Menu
New Tor-powered backdoor program targets Macs

New Tor-powered backdoor program targets Macs

The Eleanor malware allows attackers to execute commands and scripts, steal and modify files and take pictures using the webcam

Security researchers have found a new backdoor program that allows attackers to hijack Mac systems and control them over the Tor network.

The new malware has been dubbed Backdoor.MAC.Eleanor by researchers from antivirus vendor Bitdefender and is distributed as a file converter application through reputable websites that offer Mac software.

The rogue application is called EasyDoc Converter. Once installed it displays a fake interface where users can supposedly drag and drop files for conversion, but which in reality doesn't do anything.

In the background, the application executes a shell script that installs multiple malicious components in a folder called “/Users/$USER/Library/.dropbox." The Dropbox name is used to make the malware harder to spot and has nothing to do with the legitimate Dropbox file synchronization software.

The Eleanor malware has three components: a Web service with a PHP application, a Tor hidden service that allows attackers to connect to the affected systems over the Tor anonymity network and an agent that posts the Tor access URLs for infected systems to the Pastebin website.

The PHP application served by the Web service is actually a backdoor that allows attackers to view, edit, rename, delete, upload, download and archive files on the system; to execute shell commands and scripts written in PHP, Perl, Python, Ruby, Java and C; to open a reverse shell to the attackers' server; to connect to MySQL, SQLite and other databases; to view the process list and to send emails with attachments. Another component of this application allows attackers to capture images and videos using the system's webcam.

The Tor component connects the computer to the Tor network and makes its rogue Web service accessible via a .onion URL. This type of URL can only be accessed from within the Tor network.

The Pastebin agent takes the system's .onion URL, encrypts it with an RSA public key and posts it on Pastebin where attackers can find it and use it.

The oldest Pastebin post identified by the Bitdefender researchers as being created by the Eleanor backdoor is dated April 19. But the company could not establish the total number of infected machines, because different Eleanor samples upload URLs to different Pastebin accounts and they don't have all the samples.

The good news is that the app is not digitally signed by an Apple-approved certificate, so users will see security warnings on the latest OS X version if they try to install it. On OS X El Capitan (10.11) users would actually need to perform a manual override in order to install the application.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments