Intego has seen an eyebrow-raising upward trend in the number of malicious files discovered targeting Mac OS X in the past few years, and it has many security experts concerned. Virus hunters have unveiled yet another modular malware for Mac OS X, called the Ventir Trojan.
Ventir uses a dropper program (e.g. Trojan horse) that can leave a backdoor, a keylogger and other malicious files behind on an infected Mac. These can be used for spying and stealing information from the victim’s Mac.
We currently do not know how the malware is distributed. Ventir is a Trojan horse, so it’s likely being picked up when downloading pirated software from peer-to-peer websites, such as BitTorrent.
The primary feature of Ventir is that it integrates a legitimate component for intercepting keystrokes that is freely available on code sharing websites.
The keystroke logger makes use of an open source software package freely available from GitHub, called LogKext. Given the recent scares about hacked accounts, the thought of software that watches what you type and sends it to the bad guys is particularly unnerving.
LogKext has three files that function to intercept keystrokes (updated.kext), match the codes of the keys pressed by the victim to the characters associated with these codes (Keymap.plist), and log the keystrokes along with some system events (EventMonitor agent).
Fortunately, LogKext hooks on to the OS X kernel only if the dropper is successful in obtaining elevated privilges to the victims Mac.
It’s also worth noting that some of the keylogger components (Keymap.plist and updated.kext) are previously detected by Intego VirusBarrier as OSX/logKext.E and OSX/logKext.D.
The Ventir Tojan is delivered through a dropper that, when launched, checks whether it has root access to the machine—this is critical because that affects where the malware can install itself.
The result of the check for root access determines how much Ventir can run and the path where the Trojan’s files will be installed on the victims Mac.
Where Ventir installs files
It’s important to distinguish the two install directories: /Library/.local and ~/Library/.local (“~” stands for the path to the current user’s home directory). The malware will install to the home directory if the installer does not have root access.
With root access
If it has root access, the Trojan’s files will be installed in /Library/.local and /Library/LaunchDaemons. The Ventir malware downloads additional backdoor components if it has full privileges to the victims Mac.
Without root access
If it does not have root access, the files will be installed in ~/Library/.local and ~/Library/LaunchAgents. The EventMonitor spying component is downloaded to the affected machine only if elevated privileges are not obtained.
“All files of the Trojan to be downloaded to the victim machine are initially located in the ‘__data’ section of the dropper file,” wrote Mikhail Kuzin over at Securelist.
Image credit: Securelist
After the dropper determines where the Trojan’s files will be installed, it hides the following files on the infected machine:
Checking for and finding the existence of a /Library/.local or ~/Library/.local directory on your Mac is the most obvious indicator of infection. But first you will need to ensure you have Finder set to show hidden files.
By default, Mac OS X’s Finder keeps system files—which generally start with a dot, like .bash_profile—out of sight. To set Finder to show all hidden files, open Terminal and type the following:
defaults write com.apple.finder AppleShowAllFiles TRUE
killall Finder
To set it back, simply execute those same commands, but switch TRUE to FALSE.
If the /Library/.local directory exists, there may also be a keylogger extension located at /System/Library/Extensions/updated.kext.
Also check for the Agent/Daemon: com.updated.launchagent.plist in /Library/LaunchDaemon/ or ~/Library/LaunchAgents/. Its contents will reference a program in /Library/.local:
It appears that OSX/Ventir is similar to OSX/Crisis, as researchers have found it has approximately the same number of modules with similar functionality. Unfortunately, using open source software makes it easier for criminals to create new Mac malware, and it’s likely that such attacks will grow more prevalent as it becomes simpler and simpler to use off the shelf components to build malicious software.
The Ventir Trojan is a great example why a layered defense strategy is so handy. We’ve already covered the need to back up your data in multiple places and establish a good backup routine. But what else can you do?
Mac anti-virus is meant to detect known-bad things, and as Ventir was previously unknown, odds are it would not have caught this. Firewalls, however, are meant to detect unknown network traffic and would likely have alerted on this. By having layered security on your machine, you increase the chances of being able to prevent incidents like these.
Intego VirusBarrier with up-to-date virus definitions detects and eradicates this malware, which it identifies as OSX/Ventir. Additionally, some of the keylogger components (Keymap.plist and updated.kext) were already detected by Intego VirusBarrier as OSX/logKext.E and OSX/logKext.D.
