Report: new Mac malware hides as fake software installer

  • updated 01:50 am EST, Wed December 12, 2012
  •         by MacNN Staff

Uses 'SMS activation' to hide subscription charge on cell bill

A Russian security firm with a mixed track record is warning about a new malware threat for the Mac, which masquerades as an installer for various types of software. Doctor Web, who claimed to have discovered the malware, says it is widely available on various sites -- though at present it is targeting Russian Mac users. The Trojan is apparently a Mac variation on a widespread Windows and Android trickware ruse that asks users for their cell number in order to send an activation code by SMS.

According to the report, the Trojan.SMSSend.3666 malware can be found in a repackaged installer from legitimate free software offerings, or can have non-functioning code as its payload. What the malware is after is the cell number, which must be entered to receive the "activation code," which is sent by SMS. When the software returns the activation code by SMS, the user is automatically signed up for an ongoing monthly subscription on their cell bill.

The example provided by Doctor Web is an installer for VKMusic 4 Mac, a legitimate app for listening to music from a Russian social network. It is spread so far primarily by a rogue "affiliate program" company called ZipMonster that assists malware writers in monetizing their software.

Most Mac users will be able to easily avoid falling for the trickware, should it spread to other regions. No legitimate installers for the Mac use the activation-by-SMS scheme in the installer, and most Mac users would know better than to give out their phone number to an untrusted software installer -- though apparently this practice is more common in the Android community, where apps can come from many sources other than just Google Play, and there is little screening of apps prior to being published. The installers also seem to refer to the Mac as the MAC, which is a common error made by Windows-centric programmers.

The scheme is unlikely to work with most Mac users regardless of OS version, but in particular is likely to fail under OS X Mountain Lion and Lion, which sets a default Gatekeeper that prevents unsigned code from being executed. Developers must be registered with Apple, which most professional developers are, in order for installers to run in the default security settings. The controls can be overridden or turned off, but programs are also screened by built-in anti-malware software that is quietly updated. It's not known if Apple has taken any steps to detect and automatically protect from Trojan installers like this one.

It can be reasonably expected that the malware makers will also try to perpetrate this scheme in the jailbroken iOS community, since jailbreakers are the only iOS users that can install software from non-Apple sources. Again, however, SMS-based activation is virtually unknown in the iOS world, so it's unlikely the rogue software will gain much of a foothold. In the meantime, however, any software that asks for a cell phone number on installation should be quit and deleted. The genuine VKMusic 4 Mac can be downloaded for free from the service's own website.


TAGS
6 Comments
  1. Avatar
    simdude Fresh-Faced Recruit Joined: Jun 01, 2004
    Dec 12, 2012 at 06:50 am

    Have there been any cases of a virus/malware etc. in software distributed from the Mac App store? If not, it seems Apple has this problem under control for now, not that it ever turning into a huge problem in OS X anyway. For that matter, have there been any cases of issues in iOS if the devices were not jailbroken?

  2. Avatar
    msuper69 Professional Poster Joined: Jan 16, 2000
    Dec 12, 2012 at 11:38 am

    Another social engineering attempt.
    They'll catch a few ignorants no doubt.

  3. Avatar
    Charles Martin Mac Elite Joined: Aug 04, 2001
    Dec 12, 2012 at 11:51 am

    Originally Posted by simdudeView Post

    Have there been any cases of a virus/malware etc. in software distributed from the Mac App store?



    No, but the Mac App Store is not the only point of software distribution.

    If not, it seems Apple has this problem under control for now, not that it ever turning into a huge problem in OS X anyway. For that matter, have there been any cases of issues in iOS if the devices were not jailbroken?

    Not that I know of -- but the point is that this malware can hide in ANY installer, since it is a repackaged version of the installer for a legitimate app. For now it seems like it's a Russian thing, but it could spread. IMO there's little chance of it getting anywhere here, but that's in part due to stories like this that give us a heads-up and allow us to be vigilant. And while I would think most of the people who read this site would never fall for such an obvious ploy, we're by and large not typical users.

  4. Avatar
    simdude Fresh-Faced Recruit Joined: Jun 01, 2004
    Dec 13, 2012 at 05:47 am

    Originally Posted by chas_mView Post


    No, but the Mac App Store is not the only point of software distribution.
    .



    That was sort of the point I'm making though. If you stick with a trusted distributor, there hasn't been a problem to date. I'm well aware of the arguments against the app store. "they restrict my device", "They take 30% of the price" yadda yadda yadda. They also provide a massive market to an app, handle secure credit card transactions and keep and maintain the servers to distribute the apps. If people still don't want to use the store, you download at your own risk.

