To follow up on our post last Friday, I was contacted by the author of the DarkComet RAT Trojan. He seemed quite upset that I suggested the new Mac OS X Trojan BlackHole RAT was related to his Windows creation.
While the BlackHole RAT Trojan seems to be copying the behavior of DarkComet, the lack of functionality and the unsophisticated user interface clearly offended the author, who felt it was necessary to set the record straight.
To make a point, DarkComet’s author acknowledges that he is developing his own Mac OS X Trojan, called DarkCometX, that is not yet finished. He provided the following screenshot.
14/6/2014 DarkComet RAT 5.3.1 Tutorial Portforwarding + Firewall + DNS 2020 - Duration: 13:00. +cs.tribal 109,249 views. Kevin Mitnick: Live Hack at CeBIT Global Conferences 2015 - Duration: 1. The darkComet source code is freely available, so it looks like BlackHole's author simply took that code and tweaked it so it would run on the Mac, Wisniewski said.
Learning of two Mac OS X Trojans in less than a week was, admittedly, a bit of a surprise. Technically, in and of itself, writing a Trojan is not illegal. It’s all in what you do with it.
Looking at the code and descriptions, though, I think it is clear what the authors expect you to do with their “products.”
BlackHole RAT includes text saying things like
'I am a Trojan Horse, so i have infected your Mac Computer. I know, most people think Macs can't be infected, but look, you ARE Infected!'
and
'So, Im a very new Virus, under Development, so there will be much more functions when im finished.'
This hardly sounds like a legal use to me.
Likewise, DarkComet RAT’s author states “This software allow you to make hundreds of functions stealthly and remotely without any kind of autorisation in the remote process.” and references the term “Bot Shell” in his Mac OS X development build.
Some folks provided feedback that I had used the acronym RAT incorrectly, saying it stands for Remote Access Tool, not Remote Access Trojan. While the authors would like you to believe they are simply tools, I think the evidence suggests Trojan is more appropriate.
Darkcomet For Mac Os
If you are interested in what you can do to protect your Mac, check out Ben Jupp’s Mac OS X security tips part 1, part 2 and part 3 and download our free Sophos Anti-Virus for Mac Home Edition.
Creative Commons image of Rat Fink courtesy of Jennifer Ennis’s Flickr photostream.
So it’s about time we take off that security blanket that says “Macs don’t get viruses!” That use to be true because Windows had more of a market share so hackers didn’t spend time on it. Since times are changing and Macs are getting more publicity it’s time to start attacking them.
Sophos has reported a new “in development” Trojan that’s made specifically to attack Mac machines.
The Trojan name from Sophos is OSX/MusMinim-A but the nameless developer calls it Blackhole RAT after the open sourced darkComet RAT that use to plague Windows users.
The biggest threat from MusMinim appears to be its ability to display fake prompts to enter the system’s administrative password. This allows the malware to collect sensitive user and password data for later use.
The Trojan also allows hackers to run shell commands, send URLs to the client to open a website, and force the Mac to shut down, restart, or go to sleep arbitrarily. Other “symptoms” include mysterious text files on the user’s desktop and full screen alerts that force the user to reboot.
This could explain why Apple has called in security consultants to look at the PreReleased 10.7 Lion. Just goes to show, all computers are attacked equally.
Darkcomet For Android
Incoming search terms:
Darkcomet For Macbook
- blackhole rat 3 download
- BlackHole RAT 3
- blackhole rat v3 download