Flashback trojan reportedly controls half a million Macs and counting

[Sysman]

From ars technica

Variations of the Flashback trojan have reportedly infected more than half a million Macs around the globe, according to Russian antivirus company Dr. Web. The company made an announcement on Wednesday—first in Russian and later in English—about the growing Mac botnet, first claiming 550,000 infected Macs. Later in the day, however, Dr. Web malware analyst Sorokin Ivan posted to Twitter that the count had gone up to 600,000, with 274 bots even checking in from Cupertino, CA, where Apple's headquarters are located.

We have been covering the Mac Flashback trojan since 2011, but the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant.

If you are running versions of OS X prior to Snow Leopard (10.6), then you are out of luck. No security update from Apple for this. Best just disable Java in your browser settings.

Manual check and disinfection instructions

[scooby]

Excellent post

I'm clean, but I dont know if thats because I dont use safari...

[NickFitz]

I'm always dubious about tech news sites running big-figure virus stories that originate in press releases from AV companies, but there's no doubt this is a problem.

At least ars technica's story is pretty straightforward and informative, unlike the breathless hysteria of Gizmodo, which repeats ludicrous myths like "It's written in an unknown language" - umm, it's written in C with a simple OO framework based on macros and preprocessor directives, compiled with Microsoft Visual Studio

(My Macs are clean BTW, and I use Safari.)

[Sysman]

I'm always dubious about tech news sites running big-figure virus stories that originate in press releases from AV companies, but there's no doubt this is a problem.

Seceral years ago Intego got themselves a bad name in Mac community by scare stories based on a proof of concept attack. That proof of concept worked ('cos I tried it out), but it was never seen in the wild. They are like bloody tarts.

And don't get me started on that Graham Cluley character. He's a media whore. Oh look, here's his WIki entry, which unsurprisingly says:

This article appears to be written like an advertisement. Please help improve it by rewriting promotional content from a neutral point of view and removing any inappropriate external links. (April 2009)

At least ars technica's story is pretty straightforward and informative, unlike the breathless hysteria of Gizmodo, which repeats ludicrous myths like "It's written in an unknown language" - umm, it's written in C with a simple OO framework based on macros and preprocessor directives, compiled with Microsoft Visual Studio

(My Macs are clean BTW, and I use Safari.)

They also blindly copied a subset of the instructions at F-Secure. It's bleedin' obvious that the bit that says "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist" should come straight after Point 1.

[NickFitz]

Turns out this Trojan will run away - well, delete itself - if it thinks you're too geeky: Flashback Trojan Creators Scared of Xcode, But Not Norton Antivirus - Waxy.org

[mos]

If you are running versions of OS X prior to Snow Leopard (10.6), then you are out of luck.

I am afraid that Macs became one season toys ... and version 10.6 is an ancient history, who cares. That would explain exceedingly slow reaction from the Apple.

[cojak]

I am afraid that Macs became one season toys ... and version 10.6 is an ancient history, who cares. That would explain exceedingly slow reaction from the Apple.

[Sysman]

Turns out this Trojan will run away - well, delete itself - if it thinks you're too geeky: Flashback Trojan Creators Scared of Xcode, But Not Norton Antivirus - Waxy.org

Little Snitch is the best there, since that's the one which will tell you if some malware is trying to connect to the outside world.

Dont have Little Snitch?

sudo mkdir -p /Library/Little Snitch # snigger

Or yet better, get it: Little Snitch.

[chef]

does anyone here actually use any antivirus on their mac?

[Sysman]

does anyone here actually use any antivirus on their mac?

Nope.

I did try the Sophos freebie for a while but it never reported anything and hit the bit bucket when I had a general clearout of stuff I no longer use.

If I was reading my email on Windows, then maybe I'd use an antivirus package on the Mac to squash email nasties, but I only read email on the Mac or Linux.