HandBrake OSX/Proton.B Trojan Backdoor (macOS)

#TRUSTED 2b29a6a0b592fc7474ba03f6aed271683c34dfd63ca728a26f3bafaa58d757801eca02652332070016fc19793fc3eb84e52de99573837b7691c1da02da628d0bfe9f4942deaa06bb1699b8715b7053a40c16348803fc07ccfcc5daf11b7733bd1731c0dd89e30cd4e3f7fe5e89fb319bc1902124a033f5c904d621e37fc7c922c1be82aa943ab2a42c94b424430eaec46aee984a6df26d6e02357c547c43c621a51bba5521a6d1e0bd14103abf20b975da3d230748466e483cb706320fb8273781deb734521e562e95e1ffeda9bcadf37b90021d5280f6fe30e926b9f99faf57b9423645e4351fbccc38d63c9ed621b797ceeec405bc2cd43613c3367e0365e3caba3ee95b9f6e0f494da8cf9d87323c5165c4c465a4c37e4edafcb093de25bbdfb110a753cef3721065a470941e35f052ac9196044ceff26bc20dc02e453affd069355bc3146a4476f53015a68ba18aa1685f0da0ec1cd06063a6ceae8523cac3eaff87ce3a8c001adc3a7be6c56677480d33723022088e3f1510211a493c028fa4737976cb884ddd4ddbc6db4384cf060f498498fd1f31332228a84e79329ff7e570b8c642bc998f64c8b9953bc472de05ecae1f1ca05cadadb416ab834d94eaec6e4eb9582243de68a2fddfe42aabef5eb2e0a3f754f2186977c9c3a05335cde5263b59ff5266ec150fdff895acf9a4515d31fd4021f8a85580cd2119d4fb
#TRUST-RSA-SHA256 0f125cab8f51282fb188c23f8e0355b2470cfd8a5f2850792733797ac55d0886ff0b0d63a025fc94bbc57ee8d13081cb4892f8b05bd852b64c758e2c4d7d522cb4372d5f96c754422fe60e0e97927e565876b94f0aa6a14ff96b510e8f939a95bfb76aacefe3e0543c897f7e844a24db2dca5a306083400631e9c116b9dffdc7e5dbcf048757cac221aa2a4477d0123fc2f6aed058f1d1591e76eee7b28fec238c844cfec704a0d4360992e4bedc9df707329cadbe9a27ea497890b5f01b78d5754ee1ce2e0ad88021e118e0b4e111cf1b55b7ee1b33bb2349415bfebbe3669b6ef3962f3a7b388fbe6e0d7be7d5e332f425a253e55bad54d66deff3ec1d9daeefb163050a3de30bd5b6ab9cebe23a14d2c6e8b1309aef0a6c904a38e139d0ae238ddff76215a7c84571acf1dbdffb23340134a10373944c891e0304cdfdb18c7baa831b9878acdfdd2f7c4f1c41c70efe4783af29b94ac47bb984437a78a64e141bafca7f3c4dd4ef73aa105c2daa84f83d95bbc38a5dfa5852102b3823b8f8e0e55f4e39294ca0fdf9139ef5df587d3cfe1ae8f67193ee844b3f78c1e8dfcfbad62b77e7ee9f154a731155b53a1012bbc0b180aa241a4bc448ebbac67c20471a607ab4a90107e86888f9469ad5313764a250e770fe87211cfc56daff53983e6ca498b542516ca79f3b620d49807a55733b6e0cfa2881c236da31af432f1f19
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100128);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");


  script_name(english:"HandBrake OSX/Proton.B Trojan Backdoor (macOS)");
  script_summary(english:"Checks the HandBrake install for a trojanized application.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote macOS or Mac OS X host is
affected by a trojan.");
  script_set_attribute(attribute:"description", value:
"According to its binary checksum, the version of HandBrake installed
on the remote macOS or Mac OS X host is affected by the OSX/Proton.B
trojan backdoor. HandBrake was briefly distributed with the trojan due
to a compromised mirror hosting the software. An unauthenticated,
remote attacker can exploit this to exfiltrate sensitive information,
download malicious files, and execute arbitrary code.");
  script_set_attribute(attribute:"see_also", value:"https://forum.handbrake.fr/viewtopic.php?f=33&t=36364");
  script_set_attribute(attribute:"solution", value:
"To remove the infected application, open the Terminal application and
run the following commands :

