Flashback trojan reportedly controls half a million Macs and counting
arstechnica.com
arstechnica.com
I guess it was just amazing to me how disinformation like that flows so freely. It probably started out with the caveats but eventually got boiled down to "Macs never get viruses". And what computer company is going to publicly correct that statement?
Edit: It appears this uses a Java vulnerability, rather than the fake-Flash Player-installer that it was originally reported using (possibly an older variation of the same malware). So that's no longer accurate!
From the article:
>..the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant.
>..the malware installs itself after you visit a compromised or malicious webpage, so if you're on the Internet, you're potentially at risk.
Where is the social engineering part?
From the F-Secure site: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb...
On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done.
If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.
It specifically states that the malware will infect the machine even if the user does not give permission.
Originally, when it was just us geeks using computers, 'virus', 'malware', 'trojan', etc. where different terms for different things.
Now a days, 'virus' is used by the general public & media to refer to any sort of bad programme that should be removed.
To be fair, their slogan is currently "Macs don't get PC viruses" [1]. Which is true. Although, devilishly close enough to blur the two in somebody's mind.
Pretty clear.
They are implying that viruses are a severe problem on PCs that Mac users do not face. This was undoubtedly true when they were running those adverts.
They're saying PCs get viruses and Macs don't because of the way it's designed. Not that PCs get PC viruses and Macs get Mac viruses.
They are also implying that it's the sole reason for the lack of viruses, when it's mainly the lack of users. That would explain why it's not susceptible to every other type of software available on Windows.
I guess they should be "thanking" the general incompatibility with Windows binaries.
1. "A Mac is susceptible to viruses. But it is not susceptible to viruses plaguing Windows-based computers."
2. "A Mac isn’t susceptible to viruses, whereas a Windows-based computer is susceptible to thousands of viruses."
The fact that you still get viruses, but they just don't happen to be the same viruses, isn't worth stating. So as a customer, it is very unlikely that I would infer the former (Meaning 1) from the statement. Yet it is what is meant.
I would personally call this misleading (and dangerously close to lying).
I know I'm playing semantic games here, but so is Apple with this slogan :)
I had a long time Apple user ask me if I had a Mac or PC. I was using Ubuntu Linux at the time, so I said PC :P
The term "PC" persists not just for historical reasons, but because its hard to come up with a replacement term. A "Mac" refers both to hardware and the OS, whereas a "PC" means "Windows OS running on Windows-compatible computer". I suppose we could replace the term "PC" with "WOS-ROWCC".
Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage.
OSX is still dramatically safer in terms of your actual risk of a random remote attack. Whether this is economics or superior engineering, or how Windows and OSX stand up to deliberate attackers, I will not pretend to know.
Neither are trojans, and that is exactly why this trojan has manifested so successfully. Windows users are mostly hardened to the basic threats of the internet (don't open a random exe etc), and are cognizant of the reality that malicious software does target them. Non-technical Mac users have been lulled into a false sense of security that will eventually make them a more vulnerable target than a Windows user (as Win7 and OSX pretty much stand shoulder to shoulder in terms of security).
OSX is still dramatically safer in terms of your actual risk of a random remote attack.
What is your evidence for this?
In fact, it hit my house twice, and I'm not exactly incompetent: Win7, Security Essentials, kept on top of Windows Update, no admin privileges for little brother or mom, updated Firefox, etc. The last time, it turned out we were behind on Java updates - it popped up in the systray 5 or 6 times a day for a few months and the few times my dad tried to allow the update, it failed. I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off. Did a scan... MSE was showing me 20 different Java exploits and "Anti"virus 2012 wouldn't let me open Firefox again outside of safe mode. Not something my parents would be able to deal with when I'm not there; they would have had to pay somebody. Its replacement will be a Mac; they like OSX better anyway.
I worked for a small-business IT firm for 3 summers and have never seen or heard of OSX malware except from the blogosphere/HN/media. We took our clients' security pretty seriously - corporate domains, enforced Automatic Updates, no idiots with local admin, corporate endpoint antivirus, antivirus in the spam filter, Sonicwalls, Firefox wherever possible, etc. Still, we got virus calls pretty frequently. I would usually babysit the reinstalls at a reduced rate, but when I wasn't interning, businesses were shelling out $150/hour for that. To be fair, most were XP, but there were a few virus calls for Win7.
