The HandBrake for Mac Supply Chain Attack

What happened

Attackers replaced the genuine HandBrake 1.0.7 DMG on the mirror download.handbrake.fr with a trojanized copy. BleepingComputer reports that the bad file was online from 2 May 2017 at 14:30 UTC until 6 May 2017 at 01:00 UTC. Intego reports public disclosure on 7 May 2017.

The trojanized DMG looked like HandBrake. On first launch it asked for administrator rights and said it needed to install codecs. Intego names the backdoor activity_agent and says it targets OS X 10.7 or newer. The malware is a variant of the Proton RAT for macOS.

Malwarebytes also reports that the Homebrew package manager served the bad download. The malware talks to servers on handbrake.biz. Malwarebytes reports that this domain was registered on 29 April 2017, three days before the swap.

The malware steals data. It writes archives of stolen data into a folder named VideoFrameworks in the user library. Malwarebytes lists several archives there, plus one master archive named proton.zip.

BleepingComputer reports that users who updated through the built-in updater were safe, because that updater checks a DSA signature (available since version 0.10.6).

Affected versions

• HandBrake for Mac 1.0.7, only the DMG downloaded from download.handbrake.fr between 2 May 2017 14:30 UTC and 6 May 2017 01:00 UTC.
• Installs through Homebrew in the same period (Malwarebytes).
• Not affected: users who updated through the app's own updater, which checks a DSA signature (BleepingComputer).
• Not affected: HandBrake downloads from before or after the window.

Indicators of compromise

• Malicious DMG SHA1: 0935a43ca90c6c419a49e4f8f1d75e68cd70b274 (Intego).
• Genuine DMG SHA1: 75c6204d7bd7d9c6e5b1fedb56697ae2f3857789 (Intego).
• Malicious DMG SHA256: 013623e5e50449bbdf6943549d8224a122aa6c42bd3300a1bd2b743b01ae6793 (BleepingComputer).
• Launch agent: ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist
• Malware app: ~/Library/RenderFiles/activity_agent.app
• Cache folder: ~/Library/Caches/fr.handbrake.activity_agent (Intego).
• Stolen data archive: ~/Library/VideoFrameworks/proton.zip
• A process named Activity_agent in Activity Monitor.
• Network: api.handbrake.biz, handbrake.biz, and IP address 85.17.25.66.

How to check

You can check for the malware files and compare the checksum of any saved HandBrake DMG. Run these commands in Terminal. Each command only reads files.

ls -l ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist ~/Library/RenderFiles/activity_agent.app ~/Library/VideoFrameworks/proton.zip

shasum ~/Downloads/HandBrake-1.0.7.dmg

If any of the first three paths exist, treat the Mac as infected. If the SHA1 equals 0935a43c...b274, the DMG is the trojanized copy. The genuine DMG gives 75c6204d...7789.

What to do now

1. Disconnect the Mac from the network if any indicator is present.
2. Unload the launch agent: launchctl unload ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist (BleepingComputer).
3. Delete ~/Library/RenderFiles/activity_agent.app, the launch agent file, the cache folder, and the VideoFrameworks folder if it holds proton.zip.
4. Delete every copy of HandBrake.app that came from the bad DMG, then install a clean version from the official site.
5. Change every password stored in the keychain and in browser password managers. Do this from a clean device. The malware took an admin password, so treat that password as stolen too.
6. Run a malware scan. Malwarebytes detects the threat as OSX.Proton. For a Mac that held sensitive data, a full reinstall is the safest option.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 75

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    HandBrake.app
           It now reads saved passwords and access keys. It did not before.

Sources

1. malwarebytes.com/blog/news/2017/05/handbrake-hacked-to-drop-new-variant-of-proton-malware
2. bleepingcomputer.com/news/security/website-of-handbrake-app-hacked-to-spread-proton-rat-for-mac-users/
3. intego.com/mac-security-blog/handbrakes-server-compromised-download-installs-complex-trojan/