Slashdot Mirror
Mac Flashback Attack Began With Wordpress Blogs
With more on the Flashback malware plaguing many Macs, beaverdownunder writes with some explanation of how the infection grew so quickly: "Alexander Gostev, head of the global research and analysis team at Kaspersky, says that 'tens of thousands of sites powered by WordPress were compromised. How this happened is unclear. The main theories are that bloggers were using a vulnerable version of WordPress or they had installed the ToolsPack plug-in.'"
At it's height it was never as bad as some of the windows viruses have been, but it plants the seed that macs aren't safe and are just as vulnerable as any other OS.
The malware still has to install on the user's OS, which requires browser/plugin exploits on the user's PC for user-privilege level access and possibly a local escalation bug if the malware wants admin rights without user "approval". So I think it's fair to cast _some_ aspersion at Apple here, even if WordPress is providing the server end of the malware deployment ecosystem.
But getting back to your point about WordPress. It seems to me that WordPress has been the server-side vector for far too many malware deployment efforts. I've certainly heard its name associated with a lot of previous malware storms. What are some more secure alternatives to WordPress?
"How this happened is unclear. The main theories are that bloggers were using a vulnerable version of WordPress or they had installed the ToolsPack plug-in."
This it not unclear at all. There were a few security problems with WP in the last year. But a LOT of themes use the timthumb.php module to do dynamic rescaling of images. Timthumb used to be extremely vulnerable, you could download a file from http://www.youtube.com.attacker-domainname/anything.php, install it in the timthumb's cache and have full access like forever.
Updating WP wouldn't do any good, as a fully updated WP installation can still run a vulnerable theme. Even when the flaws in timthumb were fixed and the theme is updated, these sites have been flooded with backdoors, varying from eval($_POST['a']) in wp-config.php to newly created admin users. (Admin users can edit .php files from /wp-admin, an admin user effectively has power to run any php code desired.)
I've manually removed and analysed infections from several customers wordpress websites, all were hit by timthumb exploits. Some of these websites had literally dozens of backdoors, each of which gave full access to the site. I've seen malware that hid from googlebot to avoid detection. I've seen infections with timers, and infections that kept an IRC connection open to accept commands. These infections were just waiting for the right moment to be abused.
Apple really wants to downplay the issue. This actually isn't the first Malware to hit Macs (one of our professors got one that was using text to speech to read out ads, it was hilarious) just the first one to be really bad. Apple is still addicted to selling the viewpoint that Macs are immune to that kind of shit. So they didn't go putting out any big press releases warning people of nasty shit.
Most of the time when there's a nasty problem, the vendors put out press releases to try and let people know that the patches this time around are more important than normal and yes, you really need to apply them Right Now. Apple didn't so reporting on it wasn't as widespread as you might expect.
Also there are a surprising number of Mac users who drink the "Macs can't get viruses," kool aid whole heartedly. They don't just believe the specifics of the Apple advertising, they really believe Macs are 100% immune to security issues. Drives me up the wall when I'm dealing with one of them and trying to explain that yes, you DO need to patch your OS even though it is a Mac and no, running an FTP with world write access is not ok just because it is a Mac (really, had some grad students pull that one).
Given the amount of Mac users in journalism, and the general techno-unawareness of journalists, that makes the problem worse. Someone sees a story about a "mac virus" and they say "Nah, can't be real, Mac's don't get viruses, just more stupid shit floating around the 'net."
As time goes on, and Macs continue to be targeted (which they will) or we see cross platform attacks (using Java or HTML5 or something) the awareness of security on Macs will slowly rise.
I have had non technical Mac users ask me about this, that means that they (or at least more of them than before) are open to advise about security and don't just smugly boast about Macs being invincible any longer. This makes everyone safer from my view.
BTW the advise I give Mac users who ask is as follows:
1: run apple menu->software update manually at least once a week, and download everything it suggests*
2: use a non admin account for daily activity and NEVER provide admin creds unless you know exactly what it is using them for, you should never need to do this while surfing the web.
3: Only get software from trusted sources, like the app store, SourceForge, or vendor web sites like Adobe or Autodesk.
4: Switch to a platform where java is controlled and updated by the first party, Oracle and not a third party, Apple to ensure you have the best security possible.
*Just as with windows or any other *NIX box, there is an exception to the all update thing, if you know that it will break your workflow or some component thereof, you can skip it while that is worked out.