EasyDoc Malware Adds Tor Backdoor To Macs For Botnet Control (theregister.co.uk)
An anonymous reader writes: Security firm Bitdefender has issued an alert about a malicious app that hands over control of Macs to criminals via Tor. The software, called EasyDoc Converter.app, is supposed to be a file converter but doesn't do its advertised functions. Instead it drops complex malware onto the system that subverts the security of the system, allowing it to be used as part of a botnet or to spy on the owner. "This type of malware is particularly dangerous as it's hard to detect and offers the attacker full control of the compromised system," said Tiberius Axinte, Technical Leader, Bitdefender Antimalware Lab. "For instance, someone can lock you out of your laptop, threaten to blackmail you to restore your private files or transform your laptop into a botnet to attack other devices. The possibilities are endless." The malware, dubbed Backdoor.MAC.Eleanor, sets up a hidden Tor service and PHP-capable web server on the infected computer, generating a .onion domain that the attacker can use to connect to the Mac and control it. Once installed, the malware grants full access to the file system and can run scripts given to it by its masters.A report on AppleInsider says that malware can also control the FaceTime camera on a victim's computer. But thankfully, Apple's Gatekeeper security prevents the unsigned app from being installed.
Nice to see the security features of an *nix based OS working here. Gatekeeper will prevent most from installing it, and for those who disable security features, you ought to know what you are doing anyway.
And - unwritten in TFA is the fact that there will probably be a fix for this post haste.
I get this download offered a lot when I'm on dodgy file sites. I never trust these anyways, and a moment's research on Google brings up lots of complaints.
But I'm there, on this dodgy site, and I expect they will try to fling poo at my machine. So I have always avoided it.
And having a Windows machine, everything wants to infect it, even Windows Update.
deleting the extra space after periods so i can stay relevant, yeah.
Hello APK. didn't you want to leave this site after you've had a quarrel with whipslash?In fact you claimed to have made your "last post ever" on this site!
This is LUDDITE software disguised as an app! Vote for Appald Trump, and he will deport these LUDDITES to LUDDITE Mexico and MAKE APPS APPY AGAIN!
Apps!
"Go ahead - download that iffy software from some random pr0n site advert so you can see your b00bie pictures better... it'll be fine..."
Quo usque tandem abutere, Nimbus, patientia nostra?
"souled-out to admen"
Total fail. My 11-year old wouldn't make this ridiculous spelling error.
Yeah, gatekeeper prevents it from being installed... Unless the user right-clicks and clicks open in the menu there... Then it's game-on.
I must be perfectly safe from it, then.
The data flow light on their router would be constantly flicking meaning dater is leaving their computer and coming in. How could this not be noticed and stopped easily.
Let's take the simplest of home computer users accessing the Internet, and let's suppose that their data flow light flickers all the time regardless
like some cable Internet users lights do ( those having their data flow monitored ).
Surely people put a second Router in line that only flickers when dater is leaving and coming into their computer.
Data cannot leave your computer without you noticing your data outflow flickering light flickering.
I don't believe this story I know lots of people are very stupid on computers but you only have to glance at your data flow light.
whiplash has no clue how the site works, I doubt he has ever reviewed slashcode. He is completely unaware that users are able to ban other users, which is why most of us never register and post AC so that we cannot be banned by other users who disagree with what we say.
Disclaimer: I am not APK.
APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity. Compliments firewalls (w/ layered drivers blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load). Gets data via 10 security sites.
Ads rob bandwidth/speed, security (malvertising), privacy (tracking) + anonymity.
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively. Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Works vs. caps & HTTP PUSH ads w/ firewalls.
Avg. webpage = big as Doom http://www.theregister.co.uk/2... & ads = 40% of the size.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "I've seen the code & it's safe" http://forum.hosts-file.net/vi... )
Err - isn't this story about OS X malware? You are advertising something even more irrelevant than usual!
Fuck off, had enough of your spamming.
Users banning other users? What crack are you on?
I can set someone as foe and make all foes show as -6 moderation, but that only shows for me, not everyone else. You can also be down-modded for trolling or posting off topic and get bad karma which makes it harder to make good posts, but that isn't banning either.
