A New Type of Ransomware Is Affecting Apple’s OS X Devices

A new type of ransomware that attacks OS X gadgets has been identified by specialists. The ransomware, known as KeRanger, was found on a genuine site of the open-source torrent client Transmission, as the experts said in their short article published this weekend.

Ransomware represents a controversial type of viruses that is rising. Often distributed via phishing strategies and harmful information, ransomware aims to infect affected or insecure devices in order to encrypt data and keep people out of the PC and network.

As outlined by the latest case of several German medical centers affected by ransomware, after the systems are closed, this type of viruses creates a new page and requires a ransom in Bitcoin, the virtual currency

People then usually have just two options: to recover their information from a prior back up or to pay this ransom. However, for some older editions of ransomware, such as CryptoLocker, cyber security professionals have launched free saving packages to eliminate attacks.

OS X-enabled ransomware is much rarer than MS Windows editions. The other identified type ransomware affecting Macs is FileCoder, found in 2014. This virus was discovered within a couple Transmission setup as harmful .dmg data on the formal web page.

The experts do not understand how the harmful versions crawl their way into the web page, but the open-source application was recompiled or changed after the page was affected by the hacker. Named KeRanger, this ransomware was marked with a legitimate Mac database certification, which permitted it to avoid Apple’s tight Gatekeeper protection barriers.

Once downloadable, the ransomware releases an exe computer file inside the device and then stays for 3 days before linking to the attacker’s control server through the Tor system. The viruses then start to spread and encrypt files, locking the network and requiring a ransom in Bitcoins calculated at around $400.

The specialists say that it is probable the ransomware may still be in its development phase. There are signs within the code that suggest extra features under testing. These were not finished or applied, such as the initiatives to make backdoor options and secure information saved inside the Apple Time Machine service.

If this back-up information is locked, users will not be capable to restore their affected data using the Time Machine, according to experts. After the scientists informed Apple about these new results, the iPhone and iPad manufacturer suspended the certification that allows the harmful computer file to be to downloaded.

Now, customers are alerted if they want to download or open the fake .dmg data. Furthermore, Google has modified its XProtect signatures in order to cover this ransomware family. Starting last week, Transmission eliminated the harmful information from its web page, and content will now be secure for viewing and downloading.

If people got the installation software from the legit open-source venture’s web page after March 5, then they will have to scan it against contamination with KeRanger. In addition, is it recommended to perform a system scan downloads from other sites, too.

Image source: Wikimedia