Crypto-ransomware is now the biggest threat to enterprises. According to a recent Trend Micro report, this type of malware accounted for 83 percent of all data extortion attacks in Q4 2015, surpassing typical ransomware and botnets alike. It’s no surprise that cybercriminals are looking for ways to increase their impact — and succeeding.
PCWorld reported that a new strain of ransomware, called KeRanger, is the first of its kind targeting Mac OS X. But there’s more to this story than meets the eye.
Getting Past the Gate
As noted by SecurityWeek, the new malware got its start when cybercriminals hijacked the official installer for BitTorrent client Transmission. Instead of a clean version 2.90, more than 6,500 users got one infected with KeRanger. Once installed, the malware waits three days, contacts a command-and-control server over the Tor network, encrypts all files and backups and demands 1 bitcoin ($400) for a fix.
What’s interesting here is that ransomware like KeRagner should be blocked by Gatekeeper on Mac OS X, but cybercriminals were able to bypass Apple’s defenses by using a valid digital certificate originally issued to a Turkish company. While the cert has since been canceled, the damage is done: OS X has its first reported case of crypto-ransomware infection.
More to Know
But things aren’t quite as simple as they seem. When researchers from Bitdefender analyzed the KeyRanger code, they recognized it as almost identical to version 4 of Linux.Encoder, designed to encrypt files on Linux OS systems.
Bitdefender’s Chief Security Strategist Catalin Cosoi told SecurityWeek, “The encryption functions [in Linux.Encoder and KeRanger] are identical and have same [sic] names: encrypt_file, recursive_task, currentTimestamp and createDaemon, to only mention a few. The encryption routine is identical to the one employed in Linux.Encoder.”
This is standard practice in the hacking community; why build new code when it’s possible to leverage something already on the market?
What’s interesting here is the use of Linux.Encoder data since all four versions of the ransomware — based on the educational project Hidden Tear — have been cracked by researchers with the help of an intentionally included backdoor. While existing tools won’t work to decode the files, the method is the same. That means there is little threat from KeRanger over the long term; it’s off the BitTorrent website, its certificate has been revoked and its source code is fundamentally flawed.
KeRanger Represents Malware Progress
Still, it’s a big step forward for cybercriminals. Why? Because Mac OS X has a reputation for being less vulnerable to malware threats since Gatekeeper does a better-than-average job of keeping infected code at bay. The KeRanger effort was likely a test doomed to fail — a way for attackers to see if they could adapt Linux code, get it past GateKeeper and make OS X users pay up.
Bottom line? Ransomware has made the jump to Mac, and KeRanger was just a nibble at Apple’s OS. Bigger bites are next in line.