Beware: Tor backdoor targeting Macs

New Tor-powered backdoor malware targets Macs | PCWorld

Security researchers have found a new backdoor program that allows attackers to hijack Mac systems and control them over the Tor network.

The new malware has been dubbed Backdoor.MAC.Eleanor by researchers from antivirus vendor Bitdefender and is distributed as a file converter application through reputable websites that offer Mac software.

The rogue application is called EasyDoc Converter. Once installed it displays a fake interface where users can supposedly drag and drop files for conversion, but which in reality doesn’t do anything.

In the background, the application executes a shell script that installs multiple malicious components in a folder called “/Users/$USER/Library/.dropbox.” The Dropbox name is used to make the malware harder to spot and has nothing to do with the legitimate Dropbox file synchronization software.

The Eleanor malware has three components: a Web service with a PHP application, a Tor hidden service that allows attackers to connect to the affected systems over the Tor anonymity network and an agent that posts the Tor access URLs for infected systems to the Pastebin website.

The PHP application served by the Web service is actually a backdoor that allows attackers to view, edit, rename, delete, upload, download and archive files on the system; to execute shell commands and scripts written in PHP, Perl, Python, Ruby, Java and C; to open a reverse shell to the attackers’ server; to connect to MySQL, SQLite and other databases; to view the process list and to send emails with attachments. Another component of this application allows attackers to capture images and videos using the system’s webcam.

* * *

The good news is that the app is not digitally signed by an Apple-approved certificate, so users will see security warnings on the latest OS X version if they try to install it. On OS X El Capitan (10.11) users would actually need to perform a manual override in order to install the application.

(Full story: PCWorld)

via ehMac.ca http://ift.tt/29yzYSm