Slashdot Mirror
Apple Developing Tool To Remove Flashback
Trailrunner7 writes, quoting Threatpost: "Apple is planning to release a software fix that will find and remove the Flashback malware that has been haunting Mac users for several months now. ... Apple said on Tuesday that it was in the process of developing a tool that would detect and remove Flashback, but the company did not specify when the fix would be available. Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."
he would hire elite apple assasins to kill these supposed security researchers to stop the bad news
I'm still having flashbacks to the time I saw the Goatse image. Will it work on that too?
Professor Karmadillo Songs of Science
Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now.
Because they're doing the same thing Microsoft does with its slow-as-molasses patches: testing for side effects, on every major application, on every piece of hardware they can get their hands on.
You do not have a moral or legal right to do absolutely anything you want.
It's not a bug.....it's a feature.
"The average reporter we talk to is 27 years old......They literally know nothing." - Ben Rhodes
Unfortunately, security isn't that big of a deal to Apple...yet. With the increase in market penetration the bulls-eye on Macs is getting larger and a lot more tempting; hopefully they realize this before something very serious happens and take steps to bolster their in-house security research (or hell, outsource it).
"Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."
Here's a possibility:
In the past, marketing and the Jobs Reality Distortion Field (TM) have prevented the need for an anti-malware team at Apple. Now, Apple has a malware problem and no team ready to deal with malware - essentially caught with ripped pants and no backup pair.
They will have a assemble a team and come up with a comprehensive action plan to fix this, as it has never been done before at Apple. In the corporate world, these things take a lot of time the first time around.
ntr
Duh... They haven't fixed it yet because Macs don't get viruses, worms, and malware, that's a Windows problem... Hadn't you heard?
Who did what now?
They had to wait for Steve to die before they could admit there was a problem.
"Apple is planning to release a software fix that will find and remove the Flashback malware"
Did you mean Apple is planning to release a antivirus?
Here's how to figure out if you have it (from Gizmodo):
1.Run the following command in Terminal: /Applications/Safari.app/Contents/Info LSEnvironment
defaults read
2. Take note of the value, DYLD_INSERT_LIBRARIES
3. Proceed to step 8 if you got the following error message:
"The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"
If you don't get that error message, well, time to head to F-Secure for your fix. If you're clean so far, you can move on to step eight:
8. Run the following command in Terminal:
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:
"The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"
In other words: "does not exist" means you've got a healthy rig. Anything else, just keep following F-Secure's instructions to vanquish the intruder.
Apple already patched the security flaws in Java that Flashback exploits. Yes, they were months behind Microsoft in doing so. http://www.macworld.com/article/1166195/apple_releases_java_security_updates.html
"customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."
Customers should be reminded not to blaspheme and that everything is part of the lord Apple's plan.
"Flashback has been around in one form or another for more than six months now."
And Apple's File Quarantine System has found the old versions since shortly after.
is impervious to malware even though they know it's not, lol.
he would hire elite apple assasins to kill these supposed security researchers to stop the bad news
You fools, don't you realize Steve Jobs himself was the elite apple assassin?
Concealed under his black shinobi-shzoku-turtleneck was a lethal array of ninja weapons; many an unlucky Samsung executive or uncooperative tech-journalist has met their end at his hands, dispatched by a Firewire-cable garrot or iShuriken (they're like regular Shuriken, but with patented rounded corners). Gates himself has only survived thanks to the vigilant guard of his hulking 'roid-enhanced genetically engineered gorilla henchman.
He was a shinobi of un-matched caliber, until his fateful battle against Google-fu masters Page and Brin, when he was felled by the Pancreas Death-Strike technique.
For a split seocond there i misread the headline:
Apple Developing Tool To Remove Facebook
Well... hope springs eternal.
Because they are working on the next version of OS X: Honey badger. It don't give a shit.
http://www.youtube.com/watch?v=4r7wHMg5Yjg&feature=player_detailpage
Brought to you by Carl's Junior.
"Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."
because they are shit!
Casual web searches don't turn up anything other than exploiting a vulnerability to get onto your machine (bad enough!).
Did anyone successfully command it to do anything?
To a Lisp hacker, XML is S-expressions in drag.
Task: fix Apple malware.
Difficulty: Apple users
Yeah, this'll take a while.
Because they're [...] testing [...] on every piece of hardware they can get their hands on.
Testing on equipment that's more than a year or so old is, unlike Microsoft, decidedly not Apple's modus operandi.