You don't have an account for the same reason APK refuses to use his account; you don't want to be held accountable for what you post.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Well, TBH, Macs have hosts files too, and they are just as useless for what APK wants everyone to do.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Because posting your garbage three times will make people see the light of day?
Grow up APK, your software and solution totally suck, and don't protect half as well as a proper solution of DNS or Ad blocking software.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Four times now? No wonder Whipslash wants to get rid of you, I guess it is the same as everyone else. Spam is annoying when it comes in through email, where it is simple to just delete, but on Slashdot, you just piss off the audience, you don't even get through to the people you are targeting.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Don't speak for me. I see no benefits in accts & want no tracking by cookie/script chains SLOWNESS you force on yourself!
APK
P.S.=> See subject & this (no denying it):
won't demonstrate security of his product by exposing the source - by Coren22 (1625475)
57 antiviruses show different https://www.virustotal.com/en/...
MalwareBytes' employee hosts & recommends it -> http://hosts-file.net/?s=Downl...
secretary at MalwareBytes took a look at his source code and said it looked all good - by Coren22
My code's verified by Mr. S. Burn of Malwarebytes
"I've seen the code and yes it is safe." FROM http://forum.hosts-file.net/vi...
NO secretary!
I don't give it away to be misused like GOOGLE CHROME http://it.slashdot.org/story/1... ... apk
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works by bmo
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience by chihowa
APK
P.S.=> Want more? Ask & "ye SHALL receive" by the dozens - see subject, lol... apk
Coren22 you want apk gone since he made you out a fool publicly for your mistakes https://apple.slashdot.org/com...
Whipslash is a webmaster who fears apk's hosts program blocking monies he makes on Google ads.
It's obvious!
Plenty of people like apk and his work. I've seen quotes of them stating it https://apple.slashdot.org/com... and it's also obvious you like making yourself out a butthurt fool who's sore he can't do things like apk has in computing after he also made you out a complete imbecile in the first link above too. Give up already! Do you like looking stupid?
Aryeh Goretsky NOD32/ESET hosts = good security http://it.slashdot.org/comment...
Steven Burn of Malwarebytes does (hosting & recommending my ware no less - something YOU can never ever manage, lol).
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/c...
Brocke Wilders of WILDERS' SECURITY does http://www.wilderssecurity.com...
Steve Gibson https://www.grc.com/sn/sn-045....
OReilly for security http://oreilly.com/pub/a/windo...
OReilly for speed http://www.oreillynet.com/pub/...
APK
P.S.=> "EAT YOUR WORDS" (again) just like here today too https://apple.slashdot.org/com... hmmm?... apk
Coren22 haven't you had enough of apk making you look stupid 3 times from 7 security pros https://apple.slashdot.org/com... , slashdot users https://apple.slashdot.org/com... and your rather stupid mistakes against apk too https://apple.slashdot.org/com... ? It's one thing to be jealous that apk actually creates things that are useful and good but it's another to be a frustrated loon like you're turning into.
Except, APK, you have in no way made a fool of me. You have instead repeatedly displayed your unfathomable ignorance of technology, and human interaction.
Whipslash is the face of Slashdot, he doesn't fear your hosts file software in any way, he fears losing users because you drive them off with your spam, which is far worse than any ad they run on this site. The ads on this site are quite tasteful, and targeted well at the audience. If you don't like them, block them. They used to have a "turn off advertising" checkbox for people who contribute well to Slashdot's discussions, however that stopped working properly under Dice as far as I have heard. Whipslash I believe said he wanted to fix that checkbox, but I could be misremembering that conversation.
You however, there is no way to block. You spam the hell out of so many discussions because you think you are helping things. You also for some reason believe you are being persecuted against, even though the down modding is because you are spewing garbage, not because people dislike you.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
"Macs have hosts files too & they are just as useless for what APK wants" - by Coren22 ( 1625475 ) on Friday July 08, 2016 @03:40PM (#52473587)
7 security & web pros disagree w/ your offtopic bullshit:
Aryeh Goretsky NOD32/ESET hosts = good security http://it.slashdot.org/comment...
Steven Burn of Malwarebytes does (hosting & recommending my ware no less - something YOU can never ever manage, lol).
