ID: IRCNE2012041480
Date: 2012-04-24
According to "zdnet", the Flashback Trojan that infected over 600,000 Apple Macs earlier this month still reportedly has a very high infection rate, despite the fact that Apple has already patched the Java vulnerability and released a removal tool. Now, security firm Intego says it has discovered a new Flashback variant that installs without prompting the user for a password.
This version, which Intego refers to as Flashback.S, places its files in the user’s home folder, at the following locations:
- ~/Library/LaunchAgents/com.java.update.plist
- ~/.jupdate
Once Flashback.S is done installing itself, it then deletes all files and folders in ~/Library/Caches/Java/cache to hide remove the applet from the infected Mac. This is done to avoid detection or sample recovery, according to the security firm.
Flashback was initially discovered in September 2011 masquerading as a fake Adobe Flash Player installer. A month later, a variant that disables Mac OS X antivirus signatures updates was spotted in the wild.
In the past few months, Flashback has evolved to exploiting Java vulnerabilities. This means it doesn’t require any user intervention if Java has not been patched on your Mac: all you have to do is visit a malicious website, and the malware will be automatically downloaded and installed.
By the way, two other Mac-specific Trojans have been discovered since Flashback’s hype: one that also exploits Java and another that exploits Microsoft Word. Security firm Kaspersky recently confirmed what many have been saying for years: as Macs are becoming more popular, malware writers are increasingly targeting them.
My advice to Mac users remains the same. Get the latest security updates from Apple. Disable Java if you don’t use it. Install an antivirus.
Related Links:
Infected WordPress blogs blamed for Mac Flashback Trojan
Java Exploits are the Most Reliable Vulns
New Mac OS X Trojan
New Mac OS X Trojan
Apple working on Flashback removal tool
Web tool checks if your Mac is Flashback
Java update for OS X
New malware exploiting unpatched Java vulnerability in Macs
- 2