Researcher releases Free Ransomware Detection Tool for Mac OS X Users

 IN BRIEF:

Introducing RansomWhere, a free generic ransomware detection tool for Mac OS X users that can identify ransomware-like behavior by continually monitoring the file-system for the creation of encrypted files by suspicious processes.

This ransomware detection tool helps to block the suspicious processes and waits for the user to decide whether to allow or stop the process.

Ransomware has risen dramatically since last few years... so rapidly that it might have already hit someone you know.

With hundred of thousands of ransomware samples emerging every day, it is quite difficult for traditional signature-based antivirus products to keep their signature database up-to-date.

So, if signature-based techniques are not enough to detect ransomware infection, then what else can we do?

Some Antivirus companies have already upgraded their security solutions that detect suspicious behaviors like the sequential accessing of a large number of files, using encryption algorithms and key exchange mechanisms.

Here’s the latest ransomware detection tool for Mac OS X users:

RansomWhere? – a smart application that can identify ransomware-like behavior by detecting untrusted processes rapidly encrypting files, stop that suspicious process, and then alert the user.

How RansomWhere tool works

Patrick Wardle, a former NSA staffer who now leads research at bug hunting outfit Synack, has developed the RansomWhere tool, which aims at detecting and blocking generic ransomware on Mac OS X by regularly monitoring the user's local filesystem for the creation of encrypted files by any process.

"The ransomware will likely encrypt a few files (ideally only two or three), before being detected and blocked," Wardle wrote in a blog post.

This ransomware detection tool, by default, scans Mac apps and binaries that are signed with an Apple Developer ID and not by official Apple certificates.

If the tool detects any untrusted process, it suspends the suspicious process and alerts the user by showing a pop-up asking user to continue or terminate the process in question.

Wardle successfully tested RansomWhere against KeRanger as well as Gopher ransomware proof-of-concept, which was developed by a pro-Apple Mac hacker, Pedro Vilaca, last year.



Though Wardle admitted that his tool does not guarantee 100 percent result and that it could be circumvented by malicious hackers who can discover a way to bypass RansomWhere and avoid detection, it is always better to be somewhat safer than completely vulnerable.

Some known Limitations of RansomWhere tool:

• RansomWhere would not be able to help if any Ransomware malware abuses Apple-signed file or app.
• RansomWhere detects ransomware infections after they have already encrypted some of your important files.
• Files outside of your home directory are not protected by RansomWhere. So sophisticated ransomware could shift all your files outside home directory and lock them up.

Since hackers are always a step ahead of researchers, the RansomWhere tool has already been bypassed. Vilaca had tweaked his Gopher ransomware to bypass RansomWhere in a matter of minutes.

As mentioned in the limitations, Vilaca added just ten lines of code in its ransomware proof-of-concept to take the victim's files outside of the home directory and lock them up. You can watch the video above showing his hack.

Read more

Ransom32 — First JavaScript-powered Ransomware affecting Windows, Mac and Linux

Here's New Year's first Ransomware: Ransom32.

A new Ransomware-as-a-service, dubbed Ransom32, has been spotted that for the first time uses a ransomware written in JavaScript to infect Mac, Windows as well as Linux machines.

Ransom32 allows its operators to deploy the malware very quickly and easily. It has a dashboard that enables operators to designate their Bitcoin addresses to which the ransom can be sent. The dashboard also shows stats about how much Bitcoins they have made.

In short, this new ransomware-as-a-service is so simple, and efficient at the same time, that anyone can download and distribute his/her own copy of the ransomware executable as long as he/she have a Bitcoin address.

The copy of Ransom32 was first analysed by Emsisoft, which found that the new ransomware family, which embedded in a self-extracting WinRAR archive, is using the NW.js platform for infiltrating the victims' computers, and then holding their files by encrypting them with 128-bit AES encryption.

But, Why the NW.js Framework?

NW.js, formerly known as Node-WebKit, is a JavaScript framework for app development based on Node.js and Chromium. It works around normally-strict sandboxing of JavaScript, so a Web app can be repurposed for desktops without the sandbox getting in its way.

"NW.js allows for much more control and interaction with the underlying operating system (OS), enabling JavaScript to do almost everything 'normal' programming languages like C++ or Delphi can do," Emsisoft's Fabian Wosar writes.

The NW.js framework not only allows for cross-platform infections but also is harder to detect because it is a legitimate framework. Ransom32 has some resemblance to CryptoLocker that is one of the nasty ransomware that already infected millions of PCs.

Ransom32 has been traded on the dark web with the authors asking for a 25 percent cut of all ransom payments for offering its service and forwarding the rest of the amount to the operator’s Bitcoin address.

How Does Ransom32 Work?

Malware operators place the malicious file inside emails masquerading as delivery notifications, unpaid invoices, and such.

As soon as it was installed and launched, Ransom32 connected to a command-and-control (C&C) server on TOR anonymising network, displaying ransom note as shown above and the Bitcoin address where victims are supposed to pay to recover their files.

Currently, Wosar has only seen Ransom32 as a Windows attack vector, but the NW.js framework can run on all three major operating systems.

Therefore, ransomware coded to work on top of NW.js would theoretically be able to target Mac OS X as well as Linux operating systems.

How to Protect Yourself from Ransomware Threat?

Here are some important steps that should be considered to protect yourself from Ransomware threats.

• Always keep regular backups of your important data.
• Make sure you run an active anti-virus security suite of tools on your system.
• Do not open email attachments from unknown sources.
• Most importantly, always browse the Internet safely.

Read more

13 Million MacKeeper Users Hacked — 21 GB of Data Exposed

MacKeeper anti-virus company is making headlines today for its lax security that exposed the database of 13 Million Mac users' records including names, email addresses, usernames, password hashes, IP addresses, phone numbers, and system information.

MacKeeper is a suite of software that claims to make Apple Macs more secure and stable, but today the anti-virus itself need some extra protection after a data breach exposed the personal and sensitive information for Millions of its customers.

The data breach was discovered by Chris Vickery, a white hat hacker who was able to download 13 Million customer records by simply entering a selection of IP addresses, with no username or password required to access the data.

21 GB Trove of MacKeeper Customer Data Leaked

31-year-old Vickery said he uncovered the 21 GB trove of MacKeeper customer data in a moment of boredom while searching for openly accessible databases on Shodan – a specialized search engine that looks for virtually anything connected to the Internet – that require no authentication.

"The search engine at Shodan.io had indexed their IPs as running publicly accessible MongoDB instances (as some have already guessed)," Vickery said in a Reddit post. "I had never even heard of MacKeeper or Kromtech until last night. I just happened upon it after being bored and doing a random "port:27017" search on Shodan."

As a result, four IP addresses took him straight to a MongoDB database, containing a range of personal information, including:

• Customer Names
• Email addresses
• Usernames
• Password hashes
• Mobile phone numbers
• IP addresses
• System information
• Software licenses and activation codes

Security Product Using Weak Algorithm to Hash Passwords

Although the passwords were encrypted, Vickery believes that MacKeeper was using weak MD5 hashes to protect its customer passwords, allowing anyone to crack the passwords in seconds using MD5 cracking tools.

The company responded to the issue after Vickery posted it on Reddit, saying that the company had no evidence the data was accessed by malicious parties.

"Analysis of our data storage system shows only one individual gained access performed by the security researcher himself," Kromtech, the maker of MacKeeper, said in a statement. "We have been in communication with Chris, and he has not shared or used the data inappropriately."

Though the company claims Vickery was the only person to access the MacKeeper users’'information; you should still change your MacKeeper passwords and passwords on websites that use the same password.

Read more