Flashback trojan reportedly controls half a million Macs and counting

http://arstechnica.com/apple/news/2012/04/flashback-trojan-reportedly-controls-half-a-million-macs-and-counting.ars

by iProject • 14 years ago

179 117 14 years ago

arstechnica.com

dinedal• 14 years ago

Whoa, it aborts infection if you have XCode installed?

Is this just to prevent itself from infecting someone's computer that might be able to study it?

ImprovedSilence4• 14 years ago

That would be my guess. Perhaps it wanted to stay un-detected, and un-reverse engineered as long as possible? It just played the numbers game in terms of time until discovery, and gave Xcode users some respect? Hence deleting itself in the presence of anti-virus software as well?

stcredzero• 14 years ago

It just played the numbers game in terms of time until discovery, and gave Xcode users some respect?

I guess false negative was ok in this case. ;)

Cushman• 14 years ago

That is really clever.

pvarangot• 14 years ago

According to some malware researchers I've talked to it is not unusual to find that kind of hardcoded exceptions. I thought that it was to avoid infecting "clever" users, but they told me sometimes malware coders bundle those to avoid infecting their own computers (or their clients') without being to obvious about it. It's apparently not unusual to also find exceptions for IP blocks of whole countries or ISPs.

signalsignal• 14 years ago

I personally have XCode installed at /Applications/Xcode.app/Contents/MacOS/Xcode, so I ran the command at https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...

I got the "does not exist" result anyway, despite not having any of the software listed installed except for Java.

johnpowell3• 14 years ago

I read that it also aborts and removes itself if Little Snitch is installed.

I take requests from LS pretty seriously so it makes sense that they would do it. I would google the process and port if a random request occured.

joejohnson• 14 years ago

At least it is easy to check if you're infected. According to this tutorial, it's also not difficult to remove the trojan: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb...

philaquilina2• 14 years ago

As someone who used to sell Mac computers, I used to get asked the question "Is it true macs never get viruses?", to which I replied "No that's not true." (It was just an apple reseller store afterall so I was never compelled to bend the facts.) I'd try to explain the caveats a bit: a smaller market share and the unix based operating system requiring more permissions, yada yada, being "prohibitive" to an attack but still vulnerable. Still, for 3 years that question came up a few times a week, even as apple started taking off (2006-2009 ish) and grabbing more and more of the market.

I guess it was just amazing to me how disinformation like that flows so freely. It probably started out with the caveats but eventually got boiled down to "Macs never get viruses". And what computer company is going to publicly correct that statement?

Xuzz• 14 years ago

The interesting part is that I still haven't seen one traditional "virus" — even is thing appears to still be just social engineering users to install it, by pretending to be Flash Player. I can't imagine it's that much more difficult to actually find an OS X vulnerability to propagate with, but I still haven't seen any.

Edit: It appears this uses a Java vulnerability, rather than the fake-Flash Player-installer that it was originally reported using (possibly an older variation of the same malware). So that's no longer accurate!

cooldeal3• 14 years ago

Doesn't it use a Java exploit?

From the article:

>..the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant.

>..the malware installs itself after you visit a compromised or malicious webpage, so if you're on the Internet, you're potentially at risk.

Where is the social engineering part?

FireBeyond2• 14 years ago

And almost no Windows "malware" in the last decade has been a traditional "virus" either. Trojans, social engineering, all so much easier.

rmc3• 14 years ago

The interesting part is that I still haven't seen one traditional "virus"

Originally, when it was just us geeks using computers, 'virus', 'malware', 'trojan', etc. where different terms for different things.

Now a days, 'virus' is used by the general public & media to refer to any sort of bad programme that should be removed.

barista• 14 years ago

Well this had to happen at some point. Though it has a small marketshare and is based on unix, given the kind of demographic that uses a mac, (richer, more connected, etc) it is very lucrative for trojans to infect a mac and steal personal information, identity. It's unfortunate that people have this misunderstanding that macs don't get viruses and are actually not careful when using a mac.

phillco• 14 years ago

Didn't Apple used to claim that Macs didn't get viruses? I can't remember. (This would be at least several years ago, when Mac malware was still fully theoretical.) It's possible they never stated it directly, and the phrase was spread by fans.

To be fair, their slogan is currently "Macs don't get PC viruses" [1]. Which is true. Although, devilishly close enough to blur the two in somebody's mind.