I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data. Again, just as many family friends running OSX as Windows; I've had Macs die (my MBP's motherboard gave out right after 4 years), I've had Macs run out of disk space, I've had the PowerPC/Intel switch lose my family a lot of money because perfectly good ~2006 machines can't run a modern OS or Flash/Firefox/iTunes, but I've never seen malware for OSX.
I'm curious what you think about Malwarebytes Anti-Malware - this was the only product that was able to clean my father's Win7 PC for Antivirus 2012 (by booting into safe mode with networking and running the cleaner). Paid for the Pro version. A little difficult to get working with the Symantec virus scanner but worth every penny for not having to make the trip to my parents to clean malware since...
So what? I've reinstalled Windows three times since Windows 7, and it's never been due to a virus. The last company I worked at was a Windows shop that also had 0 malware problems. Anecdotes are pointless in this discussion.
I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off.
Yes, your brother was the victim of a social engineering attack, the exact technique used to infect these Mac users. Windows systems aren't inherently less secure, and every terrible ailment described in your post is the result of voluntary action taken by the user.
I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data.
No. The onus is on you to demonstrate how Windows 7 is inherently less secure than OSX. You're making vague assertions about how Windows is less secure but you haven't given specific examples of why that is true, only anecdotes that anyone can counter (or bolster) with personal exeprience.
The bottom line is, short of 0-days, both systems are equally secure.
>every terrible ailment described in your post is the result of voluntary action taken by the user.
No, it was a remote Java exploit. The dialog was to get you to pay for it after it had already installed.
The point is that despite all this talk about OSX viruses, malware is still not a part of day-to-day life with Macs to anywhere near the extent it is with Windows (when you include XP).
Well what version of OSX are you using to make your comparison? SP3 to 10.8? Either way, there isn't some nebulous security gap between OSX and Windows, vulnerabilities exist in all systems and a responsible vendor patches them when they're discovered.
Please show me how to remotely compromise an up to date SP3 machine. Yes, there are exploits that exist at points in time, but the same is true of OSX, just google "OSX exploit".
malware is still not a part of day-to-day life with Macs to anywhere near the extent it is with Windows
All that proves is that there is more malware targeting Windows, it speaks nothing to the inherent security of the system since malware can't install itself.
Couldn't disagree with you more.
Actual risk of a _targeted_ attack is a different matter.
It certainly was in the WinXP years due to a far superior security model, but I'm curious if this is still the case with modern windows.
Mac culture has been less user-hostile for a long time so Mac apps usually have e.g. automatic updaters (and rarely the crazy login-to-vendor-website-to-download insanity) and lack installers, making it less common to require authentication or slop things around the entire filesystem. This is not perfect but it avoids some of the pathologies which Microsoft (and Chrome) are slowly dragging the Windows community out of.
That's because the market share of Mac is so small that no smart virus developer would even bother wasting their time creating one.
On the other hand, create a powerful virus for Windows and the next day your on CNN.
Contrast that with typical Windows situation where no user cooperation is required to get infected.
They'd only make their computer slower but hey, it's their choice.
Unless Apple started injecting payloads there's basically no plausible way to get her infected. She doesn't even "browse the net" for the most part, doesn't click on links, doesn't give a f.
There are safe habits. AV companies would like to have you thinking you're always about to have your nix based system rooted, but this is damn unlikely for most people not using dodgy sites. I fancy my chances to get struck by lightning above her chances of having her system compromised, and I don't get out of my house scared.
Also, it is way easier to attack a desktop than a server. Desktop users are more careless than server admins and have many more different applications malware can use to gain access: im apps, browsers, media players, pdf viewers, flash runtimes, etc. To attack a server you have to find an exploit using an http, ftp or ssh request to a limited and more secure, in general, set of programs.
Apple is growing very fast and it is finding itself in that position now. You can see that in the new security measures of the Mac App Store. By limiting what apps itself can do you limit what malware gaining access to those apps can do. Maybe Microsoft should have done something similar to prevent Windows from being the virus hub.
