Before the August 28 official release of Apple’s OS X Snow Leopard, cybercriminals are already hitchhiking on this to proliferate their malicious activities. Earlier today, Advanced Threat Researcher Feike Hacquebord discovered several fake sites that supposedly give Mac users free copies of the newest version of the Mac OS, Snow Leopard. However, accessing these malicious sites land users to a DNS changer Trojan detected by Trend Micro as OSX_JAHLAV.K.
Once executed, OSX_JAHLAV.K decrypts codes, which include a script that downloads other malicious scripts. The said script then alters the DNS configuration and includes two additional IP addresses in its DNS server. Users are thus possibly redirected to phishing sites and other fraudulent sites. In fact, some of these bogus sites are reportedly hosting FAKEAV (rogue antivirus) variants and components.
As of this writing, all malicious URLs are already blocked by Trend Micro. Users are strongly advised to get only the latest Snow Leopard update directly from the Apple site, as well as consider using Trend Micro Smart Surfing for Macs.
We at Trend Micro Research recently produced a short blog series on the Pushdo botnet, a botnet which excelled at staying under the radar for a considerable amount of time. Pushdo is not alone in this regard however: enter Ilomo.
Ilomo has also being active for several years now, and like Pushdo has done so without attracting too much unwanted attention from the security industry. Like Pushdo, the Ilomo threat is quite modular in nature which makes it difficult to see the actions of the overall threat. Added to this is the fact that it uses a commercial virtual machine obfuscator, significantly adding to the effort involved in reverse engineering the malware binaries.
Ilomo has two key components to its business plan. The first is good old fashioned information stealing. Ilomo injects its code into the browser and monitors the internet connection waiting for the user to connect to one of over 4,000 banking, financial or webmail sites. Not content with simply stealing the user’s credentials, Ilomo can also “piggyback” on the user’s session, transferring funds from an infected user’s account and making a mockery of the bank’s secure login system. Ilomo will also harvest all other login credentials from the machine like those for ftp, web servers, local administrators etc. These are then used to spread itself across the network and to take control of web servers online, which it will use to host new versions of the malware.
Ilomo ‘s second source of revenue is selling “anonymity as a service.” Every infected Ilomo machine acts as a proxy so that criminals can route their illegal activities through different networks and countries. In addition to hiding the criminals’ identity this proxy network is very useful for defeating another defense built into many banking sites—namely that they can only be accessed from certain countries. If a criminal needs to access a Brazilian bank, they simply use an infected Ilomo machine in Brazil to route the connection.
We have only touched on some of the high level details of Ilomo in this article, If you want to look at Ilomo in even more detail (and find out about the technical aspects we did not have time to discuss), check out our white paper:
While still low-intensity compared to the PC platform, malware attacks against Macs are definitely becoming more prevalent. Trend Micro researcher Ivan Macalintal has found another new variant of the JAHLAV family hosted on known malicious domains. The new variant is detected as OSX_JAHLAV.I and, like other JAHLAV variants, poses as pirated versions of legitimate applications and modifies the system’s DNS settings, allowing malicious users to be victimized by phishing attacks, or surreptitiously redirecting them to sites which might harbor malicious exploits .
Unlike the earlier variants which only posed as versions of QuickTime, this one also poses as pirated versions of Foxit Reader and several antivirus applications. In addition, like the June variant of JAHLAV—OSX_JAHLAV.B—at least one website hosting OSX_JAHLAV.I could also deliver malware onto Windows systems, although the said file is no longer available from the said website.
Both Mac and Windows users are protected by the Smart Protection Network against this threat, as the websites involved are already blocked and the malicious files are detected as noted above.
