“Apple Inc customers were targeted by hackers over the weekend in the first campaign against Macintosh computers using a pernicious type of software known as ransomware, researchers with Palo Alto Networks Inc told Reuters on Sunday,” Jim Finkle reports for Reuters. “Ransomware, one of the fastest-growing types of cyber threats, encrypts data on infected machines, then typically asks users to pay ransoms in hard-to-trace digital currencies to get an electronic key so they can retrieve their data. Security experts estimate that ransoms total hundreds of millions of dollars a year from such cyber criminals, who typically target users of Microsoft Corp’s Windows operating system.”
“Palo Alto Threat Intelligence Director Ryan Olson said the ‘KeRanger’ malware, which appeared on Friday, was the first functioning ransomware attacking Apple’s Mac computers,” Finkle reports. “An Apple representative said the company had taken steps over the weekend to prevent attacks by revoking a digital certificate from a legitimate Apple developer that enabled the rogue software to install on Macs.”
“The Transmission site offers the open source software that was infected with the ransomware,” Finkle reports. “Transmission is one of the most popular Mac applications used to download software, videos, music and other data through the BitTorrent peer-to-peer information sharing network… The project’s website on Sunday carried a warning saying that version 2.90 of its Mac software had been infected with malware. It advised users to immediately upgrade to version 2.91 of the software, which was available on its website, or delete the malicious one. It also provided technical information on how users could check to see if they were affected.”
Read more in the full article here.
MacDailyNews Note: Transmission’s website (https://www.transmissionbt.com) states:
Everyone running 2.90 on OS X should immediately upgrade to and run 2.92, as they may have downloaded a malware-infected file. This new version will make sure that the “OSX.KeRanger.A” ransomware (more information available here) is correctly removed from your computer.
Users of 2.91 should also immediately upgrade to and run 2.92. Even though 2.91 was never infected, it did not automatically remove the malware-infected file.
[Thanks to MacDailyNews Readers “George” and “Road Warrior” for the heads up.]
How did Transmission get their signature key into the wrong hands?
And to think we could keep keys and secrets,… secret.
Backdoors = bio-weapons
The FBI asked to borrow it and said they’d be extra careful.
I like giving my three year old my fine china, to carry to the table, that is, being extra careful. I am not being disrespectful, however in digital warfare, anything is possible, the likes of power grids going down, the OPM breach. I am simply skeptical, regrading the safety of our software.
We must be vigilant. Thanks to Apple for being so quick in revoking Transmissions key.
I wonder how many users had their data held for ransom.
I’ve read (on heise.de, German) that the encryption starts only after 3 days. According to that, since this time hasn’t passed yet after the 8 hours window when the infected version was online, noone should be affected yet. And since the certificate has been withdrawn, noone should be in future. At least there’s hope.
About 6500 according to Palo Alto Networks.
http://buzznews.online/transmission-malware-transmitted-through-server-hack-downloaded-6500-times-mac-rumors/
I have a few questions:
1. What data got encrypted by this ransomware?
2. Did it require a user to enter their password for it to begin the encryption?
3. Couldn’t a user just use Time Machine to get back most, if not all, of their data before it got encrypted?
Local HD and time machine are being encrypted
http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
Thanks for the link.
That article mentions a “Transmission installer”. Since when did Transmission require an installer?
Good morning
every installer requires either a password or login as administrator
Do not login as administrator when you are using your computer so that you are constantly reminded to use a password so you know when software is installed at root level
Good day
E
My point was that the Transmission app has never needed an installer. When users saw that, it should have been the first sign that something was wrong and raised red flags.
If dragging the app from the dmg to the application folder doesn’t count as install, then
when the app opened for the first time, it writes some local data such as user preferences, path and directories, etc.
That counts as installer.
No it doesn’t!!!
That’s dragging an app to the Applications folder. It’s not installing anything.
Agreed. People don’t understand that there are three methods to getting an app on a Mac.
1) Download an app in a dmg or zip file (or raw). Then drag it to the Applications folder. This is not an install by any stretch. Unless, when you run it, it asks for your admin password to do “something else,” no installer process was run.
2) Download from the App store. This, too, is not an install. It literally downloads to the Applications folder.
3) Run an installer, such as for Office, Adobe, VirtualBox, just to name a few. The installer explicitly requires administrative rights to do anything and, thus, asks for a password. THIS is an install. It has admin privileges to hose the system.
Everyone keeps saying “installer,” but this does not use an installer, from what I can tell. It’s also why version 2.92 can remove the malware, ALSO without admin rights.
Awww, did I hurt a Windows’ user’s feelings? Only Windows users and Windows experts believe Mac apps are regularly installed. You show your Mac ignorance. You’re the same fools who think Mac has a registry and tell people to look at their C drives. You have zero clue what you’re talking about.
And installer that you need to download and run?
None, if you got Transmission from the Mac App store.
If you got Transmission from the developer’s website, on the other hand… And that’s the one that was infected.
They can use Time Machine to restore, provided that the Time Machine backup drive wasn’t connected when the malware did the encryption. When I do my Time Machine backups, I do them to an external drive I eject after the backup.
——RM
The malware was probably created by musicians trying to get some payment for their music that’s being stolen by torrent sites and software. 😉
the bit torrent made them pay for there nasty habit ..seems sort of like Karma
When people use Transmission, they are generally using it for torrents and guess what? Torrent sites are largely for stealing other people’s intellectual property. Just look at the proportion of illegal downloads to those that are perfectly legit.
Thieves get what’s coming to them.
*This* is why I back up critical files manually to a separate HD that I keep powered down when not in use so it cannot be accessed by nefarious means. I place a reminder in iCal to do it once a month. It has saved my bacon once before when my Time Capsule died and took my TIme Machine back-ups with it.
The horror of unprotected ransomware attacks aside, I couldn’t help thinking of the attackers’ business model today. It’s a UI disaster!
Most users struck by ransomware will never pay the ransom because a) it’s a difficult process for ordinary users, b) the ransom is too expensive for c) a reasonable expectation that the decryption promise will be honoured.
Therefore, wouldn’t a ransomware vendor make much more money by demanding smaller amounts, say $20, which a user may be willing to waste in case it works? And wouldn’t it be in their interest to craft a nice GUI that walks the user through the process of setting up their currency in Bitcoin and dispatching it?
You might be getting shafted, but at least the ransomware is easy to use and Just Works.
I refuse bit coin and torrent so I am totally free of this “” bug
This is the second reason why I don’t use BitTorrent, the first reason being that it’s generally used for illegal file sharing.
This is a shame. It should have been avoided. Apple’s “fix” is just a bandaid on a bigger issue with Gatekeeper. Apple still hasn’t fixed Gatekeeper. I’m sure that the users with encrypted files are glad it’s nothing to worry about either:
Looks as if Apple may have to move its operations to Russia.