Mac spyware discovered on Angolan dissident’s computer at Oslo Freedom Forum


Security researchers are studying an apparent new strain of Mac spyware that turned up on the computer of a participant at the just-concluded Oslo Freedom Forum, an annual human rights conference.

The backdoor was discovered by noted privacy and security researcher Jacob Appelbaum, who tweeted Thursday that it targeted the machine of an Angolan dissident. Angola is a southern African nation that has faced steep criticism for human rights abuses.

Analysts at security firm F-Secure studied the virus sample and learned that it was signed with a seemingly valid Apple Developer ID, steals screen shots and communicates with two command-and-control servers. F-Secure dubbed the malware OSX/KitM.A.

The spyware was discovered during a workshop that Appelbaum ran in which he instructed audience members on how to protect themselves from government surveillance.

The Oslo Freedom Forum event brings together "Influential dissidents, innovators, journalists, philanthropists, and policymakers" from around the world, according to the event's website.

Espionage malware built to run on Mac OS X machines is becoming increasingly common as more targets use the operating system.

UPDATE: Appelbaum said in a tweet that the activist's Mac was hit with the malware via a spear phishing attack.

UPDATE TWO: The SANS Internet Storm Center explained how it's possible to "verify and extract signatures and certificates on an Apple .app" as the attacker did in this instance.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.