11 ms·
Flashback trojan reportedly controls half a million Macs and counting
- dinedal 15y agoWhoa, it aborts infection if you have XCode installed? Is this just to prevent itself from infecting someone's computer that might be able to study it?
- ImprovedSilence 15y agoThat would be my guess. Perhaps it wanted to stay un-detected, and un-reverse engineered as long as possible? It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? Hence deleting itself in the presence of anti-virus software as well?
- stcredzero 15y agoIt just played the numbers game in terms of time until discovery, and gave Xcode users some respect? I guess false negative was ok in this case. ;)
- ImprovedSilence 15y agoHaha, yeah, I wrote the sentence as it appeared in my head, realized it was incomplete and would make no sense to anyone, then just kinda slid the rest in....
- Cushman 15y agoThat is really clever.
- pvarangot 15y agoAccording to some malware researchers I've talked to it is not unusual to find that kind of hardcoded exceptions. I thought that it was to avoid infecting "clever" users, but they told me sometimes malware coders bundle those to avoid infecting their own computers (or their clients') without being to obvious about it. It's apparently not unusual to also find exceptions for IP blocks of whole countries or ISPs.
- signalsignal 15y agoI personally have XCode installed at /Applications/Xcode.app/Contents/MacOS/Xcode, so I ran the command at https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash... I got the "does not exist" result anyway, despite not having any of the software listed installed except for Java.
- johnpowell 15y agoI read that it also aborts and removes itself if Little Snitch is installed. I take requests from LS pretty seriously so it makes sense that they would do it. I would google the process and port if a random request occured.
- joejohnson 15y agoAt least it is easy to check if you're infected. According to this tutorial, it's also not difficult to remove the trojan: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb...
- philaquilina 15y agoAs someone who used to sell Mac computers, I used to get asked the question "Is it true macs never get viruses?", to which I replied "No that's not true." (It was just an apple reseller store afterall so I was never compelled to bend the facts.) I'd try to explain the caveats a bit: a smaller market share and the unix based operating system requiring more permissions, yada yada, being "prohibitive" to an attack but still vulnerable. Still, for 3 years that question came up a few times a week, even as apple started taking off (2006-2009 ish) and grabbing more and more of the market. I guess it was just amazing to me how disinformation like that flows so freely. It probably started out with the caveats but eventually got boiled down to "Macs never get viruses". And what computer company is going to publicly correct that statement?
- Xuzz 15y agoThe interesting part is that I still haven't seen one traditional "virus" — even is thing appears to still be just social engineering users to install it, by pretending to be Flash Player. I can't imagine it's that much more difficult to actually find an OS X vulnerability to propagate with, but I still haven't seen any. Edit: It appears this uses a Java vulnerability, rather than the fake-Flash Player-installer that it was originally reported using (possibly an older variation of the same malware). So that's no longer accurate!
- cooldeal 15y agoDoesn't it use a Java exploit? From the article: >..the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant. >..the malware installs itself after you visit a compromised or malicious webpage, so if you're on the Internet, you're potentially at risk. Where is the social engineering part?
- mbreese 15y agoWell, it does have to get the user's permission to install it first... From the F-Secure site: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb... On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done. If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.
- jklp 15y agoThis both saddens and delights me, as it proves that Macs are now at a large enough market share that malware writers are willing to target that platform ...
- aboodman 15y agoTo Linux! Quickly now!
- beedogs 15y agoIn 10 years, I bet most of us will be running Linux on the desktop, actually.
- ImprovedSilence 15y agoCuz I haven't heard that for the past 15 years.... But as a recent convert to the Linux desktop, I kinda hope so.
- Herring 15y agoMy guess is it will be a 3 ghz quad-core android phone that docks on your monitor & wirelessly connects to everything else.
- ImprovedSilence 15y agoI hope so. I really really hope so. That's the direction I see computing going in the future, despite all the haters that say a tablet/phone will never replace the "desktop"
- vacri 15y agoYou'll need to kickstart Moore's Law again.
- nathannecro 15y ago
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- pooriaazimi 15y agoI seriously doubt that 600,000 macs were infected... How do we know this number is correct? Because a completely unknown security firm that sells Mac antivirus software ("Dr. Web", a russian antivirus company) tweeted about it!
- fpgeek 15y agoFair enough, with one caveat: Everyone who trumpets security/anti-virus company press releases about Android should be required to shout about 600k Macs just as loudly. I wonder how many will.
- ralfd 15y agoI also am extremely skeptical.
- kokoge 15y ago> completely unknown security firm Completely unknown? It's on the market almost for 20 years.