>lso, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible
What? Does that mean that some Windows viruses were written by Mac fanboys to make Windows look bad?
> But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses
How? Can you explain what you mean by Windows having a unique vulnerability that is not present on a Mac?
> Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering,
Again, this is a drive by exploit from a web page, not social engineering. Why is this so hard to grasp?
Servers have a lot more information (thousands of credit cards, email addresses, passwords, etc.) than desktops. Criminals who seek personal gain rather than just mayhem would target servers.
> Does that mean that some Windows viruses were written by Mac fanboys to make Windows look bad?
No. To use sociological terms, Windows was the dominate group, Mac OS X the subordinate. When Mac OS X was starting to come into vogue in the first half of the 2000s, there were many fanboys that kept bragging about how their computers were infinitely better than "PCs", and everyone who grew up in the 90s and 2000s has surely had conversations with Windows users, often gamers or early /b/ users, who had almost a religious vitriolic hatred towards every aspect of Apple--Mac OS X, Mac computers, fanboys, "one-button mice", etc. Now that Mac OS X is accepted as a well designed OS, those fanboys and that hatred seem to be much less visible, although now lots of people dislike Apple for becoming the new Microsoft with regards to patent lawsuits, but I digress. The point is that whenever such vitriol exists, there are people dying to prove that they're right, in this case that Mac OS X wasn't immune to viruses like the "mactards" (that's one of the terms they called Apple fanboys) claimed. Did you really not witness this phenomenon of hatred in the early 2000s?
> How? Can you explain what you mean by Windows having a unique vulnerability that is not present on a Mac?
Mac OS X is essentially the Aqua window system atop Darwin, the OS's underlying system that descends from FreeBSD. As a form of UNIX, it does not give non-root users direct kernel access. Windows doesn't have this very logical restriction, and more and more ways are discovered to exploit this. Windows Vista and 7 have tried to mend this flawed infrastructure by asking users to explicitly authorize everything, but we all know how that's worked out.
> Again, this is a drive by exploit from a web page, not social engineering.
Escalation was allowed from the JRE vulnerability, but it was my understanding that initial authorization had to be given to run it. Edit: I just reread the article and it appears that this was a self-installing trojan. If that's the case, that certainly shows that vulnerabilities that allow self-installation as opposed to just privilege escalation do show up in Mac OS X from time to time, but from my limited experience, the main way to make use of trojans targeting Mac OS X is to use social engineering to install them (e.g. take advantage of the fact that Finder hides file extensions by default, and then change an executable's icon to that of an image, and then preserve the metadata in an archive) and then take advantage of a security vulnerability that allows privilege escalation. Such vulnerabilities are incredibly rare in Mac OS X since unlike Windows, kernel space is isolated from users.
That's just flat wrong and hasn't been true for an OS Microsoft has supported for mainstream use since 2003 [1]. Windows XP and all current Windows releases are based on the protected NT kernel which debuted in 1993 (with Windows NT 3.1). In fact, Microsoft and Apple stopped shipping OSes with unprotected kernels in the same year (2001) with Windows XP and OS X "Cheetah", respectively.
Look, Microsoft has made a lot of mistakes with respect to security (bad defaults, running as Administrator too often, too many low-level bugs, ...). Since OS X, Apple has had a much better security track record. That's why it is so frustrating to see people criticize Microsoft for mistakes they fixed a long time ago instead of focusing on current (or at least recent) issues.
[1] When Microsoft downgraded Windows 98/98SE/ME to paid support and critical security fixes only: http://support.microsoft.com/gp/lifean18
Second, I didn't imply that prior versions Mac OS X didn't have kernel protection, I implied that prior versions of Mac OS didn't have kernel protection. This is indisputably true (see: Mac OS 9). Personally, I find Windows / Mac OS parallel surprisingly close here: Windows ME is to Windows XP as Mac OS 9 is to Mac OS X Cheetah.
Third, UAC (User Account Control), the access control introduced with Windows Vista, is almost entirely unrelated to kernel protection (except that UAC would probably be pointless without it). The problem UAC tries to solve is "users running as an administrator too often", not "the kernel isn't protected from user programs". In other words, it is Windows' answer to sudo, not a fundamental change to the Windows kernel.
