Malware Is Mac Users Via Leak In MacKeeper

Mac users who have installed warned the MacKeeper program for malware that attempts to spread via a flaw in the software that an update was published in May. Last month, a vulnerability in MacKeeper discovered that an attacker could execute arbitrary code with root privileges without much user interaction. The problem was caused by the way MacKeeper with "custom URLs" deal.

Braden Thomas researcher who discovered was a proof-of-concept that ensures that carried when visiting a specially prepared page with Safari arbitrary commands on the system problem. A few days after the proof-of-concept appeared online are also the first malicious MacKeeper URLs appear, discovered researcher Sergei Shevchenko of security company BAE Systems.

Phishing Mail

The URLs can for example be spread through phishing emails. When users click on the link, a pop-up warning that malware was found on the computer that must be removed. For this, the user must enter his password. Fills the user password, the malware is downloaded and installed. According to Shevchenko, it is a backdoor which receives an attacker remote access to the computer.

The malware collects all sorts of data on the system, including running processes, operating system name and version, user name, and the presence of VPN connections. According to the researcher, it is interesting to see how quickly attackers made use of the leak. To carry out the attack, a user must have installed a vulnerable version of MacKeeper. The developers of the software claim that MacKeeper has been downloaded over 20 million times.

Shevchenko also does not exclude that the attackers bombard their targets with phishing emails in the hope that one MacKeeper installed. After the leak last month became known MacKeeper came quickly but with an update that is installed automatically in most cases. It is also the question of how successful this attack campaign is or was.

Kaspersky Would Have Hesitation About Revealing Cyber Attacks

The Russian anti-virus firm Kaspersky Lab would have hesitation about revealing two cyber attacks attributed to the Russian regime, as were sources within the company across Reuters have announced.According to founder Eugene Kaspersky, the company never asked by government to refrain from investigating a cyber attack.

The researchers would not be guided by the political interests of a country. Yet, say several current and former employees of the company Kaspersky Lab about publishing at least two alleged cyber attacks has hesitated. Kaspersky Lab as published last year under paying customers a report on a sophisticated espionage campaign that had discovered it.

The report, however, was only five months later publicly disclosed once had a British defense company about the espionage campaign published . According to the British BAE Systems were likely to be a campaign of the Russian government, which mainly computers in the Ukraine were infected. Eugene Kaspersky, however, denied that political motives played a role. "We were late," as he announced. According to the virus fighter is not possible to win everything.

Discussion

In 2013, Kaspersky Lab researchers discovered another espionage campaign called Red October , by Russian-speaking programmers would be created and focused on governmental and diplomatic organizations in Europe, Central Asia and North America. Only after a heated internal debate virus fighter still decided to publish a report on the operation. According to several current and former employees of Kaspersky Lab, who wished to remain anonymous, it was probably an operation of a Russian military intelligence.

Update

Kaspersky Lab said in a statement that the company has never doubted about publishing studies because of political reasons. "We have no political ties," said the virus fighter, who noted further with various countries and international investigative agencies to work together. In case an attack campaign is discovered the anti-virus company follows a special procedure whereby the investigative services are warned in the countries concerned, as well as partners and customers before the investigation appears.