One of Apple's distinguishing characteristics is that they unashamedly drop support for anything they consider outdated ... regardless of its age. Heck, they don't even support (let alone test) Apple's email services on 4-5 year old Mac's that are incapable of running Lion.
no need to waste slashdot's time with this old non-news. take it to the friend bar: http://www.youtube.com/watch?v=q9ZnwvyAk8k
insensitive clod overlords obligatory xkcd car analogy russian reversals whoosh pedant fanbois ftfy in 3...2...1..PROFIT
buy the "new" ibook, it will be virus free.
when speaking in "yoda" you use correct grammar but swap words around (mostly putting them backwards)
check this out http://www.yodaspeak.co.uk/index.php
Any person using FTFY or editing my postings agrees to a US$50.00 charge
The only flashback I ever got was from the blotter.
"And we think you're going to love it."
I'm surprised that Dr. Web hasn't come out with a tool for this. (They are pretty damned good at that sort of thing)
Actually, not a specific tool, but...
http://news.drweb.com/show/?i=2354&lng=en&c=14
"Rather than employ special tools provided by other vendors to delete BackDoor.Flashback.39, Doctor Web offers you to make use of the time-tested Dr.Web Light for Mac OS X rated among the top free applications in the Mac App Store. It will easily find and neutralize the Trojan horse and other malicious programs posing threat to your Mac." (quote from article)
I don't imagine this would be that difficult to ferret out on MacOS. It's not a complex morass of liquishit like Windows. Does the botnet trojan even run as root to be able to dig itself in? You don't need root to do normal user things like open network connections to participate in a botnet. I don't think there is any "rootkit" behaviour here.
Have gnu, will travel.
"How is it that Windows can't notice that something new has been installed and executed without the user's instigation?" - by tqk (413719) on Wednesday April 11, @11:49AM (#39644863)
Windows is setup to "just work" and easily for non-techie end users, first of all (which is also, imo @ least, WHY it gets "hit" so much, not just because it's the most used on its platform (which ANDROID illustrates that concept on smartphones, another computing platform, Linux roots or not))...
HOWEVER:
With a couple minutes of work?
It's NOT LIKE IT CAN'T BE MADE SO & with just a few registry edits, and, to behave JUST LIKE MacOS X does when you install things (or something TRIES to install itself for that matter).
I setup myself up that way in fact, & it's VERY easy - but as I said above? Windows does NOT come this way "oem stock outta the box" but it could!
The settings to examine & change are as follows in gpedit.msc &/or regedit.exe:
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
(Set as PROMPT FOR CREDENTIALS)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser
(Set as Automatically deny elevation requests)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableInstallerDetection
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableSecureUIAPaths
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations
OR
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableVirtualization
(Set as ENABLED)
---
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop
OR
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableUIADesktopToggle
(Set DISABL
They now have a automated tool available at http://www.f-secure.com/weblog/archives/00002346.html
Where has everyone been for the past week? Apple released a new version of Java a week ago to fix this problem. If you want to check your own Mac to see if it's infected, you can do so using the Terminal Utility in the Applications Folder by following the instructions here:
http://osxdaily.com/2012/04/05/how-to-check-for-the-flashback-trojan-in-mac-os-x/
cry some more, little bitch. your shitware got flagged as malware.
is not. keep crying.
"Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware..."
Perhaps they're still in shock that any of their precious systems could be compromised.
ha. i'm not very impressed with companies that lie on their press releases.
http://www.malwarebytes.org/press_center/malwarebytes-industry-momentum-intensifies
"Malwarebytes recently completed the acquisition of hpHosts, a popular and trusted blacklist of malicious websites, ad servers and tracking servers. The acquisition ensures that Malwarebytes protects against the newest malevolent internet protocol (IP) addresses"
you cannot protect against malevolent ip addresses with a hosts file. a hosts file can only block host names, not ip addresses. you need a firewall to block ip addresses.
so - lying? not impressive.
"twisting the words"?
they clearly said that hpHosts (the acquisition) ensures that Malwarebytes protects against "the newest" malevolent ip addresses. i'm not twisting their words at all. that's what they explicitly said. a hosts file can't do that.
I read your profile per my subject above: I think you're FULL OF it, & this proves it below...
You state You've been a software engineer for 16 yrs.? 1 yr. less professionally than I in fact!
(30++ yrs. total time though here since 1982 coding computers from midrange/mainframes into Client Server designs currently/professionally)
That said?
How could you BLATANTLY OVERLOOK these points on HOSTS files I used vs. your "experts" @ the link you posted?
(Especially since I can justify them via how device drivers work vs. usermode apps AND basic CSC-101 file access/parsing)?
