Palo Alto tes hauj lwm Discovers Ransomware Targeting Macs
Lub Peb Hlis Ntuj Tim 4, 2016, Palo Alto Networks, ib qhov chaw ruaj ntseg zoo, muab tso rau nws cov kev tshawb ntawm KeRanger ransomware infecting kis, nrov Mac BitTorrent neeg nyiam. Lub malware tiag tiag tau pom nyob rau hauv lub tshuab nruab rau ntawm Kev Hloov Poob 2.90.
Lub vev xaib xaib sai sai tau muab cov kws muaj kab mob kis thiab xa tuaj rau leej twg uas siv Kev Hloov 2.90 los hloov tshiab rau version 2.92, uas tau raug tshawb pom los ntawm Kev Xa Mus kom tsis pub dawb ntawm KeRanger.
Txoj kev kis no tsis tau sib tham txog seb cov neeg muaj kab mob kis tau zoo li cas rau lawv lub vev xaib, tsis muaj Palo Alto tes hauj lwm tau los txiav txim siab seb qhov chaw raug xa tawm.
KeRanger Ransomware
KeRanger ransomware ua haujlwm li feem ntau ransomware ua, los ntawm encrypting cov ntaub ntawv rau koj Mac, thiab tom qab ntawd ces thov nyiaj; nyob rau hauv cov ntaub ntawv no, nyob rau hauv daim ntawv ntawm ib tug bitcoin (tam sim no muaj nuj nqis nyob ib ncig ntawm $ 400) muab koj nrog qhov tseem ceeb encryption kom zoo koj cov ntaub ntawv.
Lub KeRanger ransomware yog ntsia nruab nrab ntawm cov kev sib txuas lus nruab nrab. Lub installer ua kom siv tau ib daim ntawv pov thawj Mac app tsim tawm, muab lub installation ntawm ransomware los daus yav dhau los ntawm OS X's Gatekeeper technology , uas ua rau lub installation ntawm malware rau Mac.
Ib zaug ntsia, KeRanger teev cov kev sib txuas lus nrog ib tus neeg siv kev sib txuas lus nyob rau ntawm Network. Nws mam li mus pw tsaug zog rau peb hnub. Thaum nws tuaj txog, KeRanger tau txais qhov tseem ceeb encryption los ntawm cov neeg rau zaub mov hauv tej thaj chaw deb thiab rov mus rau encrypt cov ntaub ntawv ntawm tus kab mob Mac.
Cov ntaub ntawv encrypted muaj xws li cov neeg nyob rau hauv cov neeg siv / cov neeg siv, uas ua rau feem ntau tus neeg siv cov ntaub ntawv rau tus kab mob Mac ua encrypted thiab tsis usable. Tsis tas li ntawd, Palo Alto tes hauj lwm qhia tias daim ntim / Volume, uas muaj qhov taw tes taw rau tag nrho cov ntaub ntawv txuas, ob lub zos thiab hauv koj lub network, kuj yog lub hom phiaj.
Nyob rau lub sij hawm no, nws muaj cov ntaub ntawv sib xyaws sib xyaw ntsig txog lub sijhawm Teev Tseg Machine los ntawm KeRanger, tab sis yog tias daim ntawv / ntim nplaub tshev yog qhov tseeb, kuv pom tias tsis yog vim li cas Lub Tshuab Tshuab tsav yuav tsis raug encrypted. Kuv twv yog tias KeRanger yog xws li ib daim tshiab ntawm ransomware uas sib xyaw cov ntaub ntawv hais txog lub sij hawm tshuab yog ib tsab me ntsis hauv ransomware code; tej zaum nws ua haujlwm, thiab qee zaus nws tsis ua haujlwm.
Kua Reacts
Palo Alto tes hauj lwm qhia txog KeRanger ransomware rau Apple thiab Kev Kis. Ob leeg tau ua haujlwm ceev nrooj; Kua revoked Mac daim ntawv tsim daim ntawv pov thawj siv los ntawm lub app, yog li cia Gatekeeper txwv cov kev sib txuas ntxiv ntawm qhov tam sim no version of KeRanger. Kua kuj tau kho XProject tshiab kos npe, cia OS X malware tiv thaiv kab ke kom paub txog KeRanger thiab tiv thaiv kev txhim kho, txawm tias GateKeeper yog neeg xiam oob qhab, los yog teeb tsa rau qhov chaw tsis muaj kev ruaj ntseg.
Kev tshem tawm raug tshem tawm 2.90 tawm ntawm lawv lub website thiab sai sai dua ib tus qauv huv ntawm Kev Kis Mob, nrog ib tus xov tooj ntawm 2.92. Peb tuaj yeem xav hais tias lawv tab tom saib ua li cas lawv lub vev xaib, thiab kev ntsuas kom tsis txhob tshwm sim dua.
Tshem tawm KeRanger li cas
Nco ntsoov tias, downloading thiab txhim kho cov kab mob uas muaj tus kab mob kis tau tus mob app yog tam sim no tib txoj kev kom kis tau KeRanger. Yog tias koj tsis siv Kev Xa ntawv, koj tam sim no tsis tas yuav txhawj txog KeRanger.