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/c...
Brocke Wilders of WILDERS' SECURITY does http://www.wilderssecurity.com...
Steve Gibson https://www.grc.com/sn/sn-045....
OReilly for security http://oreilly.com/pub/a/windo...
OReilly for speed http://www.oreillynet.com/pub/...
APK
P.S.=> "EAT YOUR WORDS" (again) just like here too https://apple.slashdot.org/com... ... apk
"Macs have hosts files too & they are just as useless for what APK wants" - by Coren22 ( 1625475 ) on Friday July 08, 2016 @03:40PM (#52473587)
Coren22 7 security & web pros disagree w/ your offtopic bs (just as our /. peers did per my last post):
Aryeh Goretsky NOD32/ESET hosts = good security http://it.slashdot.org/comment...
Steven Burn of Malwarebytes does (hosting & recommending my ware no less - something YOU can never ever manage, lol).
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/c...
Brocke Wilders of WILDERS' SECURITY does http://www.wilderssecurity.com...
Steve Gibson https://www.grc.com/sn/sn-045....
OReilly for security http://oreilly.com/pub/a/windo...
OReilly for speed http://www.oreillynet.com/pub/...
APK
P.S.=> "EAT YOUR WORDS" (again) just like here vs. your offtopic ASSBURGER mental defective brain bs here too https://apple.slashdot.org/com... ... apk
"Macs have hosts files too & they are just as useless for what APK wants" - by Coren22 ( 1625475 ) on Friday July 08, 2016 @03:40PM (#52473587)
Coren22 7 security & web pros disagree w/ your offtopic bs (just as our /. peers did too in the link in my ps below too):
Aryeh Goretsky NOD32/ESET hosts = good security http://it.slashdot.org/comment...
Steven Burn of Malwarebytes does (hosting & recommending my ware no less - something YOU can never ever manage, lol).
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/c...
Brocke Wilders of WILDERS' SECURITY does http://www.wilderssecurity.com...
Steve Gibson https://www.grc.com/sn/sn-045....
OReilly for security http://oreilly.com/pub/a/windo...
OReilly for speed http://www.oreillynet.com/pub/...
APK
P.S.=> "EAT YOUR WORDS" (again) just like here vs. your offtopic ASSBURGER mental defective brain bs here too WHERE OUR /. PEERS AGREE w/ ME, not you Coren22, lol-> https://apple.slashdot.org/com... ... apk
APK's on topic offering a potential solution. You're off topic not offering one. Get on topic please.
Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61
(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).
WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)
PC-WELT FEB 1998 - page 84, again, my work is featured there
WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there
PC-WELT FEB 1999 - page 83, again, my work is featured there
CHIP Magazine 7/99 - page 100, my work is there
GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it
HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!
Being paid for an article that made me money over @ PCPitstop in 2008 http://pcpitstop.com/news/winn... for writing up a guide that has people showing NO VIRUSES/SPYWARES & other screwups, via following its point, such as THRONKA sees here -> http://www.xtremepccentral.com...
It's also been myself helping out the folks at the UltraDefrag64 project (a 64-bit defragger for Windows), in showing them code for how to do Process Priority Control @ the GUI usermode/ring 3/rpl 3 level in their program (good one too), & being credited for it by their lead dev & his team... see here -> http://ultradefrag.sourceforge... or here http://sourceforge.net/tracker...
Which ended up fixing a "bug" for them later, here -> http://sourceforge.net/p/ultra... via its implementation (only partial - if they want low priority background defrags, it's part of the trick to getting it too, not just high priority ops...)
Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only.
APK
P.S.=> Programs like my APK Hosts File Engine does the rest (hosted AND RECOMMENDED by the best antimalware's people no less)
Along w/ a professional trackrecord & resume from 1994 in computing - & THAT is only a TINY FRACTION of what I could put out above as to "credentials" - which is MORE THAN YOU EVER WILL (& we haven't seen any actual code from you THAT YOU WROTE COMPLETELY YOURSELF either LET ALONE WHAT YOU ARE ASKED FOR (proof you work in computing) FIRST which you EVADE TO NO END, lol)... apk