Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

MacKeeper security vulnerability now exploited to hijack Apple computers

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

June 16, 2015

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

According to BAE security researcher Sergei Shevchenko, last month's MacKeeper security vulnerability is now being exploited in the wild, in several attempts to hijack Apple computers and MacBooks.

Cyber criminals are using social engineering to trick users into installing malware capable of infiltrating data using a then zero-day security vulnerability in the notorious software which has been downloaded more than twenty million times.

Shevchenko added that it took only a few days after the vulnerability and proof-of-concept disclosure for malware to begin targeting many users who had installed MacKeeper.

"The first reports on this security vulnerability suggested that no malicious MacKeeper URLs had been spotted in the wild, at least not yet, until now that is.

"Since the proof-of-concept was published, it took just a day or two for the first instances to be seen in the wild. Attackers might simply be spraying their targets with the phishing emails hoping that some of them will have MacKeeper installed, thus allowing the malware to be delivered to their computers and executed pronto," he said.

Shevchenko added that users who click a crafted phishing link will be prompted to enter login credentials to the MacKeeper app that will allow malware to execute with full admin privileges.

The malware can easily allow remote execution of shell commands, upload and download files with a simple keyboard command and then sent to a control server, and it will then siphon the system's information like running processes and details of all VPN connections.

On infection, it then downloads to the directory /Users/Shared/dufh and then it executes a running list and updates LaunchAgents to enable a new launch on the computer's reboot cycle.

Kromtech, the owners of MacKeeper, said-- "There are no known cases of any security breaches and the fix was created within hours of being notified. We are still monitoring the situation and have reached out to Sergei Shevchenko for more information. We were lucky that we took a proactive approach and we patched the security vulnerability within hours. We then prompted MacKeeper to update as soon as the machine went online. These two steps closed the window of opportunity almost as soon as it was identified."

Users should uninstall MacKeeper to version 3.4.1 to lessen the exposure to the security vulnerability.

Source: BAE Security.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer