4

Just about every article I read about Cryptowall, Cryptolocker, and its ilk seems to assume that the reader is running some flavor of Windows.

When I Google "ransomware OSX", I get a long list of articles about the FBI Javascript "ransomware". However, this is not really ransomware in the same sense as Cryptowall and Cryptolocker, as it does not actually penetrate outside of the browser, and does not encrypt your files. I would consider this to be the milk snake of the ransomware world.

So is there any true encrypting ransomware that affects Macs?

Improve this question
1

2 Answers 2

Reset to default
1

I would consider this to be the milk snake of the ransomware world.

In that you are right, FBI ransomware is rather a crafted malicious JS code that is more annoying and scaring than penetrating the operating system, and as you can read on the TheSafeMac:

…there is no indication that this is actually Mac malware of any kind. It’s simply an obnoxious browser pop-up, displayed via JavaScript, in an attempt to fool people into paying.

Actually, by the beginning of this year, CISCO announced via its blogs that a new version of Cryptowall(2.0) has appeared. It uses Tor It is even able to run both on 64-bits and 32-bits processors. It affects all versions of Microsoft Windows but also the newer versions of Mac OS X:

It is coded to run on both 32-bit and 64-bit systems, which increases its chances of running on whatever computer it infects, Carter said. Newer versions of Mac OS X and Windows are 64-bit operating systems.

Improve this answer
3
  • So, have there been any confirmed cases of Cryptowall infecting a 64-bit version of OSX?
    – alexw
    Aug 7, 2015 at 17:39
  • 1
    @alexw Good question. Actually, I mentioned 2 links stating that it affects newer versions of Mac OS x, I can add you this and many others, but I did not hear yet for a successful infection on this OS, as well as I did not hear that this new version of Cryptowall infected users of Microsoft Windows
    – user45139
    Aug 7, 2015 at 17:43
  • @Begueradj – Technically the article states that the new version can run on both 32-bit and 64 bit and then goes on to say that the latest version of Mac OS X is a 64-bit operating system. The language seems to be written in a way that a reader would infer then that this will affect Macs as well but I think that it makes things clear as mud.
    – Styledev
    Jan 28, 2016 at 2:43
4

Yes, now there is a confirmed and well documented case of ransomware specifically targeting Mac OS X. It was named "KeRanger" and was distributed through a breach of the Transmission Bittorrent Client website.

http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

Some basic OS X security features (Gatekeeper) had been circumvented by using a valid developer certificate. Apple has since revoked that certificate and updated it's XProtect signature list, but obviously this happened after the malware had already done damage.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .