New, sneakier Flashback malware infects Macs
Ditches all attempts at duping users with social engineered tactics, exploits Java bug through drive-by attacks
Computerworld - A new, sneakier variant of the Flashback malware was uncovered yesterday by the French security firm Intego.
Flashback.S, which Intego described Monday, uses the same Java vulnerability as an earlier version that has infected an estimated 820,000 Macs since its appearance and still plagues over 600,000 machines.
But unlike Flashback.K, the variant that first surfaced last month and has caused consternation among Mac users, Flashback.S never asks the victim to enter an administrative password for installation, but instead relies only on the silent exploit of the Java bug to sneak onto the system.
"The differences are very subtle," Peter James, a spokesman for Intego, said in an interview Tuesday. "There's no password request [by Flashback.S]."
Flashback.K used different infection tactics: Even though it exploited the same Java vulnerability -- identified as CVE-2012-0507 -- it also displayed the standard OS X password-request dialog. If users entered their password, the malware installed itself in a different location, where it was even harder to detect.
The hackers responsible for Flashback appear to be making money through click fraud, where large numbers of people are redirected to online ads not normally served by the site the user is viewing. The criminals receive kickbacks from shady intermediaries for each ad clicked.
The Java flaw used by both Flashback.S and the earlier Flashback.K was patched by Oracle in mid-February, but Apple, which maintains its own edition of Java for OS X and so is responsible for patching Java bugs, did not issue its fix until April 3, seven weeks later.
Users are infected by Flashback.S when they browse to compromised or malicious sites; the tactic is called a "drive-by" to reflect the lack of required user action beyond steering to a URL.
Some security experts have traced the Flashback infections to tens of thousands of hacked sites and blogs running WordPress.
Because Flashback.S uses different names for the files it drops on a Mac, and installs those files in a different location than Flashback.K, it's possible that the malware seek-and-destroy tool Apple released April 12 won't eradicate the variant.
James said that Intego was not able to confirm whether Apple's tool removes Flashback.S.
It wouldn't be a surprise if Apple's tool did not eliminate Flashback.S: Last year, cyber criminals and Apple went several rounds over MacDefender, a family of fake antivirus programs that wriggled onto a large number of Macs. Several times, the hackers responded to Apple moves by modifying their tactics or code to sidestep just-deployed defenses.
Flashback is easily the most widespread and pernicious malware Mac owners have yet faced.
After a counting controversy, security companies last week agreed that the tally of infected Macs -- thought to have dropped to as low as 30,000 -- was in fact wrong, and that approximately 650,000 machines still harbored the malware.
- Mac Pro shortage sets record as worst Mac production debacle
- Apple slates WWDC for June 2-6, sets up ticket lottery
- Apple patches Safari's Pwn2Own vulnerability, two-dozen other critical bugs
- Microsoft's free OneNote vaults to top of Mac App Store chart
- Apple discounts iPhone 5C 8%-9% in five markets via storage cuts
- Apple hands stock worth $12.1M to top execs in retention deal
- Hands on: Apple's Mac Pro is the fastest Mac ever
- Apple CFO to retire in September after he cashes in $53M stock award
- Apple's CarPlay to spark mobile apps war in your car
- Apple retires Snow Leopard from support, leaves 1 in 5 Macs vulnerable to attacks
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Malware and Vulnerabilities White Papers | Webcasts