Malware

Handbrake’s Server Compromised, Download Installs Complex Trojan

Posted on May 7th, 2017 by

Handbrake’s Server Compromised, Download Installs Sophisticated Trojan

Handbrake, a popular open source video encoder, posted on its forums this weekend saying that their mirror download server was compromised. Anyone who downloaded Handbrake between May 2 and May 6 potentially grabbed a version that was infected with malware. Intego VirusBarrier anti-virus identifies and eradicates this malware as OSX/Proton.B.

What is the infection vector?

Only those that downloaded Handbrake from their mirror server (download.handbrake.fr) received the malicious application. It was not distributed on any other websites.

How does Proton install?

The Handbrake application arrives in a .dmg file as expected, and upon opening the file, nothing suspicious can be seen. The user will drag Handbrake to their Applications folder and launch it.

At this point, the application does something unusual, which will immediately stick out to long time Handbrake users: It asks for administrator privileges. Under the guise of needing to install additional codecs, a malicious payload is installed instead.

Handbrake malware install

Once the password is entered, Handbrake will launch and it appears to be business as usual. In the background, however, a backdoor was installed, named "activity_agent." The backdoor was observed contacting 85.17.25.66, which is the IP address that hosts the handbrake website. The compromised server could have been used as a Command and Control (C&C) server as well.

The backdoor application activity_agents is placed in Users > *your user* > Library > RenderFiles, and it is kept alive through restarts with a simple LaunchAgent.

Keychain data, Safari stored form data, and Safari cookies are collected, compressed and stored on the system for later upload. The activity_agent does not appear to upload or download any data during our testing. Google Chrome, Firefox, Opera and likely other browsers are raided for sensitive information.

Should Mac users be concerned about Proton?

The malicious payload runs on any Mac with OS X 10.7 or newer.

At the time of writing, the malware does not appear capable of uploading the sensitive user data to its server, but we should assume that it did successfully do so in the May 2-6 timeframe. Handbrake offers the following advice in its forum post:

Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores.

Good advice seeing as all the stored names, passwords, form data, and more, could now be in the hands of the bad guys.

Handbrake notified Apple whom late afternoon added the signature to its XProtect database as OSX.Proton.B. Unfortunately, even with the latest XProtect update in place, Proton still installed and ran just fine, though some other researchers have reported that XProtect did in fact stop the DMG from being opened. However, without a server to offload its collected data to, it is currently not a major threat.

What is worrying, however, is the way the attackers went about this. As with Transmission, not once but twice, the download server was compromised and the application available for download was replaced with a malicious one. Going after servers, which are typically not updated or patched as often as they should be, will result in less users downloading your malware, but the fact that it comes from a trusted source will make those users not suspicious at all. If a user is not suspicious, they won't go looking for malware, and malware that goes undetected longer is typically more successful.

If this becomes a trend, and even the servers of the trusted source can no longer be trusted, we may very well be in trouble.

One way to verify if the file you downloaded is the real deal, is by comparing checksums. In Handbrake's case, they maintain a page that lists all the checksums for available downloads, so anyone can verify the download is compromised. In reality, very few people actually do this, and a lot of websites that distribute software don't even offer these checksums for you to verify. Apple used to offer these checksums on their downloads page, but has since stopped doing so as well.

For websites that do offer these checksums, verification is easy. Open the Terminal application (Applications > Utilities) and type the following (include a space at the end):

openssl sha1

Now, simply drag and drop the downloaded file onto the Terminal window and hit enter. In the case of the malicious Handbrake download, this is the result:

intego$ openssl sha1 /Users/intego/Desktop/HandBrake-1.0.7.dmg
SHA1(/Users/intego/Desktop/HandBrake-1.0.7.dmg)= 0935a43ca90c6c419a49e4f8f1d75e68cd70b274

According to the Handbrake website the SHA1 checksum for this download should be "75c6204d7bd7d9c6e5b1fedb56697ae2f3857789," they clearly do not match up. If any user got infected with Proton through Handbrake, they did not run this simple security check.

How to tell if your Mac is infected (and removal instructions)

Open Activity Monitor and search for a process named "Activity_agent." If this process is running, your Mac is infected.

Click the process, and then close it with the X button in the menu bar.

To clear the infection off your Mac, browse to the following folders and trash the following files:

  • Applications - Delete the Handbrake application.
  • Users > *you* > Library > VideoFrameworks - Delete this folder and everything in it
  • Users > *you* > Library > RenderFiles - Delete the activity_agent application
  • Users > *you* > Library > LaunchAgents - Delete "fr.handbrake.activity_agent.plist" and "fr.handbrake.activity_agent.plist-e"
  • Users > *you* > Library > Caches > fr.handbrake.activity_agent - Delete the folder

With those files deleted, empty the trash and restart your Mac. Double-check the same locations again after the restart to ensure the infection is indeed cleared. If a warning shows that some items cannot be deleted, because they are in use, you'll be able to empty the trash after the restart.

For Intego's Mac anti-virus customers, protection comes in the form of updated malware definitions, which will detect and remove all of the Proton files. Proton components are detected by Intego VirusBarrier as OSX/Proton.B.

How to protect yourself from Proton

When the official server of the trusted source has been compromised, and the malware is coded to act much like the real application, there is very little to warn you something is amiss. Verifying your downloads will be the only way you can be sure the download was not compromised. Using the built-in updater, if an application provides one, is typically the best way to receive updates for an application.

There is much still to be discovered about Proton.B as it is far more complex than it appears. This malware is still under investigation and as new details emerge we will update this story.

About Jay Vrijenhoek

Jay Vrijenhoek is an IT consultant with a passion for Mac security research. He conducts independent malware protection tests, and also writes about privacy and security related matters on his blog Security Spread. Follow him on Twitter at @SecuritySpread. View all posts by Jay Vrijenhoek →
  • tetardbleu

    It seems that some crossover mac files ” are (wrongfully i hope/guess) detected as infected by this malware. i hope this is just a definitions issue…

  • Keith R McDaniel

    I ran a check earlier today and Virus Barrier flagged a file in VMWare Fusion as infected with OSX/Proton.B. It was Applications > VMWare Fusion.app > Contents > Library > isoimages > tools-key.pub I did not download handbrake to my knowledge nor see its .dmg. I didn’t see any of the files mentioned here. After letting Virus Barrier repair the file, which then read 0 bytes, I trashed the VMWare Fusion app. I do have 2 folders named HandBrake and HandBrake71 but they have creation dates from 2011 and 2012. Maybe they were from VLC Lan or Mamp?

  • Selena

    Thanks you Jay. I think we should be on the alert for the potential risks of the freeware like HandBrake. Freeware is problematic because its users are always changing and its developer may not have offered enough defensive support to the program.To ensure the safety, it is better to avoid freeware. You can try some HandBrake alternatives such as MacX Video Converter Pro or MakeMKV.

  • Wyanita Seinen

    Hi Jay – I’m a novice computer user and have been doing lots of research on how to take our DVD collection and move all to digital.

    Many articles suggest hand brake, your arcticle on the process was incredible helpful. So I went to look at starting and found this Trojan warning on the website.

    As someone that blindly assumed what I was told that macs can not get viruses. How does one go about knowing their download is safe?

    This find made me want to go back to my App Store ways and not venture out of my safe little box.

Sign up For Our Newsletter

Get the latest Mac security news direct to your inbox.

{"url":"\/marketo\/json\/add-to-newsletter","data":"list_name=Blog Roadblock"}