COLDROOT RAT. A two-year security hole in MacOS.

[DronVR]

COLDROOT RAT. A two-year security hole in MacOS.

The two-year-old COLDROOT RAT, a remote access Trojan targeted at MacOS, is still undetectable.

The Trojan is cross-platform, and is capable of running on MacOS systems up to OS High Sierra versions. Apparently, the original malware was created by someone for fun in order to “play with Mac users” and “grant them rights in this [RAT] area”. But now the trojan has changed and works for Linux, macOS and Windows.

In turn, it can be designed to steal bank credentials and other information.

Coldroot RAT can initiate new remote desktop sessions, take screenshots of the victim, start and stop processes on the target system, search, download, download externally or execute arbitrary files. The malware sends all the collected data to a remote management server, where it is accessible through a web panel.
Coldroot RAT was found by researcher Patrick Wardell, chief researcher at Digital Security. According to him, malware seems to have been on the darknet market since January 1, 2017, and Coldroot code versions have also been available on GitHub for two years now.​

Malware still do not detect antivirus solutions.
Wardell sadly notes that the main problem is that Coldroot is still virtually undetectable by defensive solutions, although the source of the malware was published in the public domain almost two years ago. So, according to VirusTotal, the malware does not “see” any anti-virus solution.

Some interesting technical information
The RAT sample verified by Wardel is unsigned. When it starts, changes are made to the macOS privacy database called "TCC.db", which maintains a list of applications and the level of access rights that they have. With these rights, applications can interact with the user interfaces of the system, other applications, and even intercept key actions (i.e., lead keylogging ) "By directly modifying the database, you could avoid the unpleasant system alert that is usually provided to the user," Vardel wrote.

He said that the RAT is disguised as the Apple sound driver “com.apple.audio.driver2.app”. Next, when you click on it, it displays a standard authentication prompt prompting you to enter your MacOS credentials. Once enabled, RAT modifies the TCC.db privacy database, granting malware access rights to execute the system keylogging .

The researcher notes that on MacOS High Sierra systems, Apple now protects "TCC.db" through the System Integrity Protection System (SIP). He wrote: "The Coldroot RAT script will not be able to perform root actions in new versions of macOS (Sierra +), since the privacy database is now protected by SIP (ohm)."

Coldroot RAT remains consistent on MacOS, setting itself up as a daemon launch. This means that malware starts automatically every time the infected system is rebooted.

Vardel noted: “Behind the scenes, the application will automatically go to the server. While creating a network connection in itself is not malicious, it is a common tactic used by malware. In particular, for registration with the management server, and management to perform tasks. "

“When the malware receives a command from the server to start a remote desktop session, it generates a new thread called“ REMOTEDESKTOPTHREAD. ”It basically sits in the“ while ”loop (until the command“ stop the remote desktop ”is issued), taking and "Streaming" capturing the user's desktop screen for a remote attacker who infected a computer, "he notes.

Vardel also said that the author of the Coldzer0 malware has been providing RAT code snippets online since January 2017. He noted that the author advertised Coldroot for sale, and offered customers ways to configure malware. He notes that the video hosted by "Coldzer0" advertises Coldroot RAT as a cross platform and can be used to attack MacOS, Windows, and Linux.

Source @Kevin Mitnick