    That being said, I probably have about 5 apps I have had to download directly because the developers are not on the app store. I have contacted the developers indicating I would much prefer an app store version. I have even repurchased a few apps I already owned to get the app store version. I like the one source for keep track of all my updates etc. There's a huge value in that. I spend my working day writing software for linux machines for internal engineering use so I don't have a problem with the technical issues of dealing with maintaining a system at home. I simply don't want to. I want my home computer to require as little work and maintenance as possible. I use to love playing with and hacking computers but nowadays, spending time with my wife and little daughter is much more fun. :)

  5. Avatar
    Spheric Harlot Clinically Insane Joined: Nov 07, 1999
    Dec 13, 2012 at 10:02 am

    Note that the 30% cut is a *terrific* deal for smaller development houses, in exchange for international distribution, dealing with any and all local sales taxes, accounting, distribution, legal requirements, etc. etc. etc.

  6. Avatar
    Spheric Harlot Clinically Insane Joined: Nov 07, 1999
    Dec 13, 2012 at 10:03 am

    Also, OS X's built-in malware recognition scanner has been updated to make this particular one obsolete.

Post a comment
Please note that it takes a couple of minutes for new comments to be visible in this area.
  

Now AAPL Stock: 112.71 ( -1.91 )

Cirrus creates Lightning-headphone dev kit

Apple supplier Cirrus Logic has introduced a MFi-compliant new development kit for companies interested in using Cirrus' chips to create Lightning-based headphones, which -- regardless of whether rumors about Apple dropping the analog headphone jack in its iPhone this fall -- can offer advantages to music-loving iOS device users. The kit mentions some of the advantages of an all-digital headset or headphone connector, including higher-bitrate support, a more customizable experience, and support for power and data transfer into headphone hardware. Several companies already make Lightning headphones, and Apple has supported the concept since June 2014. http://bit.ly/29giiZj

Developer  87d

Apple Store app offers Procreate Pocket

The Apple Store app for iPhone, which periodically rewards users with free app gifts, is now offering the iPhone "Pocket" version of drawing app Procreate for those who have the free Apple Store app until July 28. Users who have redeemed the offer by navigating to the "Stores" tab of the app and swiping past the "iPhone Upgrade Program" banner to the "Procreate" banner have noted that only the limited Pocket (iPhone) version of the app is available free, even if the Apple Store app is installed and the offer redeemed on an iPad. The Pocket version currently sells for $3 on the iOS App Store. [32.4MB]

 87d

Porsche adds CarPlay to 2017 Panamera

Porsche has added a fifth model of vehicle to its CarPlay-supported lineup, announcing that the 2017 Panamera -- which will arrive in the US in January -- will include Apple's infotainment technology, and be seen on a giant 12.3-inch touchscreen as part of an all-new Porsche Communication Management system. The luxury sedan starts at $99,900 for the 4S model, and scales up to the Panamera Turbo, which sells for $146,900. Other vehicles that currently support CarPlay include the 2016 911 and the 2017 models of Macan, 718 Boxster, and 718 Cayman. The company did not mention support for Google's corresponding Android Auto in its announcement. http://bit.ly/295ZQ94

Industry  87d

Apple employees testing wheelchair features

New features included in the forthcoming watchOS 3 are being tested by Apple retail store employees, including a new activity-tracking feature that has been designed with wheelchair users in mind. The move is slightly unusual in that, while retail employees have previously been used to test pre-release versions of OS X and iOS, this marks the first time they've been included in the otherwise developer-only watchOS betas. The company is said to have gone to great lengths to modify the activity tracker for wheelchair users, including changing the "time to stand" notification to "time to roll" and including two wheelchair-centric workout apps. http://bit.ly/2955JDa

Troubleshooting  87d

SanDisk reveals two 256GB microSDXC cards

SanDisk has introduced two 256GB microSDXC cards. Arriving in August for $150, the Ultra microSDXC UHS-I Premium Edition card offers transfer speeds of up to 95MB/s for reading data. The Extreme microSDXC UHS-I card can read at a fast 100MB/s and write at up to 90MB/s, and will be shipping sometime in the fourth quarter for $200. http://bit.ly/294Q1If

Upgrades/storage  87d

Apple's third-quarter results due July 26

Apple has advised it will be issuing its third-quarter results on July 26, with a conference call to answer investor and analyst queries about the earnings set to take place later that day. The stream of the call will go live at 2pm PT (5pm ET) via Apple's investor site, with the results themselves expected to be released roughly 30 minutes before the call commences. Apple's guidance for the quarter put revenue at between $41 billion and $43 billion. http://apple.co/1oi1Pbm

Investor  88d

Twitter stickers slowly roll out to users

Twitter has introduced "stickers," allowing users to add extra graphical elements to their photos before uploading them to the micro-blogging service. A library of hundreds of accessories, props, and emoji will be available to use as stickers, which can be resized, rotated, and placed anywhere on the photograph. Images with stickers will also become searchable with viewers able to select a sticker to see how others use the same graphic in their own posts. Twitter advises stickers will be rolling out to users over the next few weeks, and will work on both the mobile apps and through the browser. http://bit.ly/29bbwUE

IPhone apps  88d