Slashdot Mirror
OS X Malware Demands $300 FBI Fine For Viewing, Distributing Porn
An anonymous reader writes "A new piece of malware is targeting OS X to extort money from victims by accusing them of illegally accessing pornography. Ransomware typically uses claims of breaking the law and names law enforcement (such as the CIA or FBI) to scare victims, but it is usually aimed at Windows users, not Mac users. The security firm Malwarebytes first spotted this latest threat, noting that criminals have ported the ransomware scheme to OS X and are even exploiting a Safari-specific feature. The ransomware page in question gets pushed onto unsuspecting users browsing high-trafficked sites as well as when searching for popular keywords."
I thought we were past the "being surprised that apple products get malware" stage years ago. This seems like a pretty run-of-the-mill scam. I can't really see what's notable about it. Someone help?
At long last, porn parity for the Mac true believers.
I'm not saying Mac OS X has more viruses than Windows, but almost every Mac user I know has this pretentious attitude that they're invulnerable just by virtue of running Mac OS X. Maybe this will help pound some sense into them.
Well I will just tell my wife that i don't use Safari to surf for porn. Crisis averted.
(I use Firefox Private browsing for that.)
Hmmm...We are good unless she uses Safari for that!!???
Is this really malware? It's just a webpage with annoying javascript...
Clever use of a bug in Safari, who would have thought of that.. I'd say the US should be able to knock out this site in a few minutes, by using the provisions in the SOPA act. Right?
Everyone knows Macs don't get virus right? ;-)
The CIA is and always has been an intelligence/espionage agency. Blurb is incorrect to call them law enforcement
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
You think this and that guy Chris Sevier is divine retribution for Jobs taking a swipe at Android?
Stay sentient. Don't drink bad milk.
...a good security measure for the guy suing Apple for not filtering the porn he was addicted to.
--Kylus
Idiot-proof something, and Life will build a better Idiot.
I've been seeing variations on this one for a year or two now, sometimes connected with the "Yahoo Porn Bug" I wrote about in my journal, sometimes not. The main thing when it comes to a lot of this crap is to explain and assure the public its bullshit, you'd be amazed how many can be put into panic mode by a letter that looks like it comes from authority and of course guys getting child porn charges for Simpsons cartoons and manga really doesn't fucking help matters in that regard.
Now I don't know how it is on OSX but on Windows these kinds of bugs aren't that hard to kill a good tool for the job I've been trying out in the shop is the Emisoft Emergency Kit which is free for personal use but so far looks to be worth the cost of a license if you work in a shop. The whole thing runs on a stick and so far it seems to be pretty damned good at detecting all kinds of bugs and its CLI scanner so far has been pretty good at getting around the run blocks some of the malware uses.
ACs don't waste your time replying, your posts are never seen by me.
$300 fine? For each file? I'm bankrupt!!!!!!
Some finally got around to porting windows viruses to macintosh. I think it's time to declare 2013 year of the Macintosh desktop. Sorry linux.
No product is totally invulnerable. But it's a simple fact that an OSX user can go a long, long time before ever seeing a virus or malware.
That said - this is not an example of the OS being vulnerable, the whole "malware" is Javascript that takes over Safari a bit, basically a hacked website. I'm not even sure if it works if you have popup blocking on. The computer is never compromised.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Law enforcement is never that straightforward and efficient.
I thought we were past the "being surprised that websites get hacked" years ago.
This is not malware, it's a hacked site with annoying javascript. The only news here is how desperate some people are to show that OSX is vulnerable to malware - even when the malware never is installed on the system...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It's just a site that uses javascript to try and keep you from leaving, which is hard to get out of on safari because if you forcequit safari, safari "recovers" the page when you open it again.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I saw that infect someones firefox / windows7 machine once. Was a bitch to remove.
It came from a yahoo site ad.
Welcome to popular mac junkies. You're a target now. But you don't have the tools, and skills to deal with these things.
Where windows users have what... 20+ years of dealin with this crap.
It makes sense for them target Macs because of their users. If a person has no idea how to use a computer or the internet, they get a Mac. So yes, target the people stupid enough to fall for this.
Apple products get worms.
How does that foot in your mouth taste? It's not a virus, and not OSX specific - it's just a web page with some annoying Javascript.
The cynic in me wonders how long before this stops being malware and starts being efficient delivery of government policy.
..don't panic
It takes advantage of Safari's "restore last window" feature, which is optional (though on by default in some versions) and also available in Firefox and Chrome (and possibly also on by default in some versions.)
And the OS X version is limited to a browser, as opposed to the Windows versions (which I've seen) which lock you out of the whole OS and can be VERY hard to get around.
The author's suggestion is to reset Safari (as in, clear cache, remove cookies, etc.) but wouldn't you also just be able to turn off the "restore session" option and then force-quit and relaunch? Also, you could relaunch, and press 'escape' or 'command-period' repeatedly to keep the page from loading.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Disable JavaScript[1], close page, there's no step 3.
[1] Preferences -> Security Tab -> uncheck 'Enable JavaScript'
Where can I get a copy of this malware? Tell the FBI to just deposit the $300 in my savings account.
I'm slightly happy the news is making as much of a fuss over this as they are. As IT, I'm tired of people going "It can't be my problem, I have a Mac."
If we colonize Mars, it won't be the World Wide Web anymore. UWW?