  - launchctl unload ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist
  - rm -rf ~/Library/RenderFiles/activity_agent.app

Remove the proton.zip archive from the ~/Library/VideoFrameworks/
folder if it exists, and remove any HandBrake.app installs.
Additionally, it is strongly recommended to change all the passwords
that reside in your OSX KeyChain and browser password stores.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Score based on an in depth analysis by Tenable.");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/05/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:handbrake:handbrake");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2026 Tenable Network Security, Inc.");

  script_dependencies("macosx_handbrake_installed.nbin");
  script_require_keys("installed_sw/HandBrake", "Host/MacOSX/Version", "Host/local_checks_enabled");

  exit(0);
}

include('audit.inc');
include('global_settings.inc');
include('misc_func.inc');
include('install_func.inc');
include('ssh_func.inc');
include('macosx_func.inc');
include('ssh_globals.inc');
include('command_builder.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

get_kb_item_or_exit("Host/MacOSX/Version");

var app_name, install, version, path, homes, vuln, report, cmd, hash, user, home, cmd1, cmd2, res, procs;

app_name = "HandBrake";
install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);
version = install['version'];
path    = install['path'];
dbg::detailed_log(lvl:1, msg:'Install path',
  msg_details:{
    'path':{'lvl':1, 'value':path}
    }
);
# Check path for unexpected chars
if (!command_builder::validate_no_injection_denylist(path))
{
  dbg::detailed_log(lvl:1, msg:'Exiting due to injection attempt in HandBrake install path',
      msg_details:{
        'install path':{'lvl':1, 'value':path}
      }
  );
  exit(1, 'Unexpected characters in HandBrake install path: ' + obj_rep(path));
}

homes = get_users_homes();
if (empty_or_null(homes)) exit(1, "Failed to get list of users' home directories.");
dbg::detailed_log(lvl:1, msg:'User homes',
  msg_details:{
    'homes':{'lvl':1, 'value':homes}
    }
);

vuln = FALSE;
report = "";
# Check HandBrake binary's checksum for infected checksum
cmd = 'shasum -a 1 ' + path + '/Contents/MacOS/HandBrake';
hash = exec_cmd(cmd:cmd);

if (hash && hash =~ 'a8ea82ee767091098b0e275a80d25d3bc79e0cea')
{
  vuln = TRUE;

  report +=
    '\n  Path              : ' + path +
    '\n  Installed version : ' + version +
    '\n  The version of HandBrake installed on the remote host is known' +
    '\n  to contain a trojan.';
}

# Check each user's home directory for files added for malware
# persistence:
#   ~/Library/RenderFiles/activity_agent.app
#   ~/Library/LaunchAgents/fr.handbrake.activity_agent.plist
foreach user (sort(keys(homes)))
{
  home = homes[user];
  if (!command_builder::validate_no_injection_denylist(home))
  {
    dbg::detailed_log(lvl:1, msg:'Exiting due to injection attempt in a user\'s home directory',
        msg_details:{
          'home dir':{'lvl':1, 'value':home}
        }
    );
    exit(1, 'Unexpected characters in a user\'s home directory: ' + obj_rep(home));
  }
  if (home == "/var/empty" || home == "/dev/null") continue;

  cmd1 = strcat('ls "', home, '"/Library/RenderFiles');
  cmd2 = strcat('ls "', home, '"/Library/LaunchAgents');
  res = exec_cmds(cmds:make_list(cmd1, cmd2));

  if ("activity_agent.app" >< res[cmd1] ||
      "fr.handbrake.activity_agent.plist" >< res[cmd2])
  {
      vuln = TRUE;
      report += '\n\n  The following users have the infected files in their' +
                '\n  home directories :';
      if (strlen(res[cmd1]) && "activity_agent.app" >< res[cmd1])
      report += '\n    User : ' + user +
                '\n    File : ' + home + '/Library/RenderFiles/activity_agent.app';

      if (strlen(res[cmd2]) && "fr.handbrake.activity_agent.plist" >< res[cmd2])
      report += '\n    User : ' + user +
                '\n    File : ' + home + '/Library/LaunchAgents/fr.handbrake.activity_agent.plist';
  }
}

# Check for activity_agent in running processes
cmd = 'ps aux';
procs = exec_cmd(cmd:cmd);
if (strlen(procs) && "activity_agent" >< procs)
{
  vuln = TRUE;
  report += '\n\n  The activity_agent process is running on the system.';
}

if (vuln) security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);