Apple Developing Tool To Remove Flashback

Trailrunner7 writes, quoting Threatpost: "Apple is planning to release a software fix that will find and remove the Flashback malware that has been haunting Mac users for several months now. ... Apple said on Tuesday that it was in the process of developing a tool that would detect and remove Flashback, but the company did not specify when the fix would be available. Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."

Comments

if steve jobs was still here

[alen]

he would hire elite apple assasins to kill these supposed security researchers to stop the bad news

Re:if steve jobs was still here

[cant_get_a_good_nick]

Begun. the cat and mouse game has.

Proper grammar, Yoda would speak with.

Slow is good

[Sarten-X]

Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now.

Because they're doing the same thing Microsoft does with its slow-as-molasses patches: testing for side effects, on every major application, on every piece of hardware they can get their hands on.

Re:Slow is good

[FudRucker]

if it was Linux based malware a patch would have been out within 24 to 48 hours, six months is enough time to create a new version of the entire operating system,

Re:Slow is good

[Coisiche]

...on every piece of hardware they can get their hands on...

But it's Apple, isn't there just one bit of hardware to check?

Re:Slow is good

[Anonymous Coward]

Actually the quote is quite opinionated and wrong. Apple provided java patches that basically close the hole and make the malware issue mute. Flashback HAS existed for months, but its also using a new vulnerability each time it comes up (its used a Flash hole, a PDF hole and a Java hole, three things not even developed BY Apple.) Likewise they have been patching the OS to flag Flashback in previous versions of the trojan.

The whole quote both shows the writers complete lack of knowledge of whats been done about Flashback that any competent system administrator knows already (hell we even have scripts developed to flag machines that MAY be infected and have had them for months this is ON TOP OF the info Apple has been providing us) as well as his bias in trying to spin this as if this thing is a huge issue (honestly is not, its not even the first real vulnerability on the Mac OS, there were numerous worms for Quicktime back in the 90's that abused Quicktimes autoplay feature, AND THOSE didnt require you to authenticate as admin since pre-osX you ran as root.)

Re:Slow is good

[Sarten-X]

If you're running Linux, you're probably competent to fix things if a patch breaks them.

If you're running OS X, you're probably confused enough by the patch in the first place.

If you're running Windows, you're probably just going to complain to some IT guy when the report looks slightly different.

Disclaimer: I triple-boot, with more VMs. I can make fun of everybody.

Re:Slow is good

[Theophany]

Whilst I'd like to believe you, I fear that it is more to do with Apple spending so long in flat out denial that an issue ever existed.

Don't get me wrong, I'm no hater and I'm no shill. I used to exclusively use Macs, now I don't use them at all (although I do use an iPhone/iPad) purely because their support practices in terms of viruses or serious issues are disgraceful. Whilst they do have an excellent support system whilst you're covered by AppleCare, they also have a culture of denying widespread hardware and software failures that most other companies would acknowledge quickly and get fixed quickly too.

Case in point, I bought a batch of Macbook Airs a few years back for the company I was then working for. After two years, every_single_one_ died within a few days of each other from the same catastrophic hardware failure. Apple refused to acknowledge that there was any link, no matter how tenuous, of a manufacturer failure. They said it was pure coincidence.

Like I said, I'm no hater. I know that corporations have to be ruthless to make money, but once I realised just how often they bury their heads in the sand (and how infuriating it can be) that was the day I ceased to buy big ticket items from them.

Re:Slow is good

[JohnBailey]

Apple is still in disbelief that that Flasback is real.

No.. Apple is still trying to figure out if this is from Adobe or not.

Re:Slow is good

[Idbar]

Did you just compared Apple to... Microsoft!!??

Run for your lives!

Re:Slow is good

[Theophany]

Logic board went kaput on each on of them. IIRC there were 8 machines in total. Despite my many attempts to reason with them, they wouldn't even give us a discount on the repair costs as a show of goodwill.

Re:Slow is good

[olau]

So, I'd much rather have a slow patch from a company that cared enough to actually test it, vs a hobbyist who doesn't care enough to produce quality robust code.

True. That's why I run a mix of Windows ME and Apple MacOS 9 on all my servers. I'm not letting that Linux distro run entirely by volunteers, what's it called, Debbi's Ian? near any of my good stuff. When was the last time Microsoft or Apple released a security fix for those two systems? See. Flawless software.

Re:Slow is good

[CharlyFoxtrot]

if it was Linux based malware a patch would have been out within 24 to 48 hours, six months is enough time to create a new version of the entire operating system,

The vulnerability has been patched. This is about removing the malware from infected systems.

