Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Janicab.A Malware Targets Computers Running OS X and Windows

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,490
30,731



Researchers from F-Secure, Webroot, and Avast have uncovered Janicab.A, a new trojan that was discovered as a threat to Macs last week and Windows users on Monday, with findings being published recently.

For OS X users, Janicab.A was signed with a valid Apple Developer ID and also uses a special unicode character known as a "right-to-left override" (RLO) that is used in email malware attacks. From there, the trojan uses a YouTube page to hijack infected computers, directs them to command-and-control (C&C) servers, and then leaves the server and hides the infection by making the malware appear as a harmless PDF or DOC file.

janicab_2a.png
Webroot writes:
After a relatively long lag period without seeing any particular new and exciting Mac malware, last week we saw the surfacing of a new and interesting method of compromising the OSX system. Malware authors have taken a new approach by altering file extensions of malicious .app packages in order to trick users into thinking they are opening relatively harmless .pdf or .doc files. Changing file extensions in Mac OSX can be tricky due to a built in security feature of the OS that detects attempts to change the extension and automatically annexes the extension of its correct file or package type.
Click to expand...
This news comes after Apple updated security definitions to combat 'Yontoo', an adware trojan this past March, while also regularly dealing with Java-related vulnerabilities. Apple introduced Gatekeeper in OS X Mountain Lion in order to better deal with security threats, offering a way for users to restrict installation of apps to those signed by Apple-issued Developer IDs.

Article Link: Janicab.A Malware Targets Computers Running OS X and Windows
 
Article Link
https://www.macrumors.com/2013/07/24/janicab-a-malware-targets-computers-running-os-x-and-windows/
B

blackcrayon

macrumors 68020
Mar 10, 2003
2,255
1,824
If it's signed with a valid developer ID shouldn't that mean Apple should've already revoked it? Which brings up a question, if Apple revokes a developer ID because of malware, does OS X notify you that was the reason? Or do they just say it's "invalid" (in which case lots of people will still right click and open it :)

(I'm guessing the File Quarantine feature should have this added as well by now)
 
H

hkenneth

macrumors regular
Jul 25, 2011
245
23
Mimic normal files using fake icons? It looks like the malware I coded in VB back to my middle school...
 
J

jeznav

macrumors 6502
Aug 10, 2007
459
14
Eh?
Not all OSX users have Adobe Acrobat Reader installed. Icon FAIL.

Should've used Preview.app PDF icon instead.
 
redsoxunixgeek

redsoxunixgeek

macrumors regular
Dec 1, 2006
115
21
Salt Lake City YOOTah
blackcrayon said:
If it's signed with a valid developer ID shouldn't that mean Apple should've already revoked it? Which brings up a question, if Apple revokes a developer ID because of malware, does OS X notify you that was the reason? Or do they just say it's "invalid" (in which case lots of people will still right click and open it :)

(I'm guessing the File Quarantine feature should have this added as well by now)
Click to expand...

Apple's dev team is busy re-building a broken dev portal. We might have to wait until after they get us back on line to revoke certs.
 
charlituna

charlituna

macrumors G3
Jun 11, 2008
9,636
816
Los Angeles, CA
Bhatu said:
:OMG: somebody call that Researcher cum Hacker!
Click to expand...

Tin foils would say that he created it and then dropped his attack on the developer site hoping it would delay them revoking the certificate on his malware.

Just to see what would happen of course. He isn't trying to hurt anyone.

Tin foils also think he is the phisher.
 
Parasprite

Parasprite

macrumors 68000
Mar 5, 2013
1,698
144
MacRumors said:
Malware authors have taken a new approach by altering file extensions of malicious .app packages in order to trick users into thinking they are opening relatively harmless .pdf or .doc files.
Click to expand...

New because of the .app part maybe, but .pdf.exe is not a new approach by any means.

Also, who here uses Adobe for PDFs? (beyond filling out that one form that didn't work right in Preview for some reason)
 
moxin

moxin

macrumors regular
Feb 25, 2011
234
70
jeznav said:
Not all OSX users have Adobe Acrobat Reader installed. Icon FAIL.

Should've used Preview.app PDF icon instead.
Click to expand...

Reminds me of that 'New Folder' virus that used to infect XP back in the days. It used XP styled folder icon. So when you are using icon packages the threat was half gone.
 
antonis

antonis

macrumors 68020
Jun 10, 2011
2,085
1,009
Still, don't get surprised if people that don't even have the adobe reader installed on their mac will still open a "pdf" that is using the acrobat icon. There are users and users.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom