Surfeit and Blasé Security
Compromised BitTorrent installer used to spread ransomware that encrypts files on Mac OS X computers.
続きを読む
Compromised BitTorrent installer used to spread ransomware that encrypts files on Mac OS X computers.
続きを読む
Apps that use 3rd-party updater over insecure HTTP channels subject to MiTM attacks.
Enlarge (credit: vulnsec.com)
Camtasia, uTorrent, and a large number of other Mac apps are susceptible to man-in-the-middle attacks that install malicious code, thanks to a vulnerability in Sparkle, the third-party software framework the apps use to receive updates.
The vulnerability is the result of apps that use a vulnerable version of Sparkle along with an unencrypted HTTP channel to receive data from update servers. It involves the way Sparkle interacts with functions built into the WebKit rendering engine to allow JavaScript execution. As a result, attackers with the ability to manipulate the traffic passing between the end user and the server—say, an adversary on the same Wi-Fi network—can inject malicious code into the communication. A security engineer who goes by the name Radek said that the attack is viable on both the current El Capitan Mac platform and its predecessor Yosemite.
Here's a video showing a proof-of-concept attack performed against a vulnerable version of the Sequel Pro app:
Symantec analysis confirms that in the wrong hands, Mabouia ransomware could be used to attack Macs.
続きを読む