Re:Slow is good

[oh_my_080980980]

Actually no that's not correct. Apple and Oracle are working together on it:

"In November, Apple and Oracle announced that they would collaborate on a Mac-based incarnation of OpenJDK, an open source version of Java."

http://www.theregister.co.uk/2011/02/27/no_java_in_mac_os_x_lion/

Re:Slow is good

[oh_my_080980980]

And this

Oracle Previews Java SE 7 for Mac OS X, Unveils Java SE Roadmap
Oracle is releasing a technology preview of Java SE 7 on Mac OS X and said it plans to release Java SE 7 on Mac OS X for developers in the second quarter of 2012 and a consumer version later that year.

http://thejournal.com/articles/2011/10/06/oracle-previews-java-se-7-for-mac-os-x-unveils-java-se-roadmap.aspx

Re:Slow is good

[CharlyFoxtrot]

A) Vulnerability has been patched.
B) It's not that difficult to detect and remove.

This is strictly about helping non technical users that might be infected in an easy way. It's these users that were specifically targetted by the way since the malware targets old versions of Java and even checks for the existence of "power user" tools installed and doesn't install if they are :

"4. You do not have certain security tools installed on your Mac that Flashback checks for, including Little Snitch, Xcode, and a few anti-malware tools.'

Re:Slow is good

[hairyfeet]

Bah Ur doin it wrong, let the old Hairyfeet show you how to REALLY insult all three OSes!

1.-if the patch comes out on linux it will be 14 pages of CLI and a tarball that will need a specific version of GCC, if they put it in the repo upon application it will throw you into single user mode on first boot. you DO know how to edit your config files, right?

2.-If the patch comes out on Windows it will take 2 hours to install, followed by an hour on the "waiting to shutdown' screen and ANOTHER hour on the "Please wait, configuring Windows" boot up and may God have mercy upon your tortured soul if the power goes out while that is happening!

3.-If the patch comes out on Apple it will be a year behind, but it will come in a cool silver look and everyone will talk about how truly wonderful it is. it doesn't actually patch anything "bad" it just brings sprinkles of Steve's magic to your poor pathetic life because "hey Apple never gets viruses' so everything you've read here? Total lie spread by those Windoze and Lunix luzers because they can't afford magic sprinkles, poor bastards.

Now THAT is how you insult all three boy! I'd insult the BSD guys while I was at it but they'd be so damned grateful that anybody even mentioned them at all they'd probably thank me for doing it which just takes all the fun out, its like kicking a really stupid puppy that just smiles and wags its tail at you.

Re:Slow is good

[toadlife]

If it came out for BSD, the dependency check would trigger a complete recompile of KDE 4.x, bogging down your desktop for 34 hours. After it was done, everything would work fine, but in all practicality, you wouldn't be any safer because face it, you're running BSD; no one gives shit about you.

Re:How good is it?

[SJHillman]

Would probably help if you didn't make it your desktop wallpaper.

Manually Detect & Remove

[guttentag]

Running Software Update today to update Java will prevent you from getting flashback going forward, but that's not going to do anything if you already have it.

Here's how to figure out if you have it (from Gizmodo):

1.Run the following command in Terminal:
defaults read /Applications/Safari.app/Contents/Info LSEnvironment
2. Take note of the value, DYLD_INSERT_LIBRARIES
3. Proceed to step 8 if you got the following error message:
"The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"

If you don't get that error message, well, time to head to F-Secure for your fix. If you're clean so far, you can move on to step eight:

8. Run the following command in Terminal:
defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:
"The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"

In other words: "does not exist" means you've got a healthy rig. Anything else, just keep following F-Secure's instructions to vanquish the intruder.

Steve Jobs: Ninja Assasin

[Guppy]

he would hire elite apple assasins to kill these supposed security researchers to stop the bad news

You fools, don't you realize Steve Jobs himself was the elite apple assassin?

Concealed under his black shinobi-shzoku-turtleneck was a lethal array of ninja weapons; many an unlucky Samsung executive or uncooperative tech-journalist has met their end at his hands, dispatched by a Firewire-cable garrot or iShuriken (they're like regular Shuriken, but with patented rounded corners). Gates himself has only survived thanks to the vigilant guard of his hulking 'roid-enhanced genetically engineered gorilla henchman.

He was a shinobi of un-matched caliber, until his fateful battle against Google-fu masters Page and Brin, when he was felled by the Pancreas Death-Strike technique.