Forest Global Training Partners

Cyber Risks · Cisco Talos

Fun with Shell Scripts and OS X

Summary: Cisco Talos analyzed an OS X malware sample called RSPlug, a script a user is tricked into running with no exploit or internal propagation, whose end result is overwriting DNS entries to perform redirects and man-in-the-middle attacks. The scripts hide their payloads by reversing lines in place with tail -r, uuencoding, and a simple substitution cipher that turns the string ml.pll.oop.pk into the IP address 85.255.112.24, then use grouped here documents to pipe scutil commands that find the PrimaryService ID and update the system's DNS servers.

What's compelling: The final payload rewrites an OS X machine's default DNS servers to 85.255.112.24, which puts every subsequent lookup in an attacker's hands. Talos notes RSPlug had been around for a few months and was in the news again, and detection is limited to Snort sids 15563, 15564, and 15565 plus ClamAV's OSX.rsplug signature.

Read the original at Cisco Talos ↗

Topics
Malware
Related