Apple Snubs Firm That Discovered Mac Botnet

http://www.forbes.com/sites/andygreenberg/2012/04/09/apple-snubs-firm-who-discovered-mac-botnet-tries-to-cut-off-its-server-monitoring-infections/

by VuongN • 14 years ago

131 87 14 years ago

forbes.com

mrich3• 14 years ago

How long will it take to change the mindset at Apple to think about security before shipping? Microsoft did their job years ago, now Apple has to follow.

How long will it take for Mac users to learn that viruses are indeed a threat on all kinds of computers, not just PCs? I can only hope Apple will take a more active role in educating them.

hej• 14 years ago

I'm guessing Apple's plan involves Gatekeeper (coming soon) and not shipping OS X with Java and Flash by default (already implemented, but installing both is ridicoulously easy). I'm not sure how teneable and wise that is, though.

LinaLauneBaer• 14 years ago

I agree - but there is a catch: Gatekeeper will help to prevent things like that. The default mode in Mountain Lion is only to allow to run apps downloaded from the App Store and/or signed by a developer whose certificate can be revoked by Apple at any time. This will prevent at least the spreading of malicious software components after it has been discovered. And this is the point... Apple needs to react faster and malicious software has to be detected first - otherwise a revoking system makes little sense...

thoradam• 14 years ago

> and not shipping OS X with Java

That won't help the people who actually use Java on OS X. It would be better to allow Oracle to manage the updates for Java on OS X, the vulnerability that Flashback abused was patched by Oracle back in February.

dubya• 14 years ago

Is Apple getting dinged for Java installation being too easy? That seems pretty easy to fix. Having Java on by default in Safari was a bad choice (just like disk images and packages last year). I hope they'll do a scan and remove with Software Update soon, if that's possible.

rbarooah10• 14 years ago

What do you think Microsoft has done that Apple has not?

mrich3• 14 years ago

Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore).

Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize.

An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this:

http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...

munin• 14 years ago

the easier question to ask is what HASN'T Microsoft done?

quick example: they paid millions possibly tens of millions for the best people from industry and academia to build automatic bug searching tools. these tools currently define state of the art for finding bugs in applications.

they also have a community outreach program where they will work with companies and individuals that report flaws. that same outreach program will work internally with the relevant product groups to get flaws fixed.

oh and also they invest constantly in improvements to their toolchain and operating system runtime to make exploitable bugs harder (safeSEH, ASLR, DEP, GS cookies, EMET, encoded pointers, safe-unlinked heaps both in user and kernel mode, etc).

and yet, you realize, there are still exploitable bugs. in my opinion you should regard this as the fundamental instability of system software written in C. if microsoft can't get that right (in terms of security and stability), after all that they've invested, who can?

blub3• 14 years ago

Releasing security fixes in a timely manner for one.

This Java exploit was fixed for a long time before Apple so graciously bestowed a fix upon us. Then there's that SSL certificate SNAFU where I had to fix Safari myself, after almost all companies had already issued updates. Too bad that was not possible on iOS, where you just had to sit around and twiddle your thumbs.

dguido3• 14 years ago

... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it.

The next best thing they'll have to do is, when they install it, disable the web plugin in Safari by default or add an interstitial that prompts the user for it to run.

One 500k node botnet really is not that large in the grand scheme of things.

justinschuh4• 14 years ago

I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call.

And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.

Dylan168072• 14 years ago

I don't understand what the difference is between having java default-installed and installing java on demand. Both methods run a jar when it shows up, right?

blub3• 14 years ago

They have? This is like making a house burglar-proof by bricking the doors. You just cut a small hole when you want to get out... and why would you want to get out, it's so nice inside!

reirob• 14 years ago

Well according to the article the did not. Here the quote:

"The bug was patched by Oracle in February, but Apple didn’t fix the flaw until earlier this month. “Their response should have been much earlier when they should have updated their Java,” says Sharov"

nirvana5• 14 years ago

Can you name a single mac virus that has infected a significant number of machines in the wild since the mid 1990s?

Note a Trojan, is not the same thing as a virus. A virus self propagates, a trojan propagates when a user overrides a security warning.

Viruses have been a problem for Windows for decades, but not a problem on macs, since the late 1980s, possibly early 1990s.

SpiderX• 14 years ago

I think that's more to do with "herd immunity" than anything else. There haven't been enough macs communicating with macs to have widespread damage from a mac virus.

blub3• 14 years ago

"Hey, this trojan has stolen our CC numbers, photos and personal documents, but at least it's not a virus! THAT would have been really bad...".

And please try to keep up with the latest developments, this trojan requires no user intervention. Not running Little Snitch + antivirus at this point is just ignorant and asking for it.

huxley• 14 years ago

Good job on Dr. Web on finding this and trying to do the right thing but these quotes give a different context than you'd get from the article title and lede:

"Sharov believes that Apple’s attempt to shut down its monitoring server was an honest mistake."

"In Apple’s defense, it may not have recognized Dr. Web as a credible security firm when the company contacted Apple earlier this month–I hadn’t heard of the firm either until its discovery and analysis of the Flashback botnet."

It looks like Apple wasn't the only one surprised by this:

"But the better-known security firm Kaspersky confirmed Dr. Web’s findings on Friday. A Kaspersky representative said it hadn’t contacted Apple with its findings and hadn’t had any direct communication with the company, and Kaspersky researcher Kurt Baumgartner wrote in a statement that 'from what we’ve seen, Apple is taking appropriate action by working with the larger internet security community to shut down the Flashfake [also known as Flashback] C2 domains. Apple works vigorously to protect its brand and wants to rectify this.'"

varjag• 14 years ago

Oh, Kaspersky couldn't be possibly surprised by existence of Dr. Web. The company is well established and has good market share in the former USSR. I remember using their products back in 1999 or so.

ig1• 14 years ago

The first quote is from the forbes writer and not Kaspersky.

someone13• 14 years ago

Yeah, Dr. Web is very well-known in Russia, and among the wider security community. They have some very talented people working for them, and, as far as I know, Dr. Web is still one of the only AVs that can disinfect the Rustock.C rootkit/virus successfully.

mindstab• 14 years ago

That kind of "we didn't know" will only get you so far in this day and age where 1 second on google will get you a wikipedia page on dr web saying they've been around since 1992.

