Mac malware intercepts encrypted web traffic for ad injection

guest · Oct 24, 2018

Mac malware intercepts encrypted web traffic for ad injection
October 24, 2018
https://blog.malwarebytes.com/threa...cepts-encrypted-web-traffic-for-ad-injection/

Last week, Malwarebytes researcher Adam Thomas found an interesting new piece of Mac malware that exhibits some troubling behaviors, including intercepting encrypted web traffic to inject ads.

[...] the malware installs an open-source program called mitmproxy. According to the mitmproxy website, the software “can be used to intercept, inspect, modify, and replay web traffic.”

The software is designed to use this capability to modify web traffic for the purpose of injecting JavaScript into every page.
Implications
This adware, at first glance, seems to be fairly innocuous, since it’s just injecting a script that serves up advertisements. Looks can be deceiving, though. Since that script is being loaded from a server, that server’s content could change at any time.
[...] The injected script could be used to do anything, from mining cryptocurrency to capturing browsing data to keylogging and more.
Click to expand...

ProTruckDriver · Oct 24, 2018

Thank you @mood for the heads up on this one.

Log in or Sign up

Mac malware intercepts encrypted web traffic for ad injection

guest Guest

ProTruckDriver Registered Member

Log in or Sign up

Mac malware intercepts encrypted web traffic for ad injection

guest Guest

ProTruckDriver Registered Member

Useful Searches