After hiatus, in-the-wild Mac backdoors are suddenly back

After taking a hiatus, Mac malware is suddenly back, with three newly discovered strains that have access to Web cameras, password keychains, and pretty much every other resource on an infected machine.

The first one, dubbed Eleanor by researchers at antivirus provider Bitdefender, is hidden inside EasyDoc Converter, a malicious app that is, or at least was, available on a software download site called MacUpdate. When double clicked, EasyDoc silently installs a backdoor that provides remote access to a Mac's file system and webcam, making it possible for attackers to download files, install new apps, and watch users who are in front of an infected machine. Eleanor communicates with control servers over the Tor anonymity service to prevent them from being taken down or being used to identify the attackers.

"This type of malware is particularly dangerous as it's hard to detect and offers the attacker full control of the compromised system," Tiberius Axinte, technical leader of the Bitdefender Antimalware Lab, said in a blog post published Wednesday. "For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices."

Interestingly, Eleanor won't install itself if it detects a Mac is running Little Snitch, an application firewall that can monitor and control applications' access to the Internet, researchers from fellow antivirus provider Malwarebytes reported in their own Wednesday blog post.

The second recently discovered Mac malware package is known as Keydnap. Its main function is to siphon passwords and cryptographic keys stored in a Mac's keychain feature. The developer openly lifted code from Keychaindump, a proof-of-concept app that streamlines the exfiltration of keychain contents when an attacker knows a Mac's password. Like Eleanor, Keydnap also uses Tor to contact command and control servers.

Researchers from Eset, the AV provider that disclosed the new malicious app, discovered a clever trick Keydnap developers employ to increase the chances an end user will install the malware. Once unpacked from a zip file, the installation file contains a Mach-O executable that's disguised to look like a benign text document or image file. Immediately following the .txt or .jpg extension, the developers added a space character. As a result, double-clicking on the file will launch the file in a Mac's terminal window where it can then be executed.

It's still not clear how Keydnap is being distributed. Malicious files attached to spam messages or downloads from untrusted sites are two possibilities.

The third malicious Mac app is technically classified as adware because it currently does nothing more than inject a barrage of pop-up advertisements on an infected machine. And technically, the recently spotted Pirrit is a variant of an app first spotted earlier this year. Still, Pirrit installs a backdoor that gives it the power to do pretty much anything its developers want.

"Attackers could have used the capabilities built into OSX.Pirrit to install a keylogger and steal your log-in credentials or make off with your company’s intellectual property, among many other bad outcomes," Amit Serper, a researcher with security firm Cybereason, wrote in a report published Wednesday. "Even Macs are vulnerable to threats."

He went on to say that a removal script released in April recently stopped working because the adware had mutated. Code contained in the new variant led him to believe it was developed by someone at TargetingEdge, an Israeli marketing company.

Eleanor and Keydnap are only the second and third pieces of full-blown Mac malware spotted so far this year, with the discovery in March of the KeRanger crypto ransomware being the first, Malwarebytes Director of Mac Offerings Thomas Reed said. If Pirrit is lumped in, the number would grow to four. "I guess when it rains, it pours," he told Ars when asked about the sudden spike.

None of the newly disclosed backdoors are signed by Apple-trusted signing certificates. That means people who use the default settings of OS X are automatically protected, thanks to a security feature known as Gatekeeper. Although there are simple ways attackers can defeat Gatekeeper protections, the protections still provide a layer of security that can drastically lower the chances of a Mac being successfully infected. Users should only change the default settings after carefully thinking through the decision.