The world is bigger than firms who are big in america and that kind of american centric thinking also won't go down well on the web.

dasil003• 14 years ago

It's not American-centric thinking, it's Apple being Apple.

lawnchair_larry2• 14 years ago

American centric? You realize Kaspersky is Russian as well?

cube13• 14 years ago

But once you dig down, it becomes a less rosy picture for Dr. Web. The citation for the 1992 date doesn't actually appear to contain that information. It's a bunch of rather poorly written(perhaps by non-English speakers) reviews that don't actually give much useful information about the company or product. Secondly, the website that posted all the test results has not had any activity for over a year.

Their download.com cleaner software has not been updated since 2010.

Finally, a Google search comes up with their main website, wikipedia page, news stories with about their discovery, and several other links to sites that feel like antivirus phishing pages rather than legitimate links.

All-in-all, there isn't enough content to really judge them as absolutely trustworthy. It's really a brand recognition issue in a space where trust is absolutely key in evaluating claims. Kaspersky has the brand and trust worldwide. Dr. Web appears to have it in Russia, but not nearly as much outside of the country.

swatkat• 14 years ago

I am surprised that author of the article wasn't aware of Dr. Web! Well, I had an impression that any self-respecting security expert will be aware of "Russian big two". Dr. Web is very well known, especially for their powerful malware detection and removal engine. I always keep Dr. Web CureIT handy in USB sticks.

recoiledsnake• 14 years ago

>“For Microsoft, we have all the security response team’s addresses,” he says. “We don’t know the antivirus group inside Apple.”

Does Apple even have an antivirus group?

coob2• 14 years ago

They definitely have people working on OS X's malware protection (XProtect). The definitions file can be found at /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist (Flashback A/B/C are in there for me).

ravivyas3• 14 years ago

The biggest problem is as long as people think Macs are secure... they will never be.

nirvana5• 14 years ago

Which is why there are botnets of millions upon millions of Macs out there infected by viruses, while its really big news that a trojan manages to get 600,000 infections on Windows.

Oh, no, wait, its the reverse!

ravivyas3• 14 years ago

:) . Typical . I never mentioned anything about Windows. All I said was w.r.t computer security you are most venerable when you don't have the fear of bad things happening to you.

WettowelReactor• 14 years ago

Given OSX install base that accounts for almost 2% of all devices infected. That seems rather serious to me.

RyanMcGreal• 14 years ago

One interesting sidenote in this story is the fact that Mac OSX now has enough market share that it no longer enjoys security-by-obscurity from targeted malware, let alone herd immunity.

nirvana5• 14 years ago

It never did. It has simply been much more secure. The "security by obscurity" claim was a rationalization of windows fans to justify why the mac was so much more secure.

Anyone who genuinely understand security understands that obscurity is not a form of security. There are many incidents of high profile targeted attacks against owners of macs that could have occurred in the past two decades if Apple hadn't been taking security more seriously.

revelation• 14 years ago

There is obviously no point in reiterating how Apple is removing Java, how they are adding VMs, code signing - etc.

The only way for them to improve security is to take it seriously, because the amount of code shipped with each release will only go up, never down. The attitude needs to change.

There is of course lots of data support this argument. Just do a quick Ctrl+F through http://support.apple.com/kb/HT5130 for 'arbitrary code execution'. 21 hits, and many of them in core apple components. These are almost extinct on Windows by now.

runjake• 14 years ago

because the amount of code shipped with each release will only go up, never down.

Actually, it went down with the Mac OS X 10.6 Snow Leopard release. Up to 7 GB less. [1]

1. http://en.wikipedia.org/wiki/Mac_OS_X_Snow_Leopard#New_or_ch...

klez• 14 years ago

I'm nitpicking, but 7GB in binary doesn't necessarily mean 7GB in source code.

Zr402• 14 years ago

Almost extinct on Windows? I see patches for those every month. Here are six of them for the last two months:

http://technet.microsoft.com/en-us/security/bulletin/ms12-02...

http://technet.microsoft.com/en-us/security/bulletin/ms12-01... (two vulnerabilities of this nature)

http://technet.microsoft.com/en-us/security/bulletin/ms12-01...

http://technet.microsoft.com/en-us/security/bulletin/ms12-00...

pooriaazimi3• 14 years ago

This 'discovery' did certainly boost Dr. Web's market share though! 'Dr. Web Light' is now the number 2 most downloaded free app on the Mac App Store: http://cl.ly/1z0Z1F0P29221K1y3X01

drieddust• 14 years ago

so Apple first ignores Oracle's warning and fails to issue the patch. Later it react by removing Java and tries to shut down the security firm's domain.

How responsible :)

Zr402• 14 years ago

No, Java wasn't removed. Java was updated on systems where it has been installed.

stuartd• 14 years ago

Annoyingly, the Java 2012 update REMOVED the -uninstall option from Java, so you have to rm it and clean up the installhistory plist manually if you want to uninstall Java from Lion

Havoc• 14 years ago

>“We don’t know the antivirus group inside Apple.”

What antivirus group...

Apple Snubs Firm That Discovered Mac Botnet

Related Stories