Since when does "fake FBI warning page with some javascript to prevent you from closing it" qualify as "malware"?
It's like the submitter didn't even RTFA...
Even if the user knows it is a fake warning, and even if the user knows it is the site that has been hacked, if Safari will not let the user close the page and move on, it is broken. It should be fixed. Does Safari always restore the old sessions without allowing the user a chance to start fresh sessions? If not it is broken.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Calling this malware is a pretty desperate stretch.
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
Dudes, in Germany and Austria and Switzerland, these scams have been around for years. They usually tell you that your computer has been locked by the police, and that you need to pay a fine in order to get it unblocked. Nothing new here. News at eleven.
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Yesterday there was a posting about Chris Sevier suing Apple for causing his porn addiction. Maybe Chris needs to be infected with this malware.
Research is what I doing when I don't know what I am doing - Werner von Braun
I've dealt with the windows version on a few client PC's. It can be a bit of a PITA, but in the cases I've dealt with still seemed to be locked to a given user account (and not the OS).
Doesn't make it any less of a PITA to remove from a user account, especially since it buggers permissions, but the easiest way is usually to create a new user, then boot from safe media, and copy/scan the user's old files to the new account.
[...] and so far Windows Defender and MS Internet Essentials have blocked everything.
That you know about...
if you pay the $300 do you get to view the porn?
I love how the Windows users get *so* irritated when Mac users point out to them how their machines generally "just work" without all the virus and malware hassles, need for (often costly) anti-virus software and subscriptions, etc.
The only people I see really trying to "pound some sense" into OS X users to use anti-virus software are the companies hawking the stuff.
I use both Windows machines and Macs practically every day. I work in a corporate environment where we're pretty much a 50/50 mix of both platforms, and provide I.T. support for both.
Everyone in our dept. will readily tell you that the Macs are FAR less of a support issue, overall, than the Windows PCs. Nothing in this world is absolute, and it's silly for anyone to make claims involving words like "never". So yes, clearly a handful of viruses HAVE been developed over the years just for Macs and running OS X doesn't make you immune to ever getting a piece of malware. But given a typical use-case of employees using their machines on our corporate network for 8 hours every weekday, doing lots of email, editing of documents, printing of documents, online purchasing, research, etc. etc. -- the Macs have so far NEVER been infected with a virus since we've owned them. The Windows machines have caused multiple serious virus outbreaks, requiring days of effort restoring files on the servers.
We actually bought eSET anti-virus for some of our Macs to try it out, but it just didn't make much financial sense in the end. (The OS X version of their product is far behind the Windows edition in ability to do central administration and updates, and it seemed to just be one more thing to use up system resources.)
You know, true story - this problem can totally be avoided by using a shell account and text-based browser. Doing it right now. Bam. No malware. No GRAPHICS, but no malware. Thank you, goodnight. Glad to be of help.
Is this really malware? It's just a webpage with annoying javascript...
It's very interesting and rather bizarre how many posts to this article use the rather unusual turn of phrase; "annoying javascript". It's like a massive astroturf campaign.
The names and locations of the crooks behind these scams are well known, but nothing is ever done to punish them or the nations from which they operate (or the companies that provide them with web services in the first place). They are criminals well connected to Israel and certain East European nations, and are effectively above the Law. If the heat does get too high (an incredibly rare event) they simply hop over to Israel where they are protected against extradition regardless of the crime.
It gets worse. Just as Google is happy to make advertising money from any company currently one step ahead of the law, major websites of repute happily use ad-servers that frequently push these trojan schemes at their readers. Microsoft and Apple co-operate in ensuring their operating systems have fundamental vulnerabilities to these types of attacks- their excuse being that they leave holes for Israeli operations like Stuxnet, but the people who code Stuxnet, and those that code ransomware are blood-brothers.
Big scams are never punished. Big scams are run by people with political clout. In the UK, for instance, for a period of many years door-to-door cold callers would attempt to persuade people to change their energy suppliers. Even if a resident was NOT interested, these callers would claim to need a signature so they could prove they had visited, and get paid. Of course, the signature was used to authorise a change of supplier. EVERY major energy company in the UK used this scam, inconveniencing millions of Britons. Not one company was punished. Their criminal fraud was literally above the law.
Crimes originating or with strong links to Israel always go unpunished. Worse, the lack of punishment encourages such criminal enterprises to grow without limit. Attempts to clamp down on Israeli crimes (Israel is also at the heart of Human trafficking, the supply of many illegal drugs, and the illegal trade in organs taken from living victims) always has friends of Israel within the UK, USA, France and Germany screaming "anti-semitic, anti-semitic". You Mac owners are just going to have to get used to these kinds of cons, just as PC owners have.
In the UK, for instance, for a period of many years door-to-door cold callers would attempt to persuade people to change their energy suppliers. Even if a resident was NOT interested, these callers would claim to need a signature so they could prove they had visited, and get paid.
Just had one of those here in the San Francisco Bay Area, like within the last couple weeks. Claimed to be "checking" that we were "getting the government required 20% discount". Tried to get us to sign a form that would switch our gas supplier from PG&E to some pseudo-ecological-responsibility gas supplier (using the common gas distribution system).
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Just asking...
( gotta post anon as I have moderated in this forum )
then a bottle rocket is a ICBM