|
Posted by
Olog-hai
on Tue Apr 24 20:07:58 2012, in response to More than half a million Macs hit with Flashback Trojan, posted by Olog-hai on Sun Apr 8 00:17:23 2012.
edf40wrjww2msgDetailOT:detailStr fiogf49gjkf0d ComputerWorld
New, sneakier Flashback malware infects MacsDitches all attempts at duping users with social engineered tactics, exploits Java bug through drive-by attacksBy Gregg Keizer
April 24, 2012 02:00 PM ETA new, sneakier variant of the Flashback malware was uncovered yesterday by the French security firm Intego.
Flashback.S, which Intego described Monday, uses the same Java vulnerability as an earlier version that has infected an estimated 820,000 Macs since its appearance and still plagues over 600,000 machines.
But unlike Flashback.K, the variant that first surfaced last month and has caused consternation among Mac users, Flashback.S never asks the victim to enter an administrative password for installation, but instead relies only on the silent exploit of the Java bug to sneak onto the system.
"The differences are very subtle," Peter James, a spokesman for Intego, said in an interview Tuesday. "There's no password request [by Flashback.S]."
Flashback.K used different infection tactics: Even though it exploited the same Java vulnerability — identified as CVE-2012-0507 — it also displayed the standard OS X password-request dialog. If users entered their password, the malware installed itself in a different location, where it was even harder to detect.
The hackers responsible for Flashback appear to be making money through click fraud, where large numbers of people are redirected to online ads not normally served by the site the user is viewing. The criminals receive kickbacks from shady intermediaries for each ad clicked.
The Java flaw used by both Flashback.S and the earlier Flashback.K was patched by Oracle in mid-February, but Apple, which maintains its own edition of Java for OS X and so is responsible for patching Java bugs, did not issue its fix until April 3, seven weeks later.
Users are infected by Flashback.S when they browse to compromised or malicious sites; the tactic is called a "drive-by" to reflect the lack of required user action beyond steering to a URL.
Some security experts have traced the Flashback infections to tens of thousands of hacked sites and blogs running WordPress.
Because Flashback.S uses different names for the files it drops on a Mac, and installs those files in a different location than Flashback.K, it's possible that the malware seek-and-destroy tool Apple released April 12 won't eradicate the variant.
James said that Intego was not able to confirm whether Apple's tool removes Flashback.S.
It wouldn't be a surprise if Apple's tool did not eliminate Flashback.S: Last year, cyber criminals and Apple went several rounds over MacDefender, a family of fake antivirus programs that wriggled onto a large number of Macs. Several times, the hackers responded to Apple moves by modifying their tactics or code to sidestep just-deployed defenses.
Flashback is easily the most widespread and pernicious malware Mac owners have yet faced.
After a counting controversy, security companies last week agreed that the tally of infected Macs — thought to have dropped to as low as 30,000 — was in fact wrong, and that approximately 650,000 machines still harbored the malware.
Today, U.K.-based Sophos, using data mined from people who run its free Mac antivirus program, claimed that 2.7% of all Macs were infected with malware of some kind. Of those machines, 75% were infested with Flashback.
James tipped his figurative hat to the hackers for their persistence. "There aren't a dozen different groups behind [Flashback]," he said. "They're still hammering on the same vulnerabilities."
Clearly, the attackers are successful enough to keep at it, and keep improving their malware. James thought he knew why.
"Java is more widespread on Macs than most [Mac users] want to admit," he said, countering comments by some Mac owners who have expressed disbelief that the Flashback infection tally was as large as security companies claimed.
"Java is very easy to install, even on Lion," added James, referring to OS X 10.7, which does not include Java, but will ask the user to download it the first time he or she tries to run a Java applet. "Given the number of Macs, there are a lot of OS X people running Java."
Mac owners running either OS X 10.7 or 10.6 — the latter is better known as Snow Leopard — can protect themselves from Flashback.S attacks by updating Java using their machines' Software Update tool.
Because Apple has stopped shipping security updates for older editions — OS X 10.5, or Leopard, and all its predecessors — those users must either remove Java manually or disable it in their browsers.
About 18% of Mac owners ran Leopard or earlier on their systems last month, according to the most recent statistics from Internet metrics company Net Applications.
|
