Slashdot Mirror
Flashback Trojan Hits 600,000 Macs and Counting
twoheadedboy writes "A Flashback variant dubbed Backdoor.Flashback.39 has infected over 600,000 Macs, according to Russian security firm Dr Web. The virulent Flashback trojan infecting Apple machines sparked interest earlier this week after it was seen exploiting a Java vulnerability, although it was actually first discovered back in September last year. The Trojan has a global reach after Dr Web found infected Macs in most countries. More than half of the Macs infected are in the US (56.6 percent), while another 19.8 percent are in Canada. The UK has 12.8 percent of infected Macs."
Is it just wrong if I laugh a little?
Seven puppies were harmed during the making of this post.
Is there any way to check whether your Mac is infected?
It's only been a matter of time. Many people think that since the common knowledge is that Macs don't get viruses, they are immune to everything else (including trojans). Only the computer nerds differentiate between viruses, trojans, and malware you get by clicking on something on the internet.
it used to be magic pixie dust protected Macs but in the last 6 months i've been using the Spirit of Steve
time to find some new protection
The users just surfed wrong.
But seriously, Apple screwed the pooch really good on this one. Looks like it's time that their corporate culture goes through the same "trustworthy computing" initiative that Microsoft went through over the last few years.
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml
See here: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml
Summary:
If you open Terminal and run
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
and
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
and see:
The domain/default pair of [...] does not exist
for each, you are not infected. Also, if you run nearly any AV software or other tools like Little Snitch, you are not infected as it checks for these and deletes itself if found.
Also, no sensible person ever said "Macs don't get [infected/hacked/whatever]." It just a lot less likely, and has historically been, even accounting for differences in marketshare. As Mac share increases, it only makes sense they'll be targeted more with malware. But Macs, as a whole, are indeed "more secure", in that still, to this day, you are far less likely — even with the complacency or, if you prefer, ignorance, of Mac users — to become impacted with any malware than with Windows. Maybe someday this will change. But it's never been true to date, and isn't true now. The fact that single instances of Mac malware get so blown out of proportion, STILL, is ridiculous. (Though, Apple could do better with patching known vulnerabilities in Java on Mac OS X...)
The same advice and best practices for avoiding malware apply to Macs as well as any other desktop platform, and Mac users would do well to run current AV software. The Sophos free edition is nice.
Gizmodo's article shows how to determine if your machine is infected. http://www.gizmodo.co.uk/2012/04/mac-flashback-trojan-find-out-if-youre-one-of-the-600000-infected/
Can we please end the madness where people claim that since an OS is a variant of unix it can't get a virus? Users do stupid things, stupid things have consequences, doesn't matter the make of the car you are driving if you are a drunk moron soon enough you'll crash into something. Similarly if you are a horny moron eventually you'll browse to a site that will find a way to get you to install some junk that will trash your computer all in the name of some desperately needed friction motivation.
HAHA HAHAHHAHAHAHHA Hahahahahahhaahha
hahahahahhahahhahahahhahahahh
HAHAHAHAHAHAHahahahahahahaha
This is the problem with the web. When the first DBI ( Drive By Infection ) happened the code that allowed this sort of thing to happen was not ripped out "with extreme prejudice" and in an old /. post I asked why and there was damn little in the way of a response.
So I ask once again, why has this not been fixed? Why are there so god damn many ways to do this and how come that ability has not been removed?
It seems to me that in the insanity of try to make the browser everything instead of a piece of software that renders text, there is nothing but vulnerability after vulnerability and I really don't see any end in sight since in trying to make the browser do everything it needs more and more access to the core functions of the OS it is running on. How can this not lead to more and more attack vectors?
Hey KID! Yeah you, get the fuck off my lawn!
I hope for your sake that you're not living in Arizona.
Market share has something to do with it, as does a pretty good track record of security, but the type of users that use Linux is also a significant reason that we don't see widespread malware affecting desktop Linux. Your typical Linux user is generally more nerdy, computer literate and security concious.
If you did a survey of how many users clicked on pop-up banners, opened PDFs from spam email, granted permission to untrusted Java applets, etc, I bet the percentage of Linux users who fell in the traps would be smaller than the other OS users.
Wrong.
Here, step by step directions on how you can make one:
http://www.offensive-security.com/metasploit-unleashed/SET_Java_Applet_Attack
There are two types of people in the world: Those who crave closure
The piece said 50% of infected machines were in the US, not 50% of US machines were infected.
And actually I do see linux boxes with old vulnerabilities pretty often. One of the problems with OSS is that updating often breaks libraries... which if you have compiled 3rd party software installed can be a real barrier to updating. We have one machine that has not been updated with any patches for 2-3 years now because they will break installed apps.
OSX has not had a single virus in the wild since its introduction. The first person to get a virus to spread from machine to machine on OSX will be world famous. And it's not like people don't try.
Viruses are self replicating code that spread themselves via the network or sneakernet. Since OSX, Linux, Solaris, FreeBSD and all other sane OSes strip the execute bit from files coming in off the wire, this is a major hurdle to get over, and is why virus and worm propagation on OSX, other Unices, and Unix like OSes like Linux sucks.
This was a trojan. Trojans are different. They typically need to trick the user into installing them, and they do not self-propagate.
But the distinction is lost on people, such as yourself who refuse to believe there is any difference between the Bagel worm and a program that tricks the user to deltree c:\*.* or rm -rf /*
With that said, there is a way to make certain well-behaved Windows viruses and worms spread cross-platform, and that is to run wine. But then the requirement is that the virus or worm be well behaved and not depend on undocumented Windows features. These are few and far between, and even then, it runs in userspace and the cure is to rm -rf .wine.