[1] http://www.apple.com/why-mac/better-os/

craigmccaskill• 14 years ago

I was going to post the exact same thing, but spent the last five minutes searching site:apple.com virus for a direct quote. Seems they've changed their lingo as I definitely remember (around the time of the whole mac vs pc campaign) a definite statement about not getting viruses at all.

philaquilina2• 14 years ago

Whoa, no kidding. The majority of people are not going to stop on those two letters and consciously differentiate "virus" from "PC virus."

vacri5• 14 years ago

Given that macs are PCs, being personal computers, it's not true that macs don't get PC viruses.

lawnchair_larry• 14 years ago

For even the most generous interpretations of "several", Mac viruses were not merely theoretical several years ago.

superuser23• 14 years ago

Yes, it is correct that Macs can get viruses. Where people get upset is when you generalize this to say that because >1 virus exists, OSX presents no significant advantage over Windows.

Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage.

OSX is still dramatically safer in terms of your actual risk of a random remote attack. Whether this is economics or superior engineering, or how Windows and OSX stand up to deliberate attackers, I will not pretend to know.

vectorpush3• 14 years ago

Viruses are not a fact of life for Mac users.

Neither are trojans, and that is exactly why this trojan has manifested so successfully. Windows users are mostly hardened to the basic threats of the internet (don't open a random exe etc), and are cognizant of the reality that malicious software does target them. Non-technical Mac users have been lulled into a false sense of security that will eventually make them a more vulnerable target than a Windows user (as Win7 and OSX pretty much stand shoulder to shoulder in terms of security).

OSX is still dramatically safer in terms of your actual risk of a random remote attack.

What is your evidence for this?

vacri5• 14 years ago

OSX is still dramatically safer in terms of your actual risk of a random remote attack.

It certainly was in the WinXP years due to a far superior security model, but I'm curious if this is still the case with modern windows.

jister• 14 years ago

>> Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage.

That's because the market share of Mac is so small that no smart virus developer would even bother wasting their time creating one.

On the other hand, create a powerful virus for Windows and the next day your on CNN.

mkr-hn3• 14 years ago

Malware creators are going to get more creative and more dangerous now that Windows is better and Macs are more popular. Technical countermeasures can only do so much against a determined mind with a strong incentive.

muyuu2• 14 years ago

I've had new Mac users insist that I recommend an antivirus for them. Users who had very safe habits, didn't download basically any software or visit warez sites. They simply - and very sadly IMO - cannot reconcile the idea of a world where AV software is not completely necessary.

They'd only make their computer slower but hey, it's their choice.

dsrguru3• 14 years ago

I don't think small market share was ever really a reason that Mac OS X didn't get traditional viruses. UNIX-based servers have always had a huge market share, and since servers are presumably a more desirable target of infection and cracking than home computers are, we would have seen traditional viruses hit UNIX machines a long time ago if it were realistically doable. Also, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible. But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses. Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering, but I feel it's still not too much of a semantic exaggeration to say "Macs don't get viruses."

felipeota• 14 years ago

There are a lot more Windows desktops than UNIX servers. Just picture that every UNIX server is in average serving more than one Windows machine.

Also, it is way easier to attack a desktop than a server. Desktop users are more careless than server admins and have many more different applications malware can use to gain access: im apps, browsers, media players, pdf viewers, flash runtimes, etc. To attack a server you have to find an exploit using an http, ftp or ssh request to a limited and more secure, in general, set of programs.

Apple is growing very fast and it is finding itself in that position now. You can see that in the new security measures of the Mac App Store. By limiting what apps itself can do you limit what malware gaining access to those apps can do. Maybe Microsoft should have done something similar to prevent Windows from being the virus hub.

cooldeal3• 14 years ago

This virus spreads from visiting malicious websites or websites with malicious ads. Since not much browsing happens on servers, there is no reason to target them.

>lso, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible

What? Does that mean that some Windows viruses were written by Mac fanboys to make Windows look bad?

> But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses

How? Can you explain what you mean by Windows having a unique vulnerability that is not present on a Mac?

> Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering,

Again, this is a drive by exploit from a web page, not social engineering. Why is this so hard to grasp?

jklp• 14 years ago

This both saddens and delights me, as it proves that Macs are now at a large enough market share that malware writers are willing to target that platform ...

aboodman• 14 years ago

To Linux! Quickly now!

beedogs• 14 years ago

In 10 years, I bet most of us will be running Linux on the desktop, actually.

rimantas• 14 years ago

Did not pre X versions of Mac OS have more viruses in the wild with much smaller market share?

TazeTSchnitzel2• 14 years ago

Well, I saw this movie called "The Net" and there was a virus on a Mac.