Is this just to prevent itself from infecting someone's computer that might be able to study it?
I guess false negative was ok in this case. ;)
I got the "does not exist" result anyway, despite not having any of the software listed installed except for Java.
I take requests from LS pretty seriously so it makes sense that they would do it. I would google the process and port if a random request occured.
This particular exploit is not a great example, since they removed Java by default. But all the other cross-platform software that is included is worrisome if not prompty updated.
Completely unknown? It's on the market almost for 20 years.
Java is plenty widespread. It's a good bet that most systems are going to end up with a JVM on disk somewhere after 6 mo - 1 yr of usage.
(And: The same people who install Eclipse, Minecraft, LibreOffice, or Photoshop are also more likely to have one of the apps that Flashback avoids co-habitating with: Little Snitch, Xcode, etc.)
It's simple to buy and install and get working. There is no reason to assume that Mac users running Minecraft are going to also have Xcode or Little Snitch.
Oh.
Unfortunately Chrome only allows you to "run all plug-ins" on a site or "block all plug-ins", so there's still a possibility of enabling Java when you meant to enable flash to view a video. However, it's probably a good first step against attacks like these.
I also run under a regular user account without direct sudo access, so any action that modifies system files should request an admin password. Jeff Atwood (codinghorror.com) had a good post about this for Windows: http://www.codinghorror.com/blog/2007/06/the-windows-securit...
Maybe it's time to get a Mac?
But as a recent convert to the Linux desktop, I kinda hope so.
Evidence for point 1: Windows has such a large base of "desktop" applications with a larger base of active developers. Not only that, the majority of the world uses their standards for word processing, spreadsheets, presentations, etc. Honestly, OpenOffice and GoogleDocs are both still horrid. Horrid. Compared to Word 2010 on both Windows computers and OSX-based computers. Guess what? Most of the world, including us techies, still need to present, write documentation, yadda yadda. Perhaps when/if someone else develops an open/Ubuntu/RedHat/etc office suite that can actually match MS Office in ease of use and in reliability, then I'll change my mind.
Evidence for point 2: Android has grown quickly in the past three years because (in my opinion) of personalization, novelty, hardware, and free angry birds (maybe not). Android being "open" really...doesn't make a big deal to your average consumer (again, this is my opinion based on what I've seen). The big issue that's splitting through the three major draws for Android-based devices is massive fragmentation. On the device side, there are so many Android phones that ALL LOOK THE SAME (but are slightly different), that come out every other week, the novelty of owning "THE NEWEST ANDROID PHONE" dies out every other week. The fragmentation between devices is also massively confusing to the average consumer. Does the consumer want...the Galaxy S II...the Galaxy Nexus Prime...or the Nexus S? And by the way, what's the difference between all six (there are four flavors of the Galaxy S II) of these phones?? Software fragmentation is also leading to a fairly horrid user experience as developers have to develop for 2.3, 3.2, and 4.0.4. Never-mind that the UI actions for each of these OSes are very distinct and different, the UI LOOKS COMPLETELY DIFFERENT.
I don't know. I'm using a RAZR (first on 2.3 and now on 4.0.4) and I'm still not satisfied with Android. This is coming from one of the first adopters of the G1 (which I still have, and it still functions). I am eagerly waiting for the next generation (after the 900) of Windows phones.
(Wow, this didn't mean to turn into a rant...but hum.)
Unfortunately, Windows 8 tablets and the hypothetical Windows 8 phone that turns into a full desktop when you hook it into a monitor will both run on the ARM architecture. These are not binary compatible with existing Windows executables.[1] This means that any advantage that Windows has in quantity of applications does not translate to new types of devices. When it comes to phones and tablets, unless Windows gets the market share first, there will not be (m)any "killer apps" for the new platform that aren't first-party Microsoft apps. I'm not sure that Microsoft Office is important enough on mobile devices to convince everyone to switch.
The largest advantage that Windows traditionally had (almost all the apps are written for it) is gone as soon as you make the switch to ARM.[1]
[1] https://en.wikipedia.org/wiki/Windows_8#Software_compatibili...
http://www.anandtech.com/show/5688/apple-ipad-2012-review/19
Then again, that's hollywood.