Menu
Surveillence outfit Hacking Team may have released a new piece of OS X malware

Surveillence outfit Hacking Team may have released a new piece of OS X malware

The malware packs a few new tricks, and AV software wasn't detecting it at first

Security researchers have identified a new piece of OS X malware that may come from Hacking Team, the controversial Italian company that sells surveillance software to governments.

The malware is a "dropper," which is used to plant other software onto a computer. In this case, it appears intended to install Hacking Team's Remote Control System (RCS).

"The dropper is using more or less the same techniques as older Hacking Team RCS samples, and its code is more or less the same," wrote Pedro Vilaca, an OS X security expert with SentinelOne, on his blog.

It's difficult to determine if Hacking Team is using the dropper or if someone else took the code and has added a few improvements. Hacking Team suffered a devastating data breach in July 2015 that saw the release of 400GB of data, including source code and exploits.

"Either this is an old sample or HackingTeam are still using the same code base as before the hack," Vilaca wrote.

Two variations of the code were uploaded about three weeks ago to VirusTotal, the free scanning service from Google. At that time, no antivirus products detected the code.

One of the improvements is that the malware uses Apple's native OS X encryption scheme and a custom packing method, wrote Patrick Wardle, director of research with the Synack.

Vilaca wrote that it also uses an anti-debugging trick to make analysis by security researchers more difficult. Still, Vilaca wasn't complimentary about the new sample.

"Until now, nothing spectacular," he wrote. "Either this is an old sample or HackingTeam are still using the same code base as before the hack."

Hacking Team has been accused in the past by privacy and human rights groups of selling its software to governments with poor human rights records. 

The leaked data included a client list and indicated Hacking Team had relationships with governments such as Azerbaijan, Bahrain, Egypt, Ethiopia, Kazakhstan, Morocco, Nigeria, Oman, Saudi Arabia and Sudan.

The company remained defiant after the hacking, saying it did not sell tools to governments illegally. Despite such a large data breach, Hacking Team remains in business.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Why experience is the new battleground for partners

Join us for an exclusive webinar, in association with Hewlett Packard Enterprise and Technology Services Industry Association (TSIA) and learn about the latest industry insights and how technology services continue to evolve to deliver differentiated value, and how partners can be successful in 2021 and beyond.

Featured

Slideshows

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Show Comments