Then again, that's hollywood.

johnpowell3• 14 years ago

I remember a bunch of Word Macro viruses on pre OS X systems. But I was in high school so I could be mistaken.

smackfu• 14 years ago

From Apple, Mac OS 9: How to Check For Viruses: http://docs.info.apple.com/article.html?artnum=50569

pooriaazimi• 14 years ago

I seriously doubt that 600,000 macs were infected... How do we know this number is correct? Because a completely unknown security firm that sells Mac antivirus software ("Dr. Web", a russian antivirus company) tweeted about it!

fpgeek3• 14 years ago

Fair enough, with one caveat: Everyone who trumpets security/anti-virus company press releases about Android should be required to shout about 600k Macs just as loudly. I wonder how many will.

ralfd• 14 years ago

I also am extremely skeptical.

kokoge• 14 years ago

> completely unknown security firm

Completely unknown? It's on the market almost for 20 years.

sliverstorm2• 14 years ago

It's actually kind of fun when I occasionally get a virus. I always remove them by hand, piece by piece, and tracking them down is a learning experience. It's also amusing seeing some of the clever tricks they pull.

Maybe it's time to get a Mac?

btipling• 14 years ago

What do you learn? What have you ever done with that knowledge?

sliverstorm2• 14 years ago

It teaches about the structure of the registry, and gets your hands in some of the low-level hooks of the system. It mostly teaches you how to remove viruses. I didn't mean to say it was truly practical knowledge; I just enjoy discovery.

alanh3• 14 years ago

I can’t seem to /newpoll — but I would like to see, out of those who run the instructions to check for the virus, how many of us actually had it. (I didn’t.)

johnpowell3• 14 years ago

I didn't, and I installed the JAVA stuff to install CS5.

alanh3• 14 years ago

Of note — if Java is the attack vector, new Macs were not vulnerable by default as they don’t ship with Java installed anymore a/o 10.7 Lion. AFAIK, the biggest reason anyone would have Java is if you’re running Adobe products.

sukuriant• 14 years ago

+ minecraft

cookiecaper• 14 years ago

Or LibreOffice, or Eclipse, or...

Java is plenty widespread. It's a good bet that most systems are going to end up with a JVM on disk somewhere after 6 mo - 1 yr of usage.

alanh3• 14 years ago

I don’t know — those aren’t apps normal people install.

(And: The same people who install Eclipse, Minecraft, LibreOffice, or Photoshop are also more likely to have one of the apps that Flashback avoids co-habitating with: Little Snitch, Xcode, etc.)

buro9• 14 years ago

Well, it's a good thing that designers don't use Macs then.

Oh.

feefie• 14 years ago

I have XCode installed, so I guess I'm safe from this. Do you have any standard advice for how a regular MacOS user should configure their system to be safe? I don't even have anti-virus software installed like I do on my Windows machine, I assumed the Mac OS took care of that (but not if 1/2 million Macs are infected with this thing =/). I do keep the built-in firewall turned on. Is there a website or something that I can go to that will teach me what steps I should take on my MacBook Pro to keep it clean?

jacktoole1• 14 years ago

I personally run chrome and block all plugins by default, and enable them when I think I have a good idea what the plugin is doing. You can then set specific sites that may always run plugins, so it's not overly annoying when on a few flash-heavy sotes. Presumably Safari has a similar option.

Unfortunately Chrome only allows you to "run all plug-ins" on a site or "block all plug-ins", so there's still a possibility of enabling Java when you meant to enable flash to view a video. However, it's probably a good first step against attacks like these.

I also run under a regular user account without direct sudo access, so any action that modifies system files should request an admin password. Jeff Atwood (codinghorror.com) had a good post about this for Windows: http://www.codinghorror.com/blog/2007/06/the-windows-securit...

deet• 14 years ago

Apple includes a lot of third-party software in OS X, and if they don't start patching those packages as promptly as the software maintainers do, exploiting these non-Apple or open source packages could become a common strategy. Attackers can watch other platforms roll out updates before Apple and then target the same software in OS X. Not that the same vulnerabilites will always work, but it's certainly a worry.

This particular exploit is not a great example, since they removed Java by default. But all the other cross-platform software that is included is worrisome if not prompty updated.

pagekalisedown• 14 years ago

That's a good observation. Avoiding GPL3 software, like newer versions of bash and gcc, might have the unintended consequence of putting their users at risk.

rmc3• 14 years ago

I highly highly doubt we'll see a day when there are significant exploits for Joe Soap Mac User from a bug in bash or gcc. Those are not software that Joe Soap is likely to have install (e.g. gcc), or will be hard for a website to run.

Tichy• 14 years ago

What annoys me is that I just found Java to be enabled in Firefox again, when I was pretty sure that I had disabled it before. I suspect that yesterdays update reinstalled it into Firefox. (I could be wrong, though - but I definitely remember starting Safari just for the sake of trying Minecraft, because it was the only one of my Browsers with Java enabled).

TazeTSchnitzel2• 14 years ago

IIRC Mozilla are going to blacklist out-of-date Java versions in FF.

Flashback trojan reportedly controls half a million Macs and counting

Related Stories