DevilRobber Mac OS X Trojan horse spies on you, uses GPU for Bitcoin mining

[illumination]

Spread via torrents, new Mac malware doesn't just try to rob you of your information - it's also keen to steal your computing time.
Read More

 

[WinAndLinuxTutorials]

Now the antivirus vendors who offer a version for Mac should also start to focus on that OS to keep its customers protected

 

[Valentin N]

Now the antivirus vendors who offer a version for Mac should also start to focus on that OS to keep its customers protected

It's also important that mac tell their users.

 

[AyeAyeCaptain]

Now the antivirus vendors who offer a version for Mac should also start to focus on that OS to keep its customers protected

It's also important that mac tell their users.

That they're been exploited in more ways than one?? LOL £££

 

[moonshine]

This is just the proof that Mac OS X isn't invulnerable to malware. I'm speculating that more malware for the Mac OS X will come this year.

 

[AyeAyeCaptain]

If it does then it can only benefit the providers of security software, as more and more people will want to pay to be protected.

 

[jamescv7]

Seems a scary trojan for that, let's expect that in the future chart on how many viruses spread in Mac OS X will tied up to Windows.

 

[Jack]

DevilRobber.A : Mac OS X with backdoor and trojan-like capabilities

F-Secure Labs has recently analyzed DevilRobber.A, a Mac OS X malware that has both backdoor and trojan-like capabilities. All the samples we've collected so far were from torrents uploaded by a single user account on The Pirate Bay website:

The files shared were legitimate Mac applications, but modified to include the malware's components. The samples we got had some variations in the components, which means that some samples (variants) had additional functionalities.

It seems that the malware author had varying purposes for each of his creations. One variant steals the Keychain of the infected machine and logs the number of files on the system with names matching the string "pthc" — which Graham Cluley speculates may be referring to "pre-teen hardcore pornography". It appears as though the malware author is trying to find illegal child abuse materials, by spotting which infected machine has the most pornography and using its credentials to gain access to the materials.

Other variants install applications related to Bitcoin mining. These applications use both the CPU and GPU computational power of the infected machines, which improves the mining operations at the computer owner's expense. Now that is greedy!

Below is a summary of the differences between the variants we've found as of this writing:

In addition, all the variants we've seen log the number of files that match a certain set of criteria, and also steal the Terminal command history and Bitcoin wallet. All variants also perform the following:

• Opens a port where it listens for commands from a remote user.
• Installs a web proxy which can be used by remote users as a staging point for other attacks.
• Steals information from the infected machine and uploads the details to an FTP server for later retrieval.

Even here, there are differences between the variants. The specific port used by the web proxy depends on the variant (see Port Mapping column in the table above). The specific FTP server for data stealing also varies between samples. And DevilRobber's data stealing routine is repeated on a fixed interval — every 43200, 60000, or 100000 seconds, depending on the sample.

via F-Secure

 

[moonshine]

That was a whole lot of information Jack. (Too lazy to go out and look for useful info )

 

[win7holic]

Yes.
as I said earlier.
MAC OSX was no longer like last year or even two years ago. highly secure against malware.
but now, one by one the authors of malware to attack MAC OSX with many infections.

I miss MAC OSX with very secure against malwares. :s

 

[moonshine]

I bet you're not using a Mac before to miss the OS's Security very much.

 

[win7holic]

honestly, I use MAC only shortly (1-2 months) Q1-2010
and then I sold it, in because complicated to play games: (
need bootcamp

 

[moonshine]

You should've got Boot Camp then.

 

[jamescv7]

Well as year by year, we can expect more viruses will spread so those writers are give a twist from another OS to make fully work.

Good thing AV that works in Mac were already exist before the spread of viruses dramatically.

 

[Jack]

This is a very nasty piece of malware as it harvest data from the infected machines and by far the most advanced piece of malware I've seen for a MAC OS X.
The removal process for this infection is not very complicated but I'm sure this guys will create in the future much tougher pieces of malware

Disinfection

Manual Removal Instruction:

Delete the folder and all its contents "~/Library/mdsa1331"
Delete the file "~/Library/LaunchAgents/com.apple.legion.plist"

More details

It's important to be noted that for this attack to be successful there is a need for user interaction, as social engineering is used in order to infect the machine.
Wonder how long it will take before cyber criminals will start to work with the MAC OS X vulnerabilities..