New malware variant targets Uyghur Mac users

Yet another malware variant is being sent to Uyghur activists via e-mail spam; however, for updated systems the threat is nonexistent.

One of the ongoing malware sagas is a political fight that is targeting Uyghur activist groups in China, where spam e-mail laced with backdoor Trojan horse malware has been continuously delivered to members of these groups in an Advanced Persistent Threat attack.

This week, security company F-secure uncovered yet another variant of this attack being used.

Like prior ones, the new variant takes advantage of old vulnerabilities in Microsoft Word, by sending attachments that will embed the malware in the affected system if the document is opened in an unpatched version of Word.

The malware used has changed a little over the past year, with some versions using Trojans embedded in ZIP files, and others exploiting Word vulnerabilities. F-secure's report shows this latest attempt uses a Word document called "poadasjkdasuodrr.doc," though any document name can likely be used. When opened, the malware contained in it will install two files that attempt to pose as update components to RealPlayer, in the following locations:

~/Library/Application\ Support/.realPlayerUpdate
~/Library/LaunchAgents/realPlayerUpdate.plist

Since these folders are within the user account, the malware used in this attack variant can install itself without user passwords being required. However, another mode of attack does ask for authentication; if it gets it, the malware will then be placed in the global Library folder instead, so it will run for every user on the system.

Using the "launchagent" file, the system will keep the hidden malware in the Application Support folder running, and will attempt connections to a command-and-control server at the URL alma.apple.cloudns.org.

There are easy ways to help detect and delete such malware (though again, these particular attacks target certain groups and the threat to most Mac users is minimal). First, with general safe computing practices you can avoid obvious spam messages, and be sure to only open attachments that are from trusted sources. Additionally, these attacks often exploit known vulnerabilities that have been patched, so always keep your operating system and installed applications up-to-date.

In addition, these attacks use very common and easy-to-detect modes of keeping the malware active on an OS X system, by way of the system launcher folders, which include the various LaunchAgent and LaunchDaemon directories in the system, global, and user libraries. By setting up a monitoring routine that will alert you when a new item is added to these folders, you can keep on top of what programs are attempting to automate or schedule background routines.

Additionally, you can take the extra step and install a reverse firewall such as those offered by Objective Development's Little Snitch and Intego's VirusBarrier suite , to keep tabs on any program that is trying to phone home to remote servers, and block or otherwise manage the attempt.



Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.

About the author

    Topher, an avid Mac user for the past 15 years, has been a contributing author to MacFixIt since the spring of 2008. One of his passions is troubleshooting Mac problems and making the best use of Macs and Apple hardware at home and in the workplace.

     

    Join the discussion

    Conversation powered by Livefyre

    Don't Miss
    Hot Products
    Trending on CNET

    HOT ON CNET

    How well do you know your surge protector?

    Whether you're looking to add more outlets, or want to add a layer of protection between your gear and the outside world, here's what you need to know.