To wit "point-by-point" as is my usual style backed by facts AND EXACTLY WHAT I USED vs. the fools in your link you posted (some 'experts', lol - not! More like noobs or techies trying to play "smart"):
---
First of all - You've made VERY FUNDAMENTAL "rookie" mistake's here on hosts files above! I welcome ANYONE to dispute these points on benefits hosts files give the end user of them in:
1.) Diskcaching taking over for "in memory speed of access" for larger hosts files vs. the faulty DNS clientside cache service in Windows
2.) How hosts files can aid security via "layered-security"/"defense-in-depth"
3.) How hosts files can lessen tracking & aid "anonymity" to an extent (DNS request logs)
4.) How hosts files can circumvent DNSBL's
5.) How hosts files aid speed
6.) Added reliability hosts files can give you vs. DOWNED dns servers
7.) Added security vs. DNS poisoned redirected DNS servers (a huge RECURRING problem the past few years done via port 51/53 iirc & "bum rushing" DNS servers set into recursive mode)
8.) The fact that HOSTS can do several things noted above for anonymity, & reliability AdBlock especially + even software firewalls cannot
9.) LASTLY & POSSIBLY MOST IMPORTANTLY FOR EFFICIENCY VS. OTHER SOLUTIONS SUGGESTED HERE BY PDUBS:
The fact hosts files are merely a kernelmode/ring 0/rpl 0 FILTER for the IP stack (far faster operations than occurs in usermode/Ring 3/RPL 3 programs like AdBlock)...
A fact of life in coding gentleman, & ONE YOU'D KNOW if you'd have programmed device drivers, vs usermode apps.
---
* Once more, I read your profile, and your claim of being a 'software engineer' isn't 'cutting it' vs. the above... & like your experts in the link below you posted? I welcome debate on the above - I'll take GREAT PLEASURE in 'ripping you in 1/2' for trolling me in fact!
So, either you're NOT MUCH OF A "software engineer" your profile claims & I DOUBT after the above?
OR
You need to actually get a degree in CSC - based on the above, because any 101 CSC class and file access methods + datastructures classes would have educated you on (as well as device driver programming)!
EXACTLY how I 'dusted' the "wannabe experts" in the link you posted here:
http://security.stackexchange.com/questions/9795/any-additional-security-with-large-blacklisting-hosts-file
?
No, I don't think so on your end... as to your CLAIM of being a "software engineer" and for 16 yrs... no way.
APK
P.S.=> In fact, after what I posted there? Again:
I challenge you to disprove its points "Mr. Bullshitter", because if you don't KNOW those points?
NO WAY You are A SOFTWARE ENGINEER... period (or you never had any classical CSC education training or you're just stupid - take your pick!)... apk
I didn't notice that because I didn't read more than six lines of the shitflood you posted, you little cunt. That was a page and a half down.
About Time.
Yeah, go ahead and keep crying about the moderation. You're a troll, and a lousy one at that, and the new "Flag" feature makes it really easy to get your posts admin-bombed. So go ahead and keep refreshing that IP address.
So, "Read 'em & WEEP" -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39661811
APK
So, "Read 'em & WEEP" -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39661811
APK
P.S.=> All the downmods in the WORLD can't hide it, so keep blowing your mod points... apk
Trying 2 hide the post parent to this reply, trolls? I won't allow it.
Trying to hide my posts, trolls, by downmodding them -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow it, no way.. lol, keep blowing those mod points!
Trying 2 hide my posts trolls, by downmods od 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow it, no way.. lol, keep blowing those mod points!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow thatt, no way.. lol, keep blowing those mod points trolls!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow that, no way.. lol, keep blowing those mod points trolls - I'll just drag them back into view, and you'll exhaust all your mod points. Can't do that to the next person, now can you, if that happens... lol!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow that, no way.. lol, keep blowing those mod points trolls - I'll just drag them back into view, and you'll exhaust all your mod points. Can't do that to the next person, now can you, if that happens... lol!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow that, no way.. lol, keep blowing those mod points trolls - I'll just drag them back into view, and you'll exhaust all your mod points. Can't do that to the next person, now can you, if that happens? Nope... lol!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow that, no way.. lol, keep blowing those mod points trolls! Me? Well - I'll just drag them back into view, and you'll exhaust all your mod points. Can't do that to the next person, now can you, if that happens? Nope... lol!
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow that, no way.. lol, keep blowing those mod points trolls! Me? Well - I'll just drag them back into view, and you'll exhaust all your mod points. Can't do that to the next person, now can you, if that happens? Nope... lol! http://apple.slashdot.org/comments.pl?sid=2779659
Trying 2 hide my posts by downmoddin 'em -> http://apple.slashdot.org/comments.pl?sid=2779659&cid=39666615 ? I won't allow it, no way.. lol, keep blowing those mod points troll!
Me? Well - I'll just drag them back into view, and you'll exhaust all your mod points.
Can't do that to the next person, now can you, if that happens? Nope... lol!