Some users writing on the discussion forums of the MacRumors website said they had been infected after downloading the malicious update from the HandBrake website, with one user saying the malware had caused a number of suspicious pop-up windows to appear, asking for a system password. HandBrake’s developers said the affected download mirror has been shut down and is to be rebuilt from scratch. However, versions 0.10.5 and earlier don’t verify updates, meaning they may have automatically installed the infected file. The malicious installer’s checksum hashes don’t match those of the official version, meaning that if users have version 1.0 or later installed the infected update would not have been automatically installed. Read also : Ofcom Hit By MOVEit Extortion Hack
Handbrake software virus password#
If the trojan is found to be present, the procedure for removing it is straightforward, but developers also advised users to change all the passwords that may have been present in MacOS’ Keychain or in browser password stores, as they may have been compromised. Users can detect an infection by searching for a process called “Activity_agent” in MacOS’ Activity Monitor or verifying the checksums of the version of HandBrake they installed. OSX Proton provides attackers with remote access to infected systems, allowing them to potentially steal files, monitor what the user is typing, take screenshots or to carry out other malicious activities, according to security researchers. Hackers replaced the installer file HandBrake-1.0.7.dmg with an infected version that installs a variant of the OSX Proton trojan horse. HandBrake is also available for Windows and Linux, but those versions weren’t affected, developers said. “You have 50/50 chance if you’ve downloaded HandBrake during this period,” the project’s developers wrote in an advisory.
While the primary download mirror and website weren’t affected, the project urged users who downloaded and installed the software last week to check for an infection. The developers of HandBrake, a popular open source software program for copying video from a DVD to computer storage, have warned some MacOS versions of the software were replaced by malware in an apparent hack last week.Īn infected version of the software’s installer was placed on one of the project’s download mirror servers,, and was made available to users from Sunday 2 May to Thursday 6 May, developers said.
0 kommentar(er)
