The Eleanor malware allows attackers to execute commands and scripts, steal and modify files and take pictures using the webcam Security researchers have found a new backdoor program that allows attackers to hijack Mac systems and control them over the Tor network. The new malware has been dubbed Backdoor.MAC.Eleanor by researchers from antivirus vendor Bitdefender and is distributed as a file converter application through reputable websites that offer Mac software. The rogue application is called EasyDoc Converter. Once installed it displays a fake interface where users can supposedly drag and drop files for conversion, but which in reality doesn’t do anything. In the background, the application executes a shell script that installs multiple malicious components in a folder called “/Users/$USER/Library/.dropbox.” The Dropbox name is used to make the malware harder to spot and has nothing to do with the legitimate Dropbox file synchronization software. The Eleanor malware has three components: a Web service with a PHP application, a Tor hidden service that allows attackers to connect to the affected systems over the Tor anonymity network and an agent that posts the Tor access URLs for infected systems to the Pastebin website. The PHP application served by the Web service is actually a backdoor that allows attackers to view, edit, rename, delete, upload, download and archive files on the system; to execute shell commands and scripts written in PHP, Perl, Python, Ruby, Java and C; to open a reverse shell to the attackers’ server; to connect to MySQL, SQLite and other databases; to view the process list and to send emails with attachments. Another component of this application allows attackers to capture images and videos using the system’s webcam. The Tor component connects the computer to the Tor network and makes its rogue Web service accessible via a .onion URL. This type of URL can only be accessed from within the Tor network. The Pastebin agent takes the system’s .onion URL, encrypts it with an RSA public key and posts it on Pastebin where attackers can find it and use it. The oldest Pastebin post identified by the Bitdefender researchers as being created by the Eleanor backdoor is dated April 19. But the company could not establish the total number of infected machines, because different Eleanor samples upload URLs to different Pastebin accounts and they don’t have all the samples. The good news is that the app is not digitally signed by an Apple-approved certificate, so users will see security warnings on the latest OS X version if they try to install it. On OS X El Capitan (10.11) users would actually need to perform a manual override in order to install the application. Related content analysis BGP: What is border gateway protocol, and how does it work? BGP is how the autonomous networks that make up the internet share routing information to find the best route for IP traffic. CISA describes BGP as 'the most important part of the internet you’ve probably never heard of.' By Keith Shaw May 17, 2024 11 mins Routers Internet Network Security feature Red Hat seeks to be the platform for enterprise AI By Maria Korolov May 17, 2024 12 mins Linux Network Management Software news FCC proposes BGP security measures Protecting the Border Gateway Protocol is as important as protecting the border. By Gyana Swain May 17, 2024 4 mins Regulation Network Security brandpost Sponsored by Zscaler 5 Must-haves for your next DSPM solution Elevating cloud security: Navigating the data storm with DSPM By Kalie Radsmikham, Sr. Director of Product Marketing, Cloud Security May 16, 2024 7 mins Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe