Koobface worm targets Mac users on Facebook, Twitter
Malicious Java applet shows that Apple's smart to dump Oracle's technology, says researcher
Computerworld - A new variant of the Koobface worm that targets Mac OS X and Linux as well as Windows is spreading through Facebook, MySpace and Twitter, security researchers warned today.
Antivirus firms first reported the malware, dubbed "Boonana," on Wednesday when Intego and SecureMac, two Mac-only security vendors, warned Mac OS X users that the worm was aimed at them.
Boonana spreads via messages posted to social networking or microblogging sites. Those messages bait the trap with the subject "Is this you in the video?" and a link to a malicious site. People who bite and click the link are then prompted to run a Java applet.
That applet is key to the malware's cross-platform capabilities, said Symantec in a note posted to its research blog.
"The [malware] is written in Java, which is a platform independent language," said Symantec researcher Jeet Morparia. "Individual modules contain Java compiled files, which are packaged in a Java runtime executable. As long as a computer has the Java Runtime Environment (JRE) installed on it, which is often the case across all the platforms, the threat can execute itself."
Intego and Symantec noted that the worm includes several components, including an IRC connector used by the hacker to issue commands to hijacked computers, a keylogger to steal usernames and passwords, and a rootkit to hide it from security software.
Functionally, Boonana works the same as the better-known Koobface Windows worm. Koobface has been actively infecting Windows PCs for more than two years, although virulent forms used in large-scale attacks didn't appear until early 2009.
Koobface, an anagram of Facebook, is best-known for infecting PCs through spammed messages on the giant social networking service.
According to Symantec, Boonana includes a component that reads browser cookies of users logged into Facebook, then posts additional bogus messages and links on the site using those Facebook accounts.
A Facebook spokesman downplayed the threat, saying in an e-mail reply to a request for comment that it was a "small-scale attack." As is its practice, Facebook has blocked access to accounts compromised by Boonana in an attempt to quell the malware outbreak.
Marc Fossi, the director of Symantec's security response team, echoed Facebook, saying that his group had tracked a number of infection attempts, but that the number was "not in epidemic proportions."
The important element in Boonana, Fossi continued, is its cross-platform infection ability, courtesy of Java, which is installed on many Windows, Mac and Linux machines. Such threats are rare, he added, as he cited the one example he was familiar with. "I recall [just] one piece of malcode from a few years back that affected Windows and OS X, but I believe it was proof of concept and didn't really go anywhere," he said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts