This window can not be moved or closed.<\/p>\n

\"\"<\/p>\n

This fake security alert is a ploy to get your administrator password. It asks for your password when the “Update All” button is clicked. The window will stay up for about 5 minutes while in the background several changes to the system are made. These changes include the installation of brew, which in turn facilitates the installation of TOR and SOCAT. If\u00a0OSX\/Dok obtains\u00a0administrator privileges, thanks to the provided password, it grants admin privileges wherever needed without the user ever seeing a password prompt again. This is done by modifying the sudoers file.<\/p>\n

When Dok is done, the full screen window will close and the Login Item is removed. The login item is replaced, however, with several LaunchAgents in \/Users\/*User*\/Library\/LaunchAgents<\/em>.<\/p>\n

com.apple.Safari.pac.plist
\ncom.apple.Safari.proxy.plist
\nhomebrew.mxcl.tor.plist<\/p><\/blockquote>\n

The first two files are obviously meant to look like they belong to Apple’s Safari browser; they don’t, however. The third file might be trying to masquerade as something related to Homebrew<\/a>, a popular macOS package manager.<\/p>\n

Other system changes that are\u00a0made include a change to the Network settings to set up a proxy, and the installation of a root certificate in the System.keychain, which allows the attacker to intercept all web traffic sent through that proxy. Victims will not know that their information is being intercepted, noted<\/a> Check Point:<\/p>\n

By abusing the victim\u2019s new-found trust in this bogus certificate, the attacker can impersonate any website, and the victim will be none the wiser.<\/p><\/blockquote>\n

The proxy setup can be viewed by opening System Preferences<\/strong> > Network<\/strong> > Select your active network connection<\/strong> > Advanced<\/strong> > Proxies<\/strong>.<\/p>\n

\"\"<\/strong><\/p>\n

Open up Applications<\/strong> > Utilities<\/strong> > Keychain Access<\/strong>, and select the System<\/strong> keychain. There you can see the root certificate Dok installed.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

As a result of all of the above actions, when attempting to surf the web, the user\u2019s web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim\u2019s traffic and tamper with it in any way they please.<\/p><\/blockquote>\n

An additional surprise: OSX\/Dok.B<\/h3>\n

Alongside the discovery of Dok, Intego’s malware research team found another piece of malware, called “Bella,” identified by Intego VirusBarrier<\/a> as OSX\/Dok.B. While related to OSX\/Dok.A, its behavior appears to\u00a0be very different\u00a0from the other version.<\/p>\n

The malware comes as a .zip file, named Dokument.zip, and contains an application named Dokument. Just like the above mentioned malware, it installs an AppStore application in \/Users\/Shared\/. The application is signed with the same certificate as well. That is where the similarities end.<\/p>\n

OSX\/Dok.B\u00a0does not display a full screen window that claims software\u00a0updates need to be installed. Instead, it installs a backdoor named Bella, which is open-source and available on GitHub. Bella uses a Command & Control (C&C) server located in Russia and is capable of exfiltrating iOS backups, keychains, iMessage chat history and screenshots it makes. It’s also able to phish for passwords, capture data from your camera and microphone, and more. In short, Bella is a full fledged Remote Access Trojan (RAT) that doesn’t leave any visible traces on the infected system.<\/p>\n

Whereas OSX\/Dok.A modified the system’s network settings and left visible files in the user \/Library\/LaunchAgents folder, OSX\/Dok.B makes no visible changes to any system settings and the files that are placed in the library are invisible.<\/p>\n

The following files are placed in the User library:<\/p>\n

~\/Library\/Containers\/.bella\/Bella
\n~\/Library\/Containers\/.bella\/bella.db
\n~\/Library\/LaunchAgents\/com.apple.iTunes.plist<\/p><\/blockquote>\n

If Bella was able to gain root access, these items will be found in the root library instead.<\/p>\n

Should Mac users be concerned about OSX\/Dok?<\/h3>\n

At the time of writing, Apple has already revoked the developer certificate that was used to sign the malicious applications, which should avoid further infections. This kind of malware can be very dangerous as it can intercept traffic that is supposed to be secure and compromise a host of user data. Just think of what can happen if your online banking login credentials are intercepted.<\/p>\n

How to tell if your Mac is infected (and removal instructions)<\/h3>\n