- sliverstorm 15y agoIt's actually kind of fun when I occasionally get a virus. I always remove them by hand, piece by piece, and tracking them down is a learning experience. It's also amusing seeing some of the clever tricks they pull. Maybe it's time to get a Mac?
- btipling 15y agoWhat do you learn? What have you ever done with that knowledge?
- sliverstorm 15y agoIt teaches about the structure of the registry, and gets your hands in some of the low-level hooks of the system. It mostly teaches you how to remove viruses. I didn't mean to say it was truly practical knowledge; I just enjoy discovery.
- alanh 15y agoI can’t seem to /newpoll — but I would like to see, out of those who run the instructions to check for the virus, how many of us actually had it. (I didn’t.)
- johnpowell 15y agoI didn't, and I installed the JAVA stuff to install CS5.
- alanh 15y agoOf note — if Java is the attack vector, new Macs were not vulnerable by default as they don’t ship with Java installed anymore a/o 10.7 Lion. AFAIK, the biggest reason anyone would have Java is if you’re running Adobe products.
- sukuriant 15y ago+ minecraft
- cookiecaper 15y agoOr LibreOffice, or Eclipse, or... Java is plenty widespread. It's a good bet that most systems are going to end up with a JVM on disk somewhere after 6 mo - 1 yr of usage.
- alanh 15y agoI don’t know — those aren’t apps normal people install. (And: The same people who install Eclipse, Minecraft, LibreOffice, or Photoshop are also more likely to have one of the apps that Flashback avoids co-habitating with: Little Snitch, Xcode, etc.)
- shelfu 15y agoMinecraft is _hugely_ popular with anybody under 14. To the point that it's no longer only nerdy parents that showed their kids it, it's kids hearing about it from other kids. It's simple to buy and install and get working. There is no reason to assume that Mac users running Minecraft are going to also have Xcode or Little Snitch.
- buro9 15y agoWell, it's a good thing that designers don't use Macs then. Oh.
- feefie 15y agoI have XCode installed, so I guess I'm safe from this. Do you have any standard advice for how a regular MacOS user should configure their system to be safe? I don't even have anti-virus software installed like I do on my Windows machine, I assumed the Mac OS took care of that (but not if 1/2 million Macs are infected with this thing =/). I do keep the built-in firewall turned on. Is there a website or something that I can go to that will teach me what steps I should take on my MacBook Pro to keep it clean?
- jacktoole1 15y agoI personally run chrome and block all plugins by default, and enable them when I think I have a good idea what the plugin is doing. You can then set specific sites that may always run plugins, so it's not overly annoying when on a few flash-heavy sotes. Presumably Safari has a similar option. Unfortunately Chrome only allows you to "run all plug-ins" on a site or "block all plug-ins", so there's still a possibility of enabling Java when you meant to enable flash to view a video. However, it's probably a good first step against attacks like these. I also run under a regular user account without direct sudo access, so any action that modifies system files should request an admin password. Jeff Atwood (codinghorror.com) had a good post about this for Windows: http://www.codinghorror.com/blog/2007/06/the-windows-security-epidemic-dont-run-as-an-administrator.html http://www.codinghorror.com/blog/2007/06/the-windows-securit...
- deet 15y agoApple includes a lot of third-party software in OS X, and if they don't start patching those packages as promptly as the software maintainers do, exploiting these non-Apple or open source packages could become a common strategy. Attackers can watch other platforms roll out updates before Apple and then target the same software in OS X. Not that the same vulnerabilites will always work, but it's certainly a worry. This particular exploit is not a great example, since they removed Java by default. But all the other cross-platform software that is included is worrisome if not prompty updated.
- pagekalisedown 15y agoThat's a good observation. Avoiding GPL3 software, like newer versions of bash and gcc, might have the unintended consequence of putting their users at risk.
- rmc 15y agoI highly highly doubt we'll see a day when there are significant exploits for Joe Soap Mac User from a bug in bash or gcc. Those are not software that Joe Soap is likely to have install (e.g. gcc), or will be hard for a website to run.
- el_presidente 15y agoI think they install bash by default, not sure if they use gcc's libstdc++.
- Tichy 15y agoWhat annoys me is that I just found Java to be enabled in Firefox again, when I was pretty sure that I had disabled it before. I suspect that yesterdays update reinstalled it into Firefox. (I could be wrong, though - but I definitely remember starting Safari just for the sake of trying Minecraft, because it was the only one of my Browsers with Java enabled).
- TazeTSchnitzel 15y agoIIRC Mozilla are going to blacklist out-of-date Java versions in FF.