Menu
Surveillence outfit Hacking Team may have released a new piece of OS X malware

Surveillence outfit Hacking Team may have released a new piece of OS X malware

The malware packs a few new tricks, and AV software wasn't detecting it at first

Security researchers have identified a new piece of OS X malware that may come from Hacking Team, the controversial Italian company that sells surveillance software to governments.

The malware is a "dropper," which is used to plant other software onto a computer. In this case, it appears intended to install Hacking Team's Remote Control System (RCS).

"The dropper is using more or less the same techniques as older Hacking Team RCS samples, and its code is more or less the same," wrote Pedro Vilaca, an OS X security expert with SentinelOne, on his blog.

It's difficult to determine if Hacking Team is using the dropper or if someone else took the code and has added a few improvements. Hacking Team suffered a devastating data breach in July 2015 that saw the release of 400GB of data, including source code and exploits.

"Either this is an old sample or HackingTeam are still using the same code base as before the hack," Vilaca wrote.

Two variations of the code were uploaded about three weeks ago to VirusTotal, the free scanning service from Google. At that time, no antivirus products detected the code.

One of the improvements is that the malware uses Apple's native OS X encryption scheme and a custom packing method, wrote Patrick Wardle, director of research with the Synack.

Vilaca wrote that it also uses an anti-debugging trick to make analysis by security researchers more difficult. Still, Vilaca wasn't complimentary about the new sample.

"Until now, nothing spectacular," he wrote. "Either this is an old sample or HackingTeam are still using the same code base as before the hack."

Hacking Team has been accused in the past by privacy and human rights groups of selling its software to governments with poor human rights records. 

The leaked data included a client list and indicated Hacking Team had relationships with governments such as Azerbaijan, Bahrain, Egypt, Ethiopia, Kazakhstan, Morocco, Nigeria, Oman, Saudi Arabia and Sudan.

The company remained defiant after the hacking, saying it did not sell tools to governments illegally. Despite such a large data breach, Hacking Team remains in business.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Veritas honours top performing trans-Tasman partners

Veritas honours top performing trans-Tasman partners

Veritas honoured its top performing partners across the channel in Australia and New Zealand, recognising innovation and excellence on both sides of the Tasman. Revealed under the Vivid lights in Sydney, Intalock claimed the coveted Partner of the Year 2017 (Pacific) award, with Data#3 acknowledged for 12 months of strong growth across the market. Meanwhile, Datacom took home the New Zealand honours, with Global Storage and Insentra winning service provider and consulting awards respectively. Dicker Data was recognised as the standout distributor of the year, while Hitachi Data Systems claimed the alliance partner award. Photos by Bob Seary.

Veritas honours top performing trans-Tasman partners
An Evening With Eugene Kaspersky for Kiwi partners in Auckland

An Evening With Eugene Kaspersky for Kiwi partners in Auckland

​New Zealand partners came together for An Evening With Eugene Kaspersky in Auckland, an invitation only event as part of Kaspersky Lab Partner Engage. Following an evening of insights and executive networking with the founder of Kaspersky Lab, Eugene Kaspersky, Kiwi partners got up close and personal with Eugene in an unprecedented​ panel discussion. Facilitated by Reseller News, this panel explored channel relationships, successful business strategies, and the latest ground breaking technologies to impact the security market. Photos by Maria Stefina.

An Evening With Eugene Kaspersky for Kiwi partners in Auckland
Show Comments