Surveillence outfit Hacking Team may have released a new piece of OS X malware

The malware packs a few new tricks, and AV software wasn't detecting it at first

Security researchers have identified a new piece of OS X malware that may come from Hacking Team, the controversial Italian company that sells surveillance software to governments.

The malware is a "dropper," which is used to plant other software onto a computer. In this case, it appears intended to install Hacking Team's Remote Control System (RCS).

"The dropper is using more or less the same techniques as older Hacking Team RCS samples, and its code is more or less the same," wrote Pedro Vilaca, an OS X security expert with SentinelOne, on his blog.

It's difficult to determine if Hacking Team is using the dropper or if someone else took the code and has added a few improvements. Hacking Team suffered a devastating data breach in July 2015 that saw the release of 400GB of data, including source code and exploits.

"Either this is an old sample or HackingTeam are still using the same code base as before the hack," Vilaca wrote.

Two variations of the code were uploaded about three weeks ago to VirusTotal, the free scanning service from Google. At that time, no antivirus products detected the code.

One of the improvements is that the malware uses Apple's native OS X encryption scheme and a custom packing method, wrote Patrick Wardle, director of research with the Synack.

Vilaca wrote that it also uses an anti-debugging trick to make analysis by security researchers more difficult. Still, Vilaca wasn't complimentary about the new sample.

"Until now, nothing spectacular," he wrote. "Either this is an old sample or HackingTeam are still using the same code base as before the hack."

Hacking Team has been accused in the past by privacy and human rights groups of selling its software to governments with poor human rights records. 

The leaked data included a client list and indicated Hacking Team had relationships with governments such as Azerbaijan, Bahrain, Egypt, Ethiopia, Kazakhstan, Morocco, Nigeria, Oman, Saudi Arabia and Sudan.

The company remained defiant after the hacking, saying it did not sell tools to governments illegally. Despite such a large data breach, Hacking Team remains in business.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?