"even if you want to write a virus for iOS you can't" and "there is zero malware in the app store".
That's because your code is up for review if you want Apple to sell your program for you in the Apple store. They check it for bad stuff and vet the program. The Apple Store is much like the trusted repositories you see in the Linux world. The repo system for Linux has proven time and again this is a good way to go. The only difference with the Apple store is that there is only one repo, theirs.
>implying that third party software vulnerabilities are suddenly the OS vendor's fault
This is not even true in the Windows world. Nobody blames Microsoft for an Adobe Reader or Flash vulnerability. Adobe certainly does attract enough blame themselves.
--
BMO
Only on slashdot.
Not all apps go through package management, and sometimes they depend on libraries that other system components also depend on.
Unfortunately 'sandboxing' sometimes requires so much of the system that the only solution is to set up a VM, which puts you right back in the 'old distribution' category'
*shrug* not everything comes with source or has source available, and not all vendors are happy (or willing) to keep providing new binaires over the years, esp if you are not paying them for it.
Which gets back to the issue with OSS in this specific domain. OSX and Windows do a pretty good job of maintaining backward binary compatibility. You install an app, that app will probably keep working across many updates. OSS tends to assume that you have the ability to rebuild form source or your app is being maintained through the packaging system of that distribution. For most people this is indeed the case, but when it is not such systems can become a real headache and it is not always possible (or at least not always easy) to isolate large parts of the system in order for the app to use some system libraries while everything else uses another. It gets even worse when you are talking about things that need kernel modules.
It kinda come back to 'to each their strengths and weaknesses', and this is a weakness of OSS when it comes to deploying exotic 3rd party applications.
Nope, not an order of magnitude unless you mean base 2. Mac global desktop share is 5%, Linux global desktop share is 1.5%.
examine the claim of 600,000 infections?
F-Secure say that each infection uses the MAC address as a unique User-Agent, so it's easy to count individual infections.
I'm more than a little skeptical about the distribution of infections.
Yes, that is interesting. The register reports that Dr. Web only managed to compromise and "sinkhole" one of the Command and Control servers, so they are only seeing one segment of the network (600k is therefore the lowest bound). Dr. Web say "Over 550 000 infected machines running Mac OS X have been a part of the botnet on April 4. These only comprise a segment of the botnet".
Flashback uses some function to generate C&C addresses and then tries to connect to them. So the question is - is the C&C address generation function dependent on some aspect of the source IP, or geography, or reliant on network topology? Dr. Web do say "It should be noted that the malware utilizes a very peculiar routine for generating such addresses." If so, then it is possible that the Irish infections are connecting to a different C&C server than UK infections.
The UK has a population ten times bigger than Ireland
Actually it's 14x bigger.
Some tweets from Mikko Hypponen of F-Secure:
mikko : Assuming there are about 45 million Macs out there, Flashback would now have infected more than 1% of them.
mikko: That would make Flashback roughly as common for Mac as Conficker was for Windows.
So, do the numbers actually make sense to you then? Do you think this as big as Conficker? Because that would genuinely be news. I'm surprised that only Dr. Web have found an infection of this size. The other security companies must be asleep at the wheel.
I would assume so if Apple doesn't support Mac OS X 10.5.x anymore. I hope disabling Java in web browsers is enough since there's no way to uninstall it because Mac OS X came with it. :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
A bootable image is just an OS X install disc. If you lost yours, you can get one off eBay (or copy it from someone). As soon as the installer starts, you have an option of restoring a time machine backup. It was quite easy last time I tried it (1 year ago or so).
A successful API design takes a mixture of software design and pedagogy.
According to the Dr. Web site: "Each bot includes a unique ID of the infected machine into the query string it sends to a control server. Doctor Web's analysts employed the sinkhole technology to redirect the botnet traffic to their own servers and thus were able to count infected hosts." Why such a strange distribution of infections? If you look at the list of known infected sites, you can see they would only appeal to a rather odd group of web surfers.
Does anyone have any suggestions for getting rid of the damn thing?
Instead of flaming each other maybe we can skip to the part where we say how to remove it completely. Same goes for Windows Malware. If we put in one tenth of the energy documenting the removal of these things that we do into flaming there wouldn't be malware to speak of. Removing the stuff is a pain and every tech I know has a different set of tools they use to do the job.
In regard to this piece of malware I have scanned computers with Integro's VirusBarrier X6 and it takes days to complete a scan and doesn't seem to be able to remove it anyway. How it takes days is beyond me, there's only a handful of malware for macs and it seems like a full scan would take seconds, but hey, that's just me.
I said [trojans] do not self-propagate.
You said Sorry to break your bubble, but this was a drive-by exploit using a hole in Java.
That's not self-propagation. It also pretends to be a Flash update. That's not a virus. That's a trojan.
Hope this helps.
--
BMO
I'm afraid you don't have a clue. To start with, that would not be a Linux exploit. As you pointed out it would be a Java exploit. A Java exploit on Linux, Windows, or OS X is not a Linux, Windows, or OS X exploit. Obviously if I run software you have written on my machine that software will have vulnerabilities. On most Windows boxen in the wild (i.e. horribly and wrongfully configures out of the box), once I exploit your app I can own your OS. On almost all Linux distributions, however, you may access local user data and screw up the local users stuff, but you will not own the OS.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun