In-the-wild attack exploits unpatched OS X zero-day vulnerability

Last month, security researcher Stefan Esser published details and proof-of-concept code of a zero-day vulnerability in OS X Yosemite that could allow a hacker to easily escalate their privileges, and take complete control over Mac computers.

Esser chose not to contact Apple about the DYLD_PRINT_TO_FILE vulnerability – which remains currently unpatched in OS X Yosemite, despite it curiously being fixed in the beta version of the next iteration of OS X, El Capitan.

Now, security firm Malwarebytes has discovered an in-the-wild attack exploiting the vulnerability, where root permission is gained on the computer without a password being needed.

According to the firm, the attack installs a version of the VSearch and Genio adware, alongside a copy of the controversial MacKeeper app.

The VSearch adware is frequently hidden within installers for bogus video streamers. Once it has got its claws into your Mac, you will find yourself pestered by pop-up adverts and find your online searches redirected to a different search engine to generate revenue for the attackers.

As a final flourish, according to Thomas Reed of Malwarebytes who analysed the latest attack, users are being directed to an app called Download Shuttle app in the Mac App Store.

It’s worrying to see the vulnerability is now being exploited by bad guys, and the lack of response so far from Apple as to how they expect Yosemite users to protect themselves.

Right now, with no fix currently available from Apple itself, your best course of action may be to trust Stefan Esser – the same guy who made the vulnerability public in the first place.

Esser’s firm SektionEins has released a kernel extension called SUIDGuard that protects computers from the threat. You can download its source code from GitHub.

For more information on the latest attack, check out Thomas Reed’s post on the Malwarebytes blog.

Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at @gcluley, on Mastodon at @[email protected], or drop him an email.