New Tool Aims to Generically Detect Mac OS X Ransomware

[Morvotron]

Content source

http://www.securityweek.com/new-tool-aims-generically-detect-os-x-ransomware

Security researcher Patrick Wardle has been looking at ways to generically detect ransomware attacks on Mac OS X systems and he has developed a tool that appears to be capable of accomplishing the task.


Wardle, director of research at Synack, is well-known in the industry for bypassing Apple’s Gatekeeper security feature. The expert has developed several OS X security tools in the past and on Wednesday he announced the release of a new one.

The tool, named “RansomWhere?”, is designed to detect and block any type of file-encrypting ransomware on OS X by continually monitoring the file system for the creation of encrypted files by suspicious processes.

There have been several reports over the past years about ransomware targeting Mac OS X users. Early threats were designed to simply lock users’ browsers and could be easily removed, but newer ransomware, such as KeRanger, pose a more serious threat.

KeRanger, which is considered the first fully functional ransomware targeting OS X, attempts to encrypt 300 different file types on infected systems. The malware bypassed Gatekeeper because it was delivered via a compromised installer that was signed with a valid app development certificate issued by Apple.

After analyzing various pieces of ransomware, Wardle came up with the idea that such threats can be generically identified by monitoring file I/O events and detecting the rapid creation of encrypted files by untrusted processes. For this, he needed to find ways to monitor file I/O events, determine if a file is encrypted, and identify untrusted processes.

There are several tools and methods that can be used to monitor file I/O events on OS X, including dtrace, fs_usage, OpenBSM, and fsevents. The expert chose the direct use of fsevents, which he also leveraged in another one of his tools called BlockBlock.

In order to determine if a file is encrypted, Wardle used available documentation on differentiating encryption from compression based on mathematical calculations.

The researcher told SecurityWeek that the same principle could also work on Windows and Linux operating systems. When he came up with the idea for RansomWhere?, Wardle found discussions about CryptoMonitor, an apparently similar Windows anti-ransomware tool that Malwarebytes has started integrating in its products.



Seems to be, Ransomware fights back are finally being released. On the other hand, this type of malware ended up to be a very efficient way for crackers to gain their cash, so we must expect a long coding war. On one side, crackers. On the other side, researchers & analysts. In the middle, users.



Original article: New Tool Aims to Generically Detect Mac OS X Ransomware | SecurityWeek.Com​

 

[Exterminator]

Despite not being a big problem for Mac users yet, Patrick Wardle, lead researcher at Synack, has created a nifty little app that can identify ransomware-like behavior by detecting the quick creation of encrypted files, stop the suspicious process, and then alert the user.

Called RansomWhere, this tool is very similar to what Sean Williams created almost a month ago with his CryptoStalker project, a generic ransomware detection system for Linux.

RansomWhere can stop apps that generate a lot of encrypted content
Just like CryptoWalker, RansomWhere works by watching the user's local filesystem for the creation of a large number of encrypted files. Mr. Wardle's app goes a step further by temporarily suspending the process that generates the massive amount of encrypted content, and prompting the user to verify and approve its actions.

RansomWhere may cause some false positives, but it's always better to be safe than sorry.

By default, RansomWhere scans unsigned Mac apps and binaries signed with an Apple developer ID. The only binaries RansomWhere ignores are those signed by official Apple certificates.

The downside is that if ransomware injects and hijacks the process of an Apple-signed binary, the tool won't be able to pick it up. Another downside is that RansomWhere takes a bit to detect ransomware infections, by which time some files might be already encrypted.

Ransomware for Macs not yet a (big) problem
At the start of March, KeRanger, the first fully functional Mac-targeting ransomware appeared on the scene after it infected users via tainted versions of the Transmission BitTorrent client for Mac.

Before this, a Brazilian coder also created a proof-of-concept ransomware variant called Mabouia, which was never released and eventually handed over to Apple's security staff.

Ransomware is not yet a danger to the Mac ecosystem, and more Linux users suffered from ransomware compared to Mac users. This statistics leans towards Linux users because of many ransomware variants that target Linux servers, such as Linux.Encoder, CTB-Locker, and KimcilWare.

For users who like their privacy, just be aware that RansomWhere will ask for your Mac password in order to continually monitor your workstation's processes.