Ntev li KeRanger tsis tau encrypted koj Mac cov ntaub ntawv tsis tau, koj muaj sij hawm kom tshem tau cov app thiab tiv thaiv cov encryption ntawm tshwm sim. Yog tias koj cov ntaub ntawv Mac yog twb encrypted, muaj 's tsis npaum koj yuav ua li tsuas vam cia koj backups tsis tau encrypted zoo li. Cov ntsiab lus no tawm ib qho laj thawj zoo heev rau kev tsav tsheb uas tsis tas txuas nrog koj lub Mac. Ua piv txwv, kuv siv Carbon Copy Cloner los ua ib qho clone ntawm kuv Mac cov ntaub ntawv . Lub tsev uas tsav tsheb uas clone tsis txuas rau kuv Mac mus txog thaum nws xav tau rau txheej txheem cloning.
Yog hais tias kuv tau khiav mus rau hauv qhov teeb meem ransomware, kuv kuj muaj zoo tu qab los ntawm rov ua los ntawm lub limtiam clone. Tsuas nplua rau kev siv clone txhua lub limtiam yog muaj cov ntaub ntawv uas yuav yog txog li ib lub lim tiam txij hnub, tab sis qhov zoo tshaj qhov them qee yam kev nyuab siab tsis muaj nyiaj.
Yog tias koj pom koj tus kheej hauv qhov teeb meem tsis muaj hmoo ntawm KeRanger twb tau tuaj yeem ua rau nws lub ntxiab, kuv paub tias tsis muaj lwm txoj kev uas tsis yog them tus nqi qiv los yog rov qab los ntawm OS X thiab pib dua nrog ib qho chaw ntxhua khaub ncaws .
Tshem tawm Kev Xa Mus
Hauv qhov Finder , mus rau / Cov Ntawv Thov.
Nrhiav qhov kis tau tus mob app, thiab tom qab ntawd ces nias nws txoj icon.
Los ntawm cov ntawv qhia zaub mov pop-up, xaiv Qhia Cov Ntsiab Lus.
Nyob rau hauv Finder qhov rai uas qhib, mus rau / txheej txheem / Resources /.
Nrhiav ib daim ntawv hais txog General.rtf.
Yog tias cov ntaub ntawv General.rtf yog tam sim no, koj muaj tus kab mob uas muaj kev sib kis tau kho. Yog hais tias qhov kev sib kis ntawm app khiav, tawm lub app, cab nws mus rau cov thoob khib nyiab, thiab tom qab ntawd khoob pov tseg.
Tshem KeRanger
Tua Tsum Saib Xyuas Kev Ntaus Tawm , nyob hauv / Cov Ntawv Qhia / Kev Siv Hluav Taws Xob.
Hauv Kev Saib Xyuas Kev Ua Dej Num, xaiv CPU tab.
Hauv Kev Ncaj Ncees Saib Xyuas Kev Tshawb Fawb txoj kev tshawb nrhiav, sau cov nram no:
kernel_servicethiab tom qab ntawd nias rov qab.
Yog tias qhov kev pab cuam no tshwm sim, nws yuav muab teev rau hauv Kev Ncaj Ncees ntawm Kev Ncaj Ncees.
Yog tias tam sim no, ob-nias cov txheej txheem lub npe hauv Kev Tshawb Nrhiav.
Nyob rau hauv lub qhov rais qhib, nyem qhov qhib cov Ntaub Ntawv thiab Cov Nres Ports.
Ua ib daim ntawv ntawm txoj kab ntawm kernel_service; nws yuav yog ib yam zoo li:
/ cov neeg siv / homefoldername / library / kernel_serviceXaiv cov ntaub ntawv, thiab nias lub khawm Txiav.
Rov ua dua qhov saum toj no rau lub npe ntawm kernel_time thiab cov npe ntawm cov tsiaj ntawv kernel_complete .
Txawm hais tias koj txiav cov kev pab cuam nyob rau hauv kev saib xyuas, koj kuj yuav tsum rho tawm cov ntaub ntawv los ntawm koj lub Mac. Ua li no, siv cov ntaub ntawv pathnames uas koj tau sau tseg rau kev xa mus rau kernel_service, kernel_time, thiab kernel_complete cov ntaub ntawv. (Ceeb Toom: Koj yuav tsis muaj tag nrho cov ntaub ntawv muaj nyob hauv koj lub Mac.)
Vim cov ntaub ntawv koj yuav tsum rho tawm muaj nyob rau hauv koj phau ntawv nplaub tshev lub tsev qiv ntawv, koj yuav tau ua kom daim nplaub tshev no pom. Koj tuaj yeem nrhiav cov lus qhia rau qhov yuav ua li cas hauv OS X Yuam Suab Koj Phau Ntawv Sau Ntawv .
Thaum koj tuaj yeem nkag mus rau hauv cov ntawv nplaub tshev, rho tawm cov ntaub ntawv saum toj-hais los ntawm kev cab lawv mus rau cov thoob khib nyiab, ces txoj cai-khawm lub pov tseg icon, thiab xaiv khib nyiab.