Mac spyware discovered on Angolan dissident's computer at Oslo Freedom Forum

Share this article:
FBI ransomware scam finds new home on the Mac
FBI ransomware scam finds new home on the Mac

Security researchers are studying an apparent new strain of Mac spyware that turned up on the computer of a participant at the just-concluded Oslo Freedom Forum, an annual human rights conference.

The backdoor was discovered by noted privacy and security researcher Jacob Appelbaum, who tweeted Thursday that it targeted the machine of an Angolan dissident. Angola is a southern African nation that has faced steep criticism for human rights abuses.

Analysts at security firm F-Secure studied the virus sample and learned that it was signed with a seemingly valid Apple Developer ID, steals screen shots and communicates with two command-and-control servers. F-Secure dubbed the malware OSX/KitM.A.

The spyware was discovered during a workshop that Appelbaum ran in which he instructed audience members on how to protect themselves from government surveillance.

The Oslo Freedom Forum event brings together "Influential dissidents, innovators, journalists, philanthropists, and policymakers" from around the world, according to the event's website.

Espionage malware built to run on Mac OS X machines is becoming increasingly common as more targets use the operating system.

UPDATE: Appelbaum said in a tweet that the activist's Mac was hit with the malware via a spear phishing attack.

UPDATE TWO: The SANS Internet Storm Center explained how it's possible to "verify and extract signatures and certificates on an Apple .app" as the attacker did in this instance.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.