Trojan BackDoor.Flashback

Trojan BackDoor.Flashback, commonly referred to as the Flashback Trojan, is a Trojan horse affecting personal computer systems running Mac OS X.[1][2] The first variant of Flashback was discovered by antivirus company Intego in September 2011.[3]

Infection

According to the Russian antivirus company Dr. Web, a modified version of the "BackDoor.Flashback.39" variant of the Flashback Trojan has infected over 600,000 Mac computers, forming a botnet that includes 274 bots located in Cupertino, California.[4][5] The findings were confirmed one day later by another computer security firm, Kaspersky Lab.[6] This variant of the malware was first detected in April 2012[7] by Finland-based computer security firm F-Secure.[8][9] Dr. Web estimated that in early April 2012, 56.6% of infected computers were located within the United States, 19.8% in Canada, 12.8% in the United Kingdom and 6.1% in Australia.[5]

Details

The Trojan targets a Java vulnerability on Mac OS X. The system is infected after the user is redirected to a compromised bogus site, where JavaScript code causes an applet containing an exploit to load. An executable file is saved on the local machine, which is used to download and run malicious code from a remote location. The malware also switches between various servers for optimised load balancing. Each bot is given a unique ID that is sent to the control server.[5] The trojan, however, will only infect the user visiting the infected web page, meaning other users on the computer are not infected unless their user accounts have been infected separately.[10]

Resolution

Oracle, the company that develops Java, fixed the vulnerability exploited to install Flashback on February 14, 2012.[7] However, Apple maintains the Mac OS X version of Java and did not release an update containing the fix until April 3, 2012,[11] after the flaw had already been exploited to install Flashback on 600,000 Macs.[12] On April 12, 2012, the company issued a further update to remove the most common Flashback variants.[13] The updated Java release was only made available for Mac OS X Lion and Mac OS X Snow Leopard; the removal utility was released for Intel versions of Mac OS X Leopard in addition to the two newer operating systems. Users of older operating systems were advised to disable Java.[11] There are also some third party programs to detect and remove the Flashback trojan.[12] Apple is working on a new process that will eventually lead to a release of a Java Runtime Environment (JRE) for Mac OS X at the same time as it is available for Windows, Linux, and Solaris users.[14] As of January 9, 2014, about 22,000 Macs are still infected with the Flashback trojan.[15]

See also

References

  1. ↑ 5 April 2012, Flashback Trojan botnet infects 600,000 Macs, Siliconrepublic
  2. ↑ 5 April 2012, 600,000 infected Macs are found in a botnet, The Inquirer
  3. ↑ September 26, 2011, Mac Flashback Trojan Horse Masquerades as Flash Player Installer Package, Intego Security
  4. ↑ Jacqui Cheng, 4 April 2012, Flashback Trojan reportedly controls half a million Macs and counting, Ars Technica
  5. 1 2 3 4 April 2012, Doctor Web exposes 550 000 strong Mac botnet Dr. Web
  6. ↑ Chloe Albanesius, 6 April 2012, Kaspersky Confirms Widespread Mac Infections Via Flashback Trojan, PCMag
  7. 1 2 "Half a million Mac computers 'infected with malware'". BBC. April 5, 2012. Retrieved April 5, 2012.
  8. ↑ April 2, 2012, Mac Flashback Exploiting Unpatched Java Vulnerability F-Secure's News from the Lab
  9. ↑ 11 April 2012, Apple crafting weapon to vanquish Flashback virus, Sydney Morning Herald
  10. ↑ http://reviews.cnet.com/8301-13727_7-57410096-263/how-to-remove-the-flashback-malware-from-os-x/
  11. 1 2 "About Flashback malware". Apple. April 10, 2012. Retrieved April 12, 2012.
  12. 1 2 "flashbackcheck.com". Kaspersky. April 9, 2012. Retrieved April 12, 2012.
  13. ↑ "About Java for OS X Lion 2012-003". Apple. April 12, 2012. Retrieved April 12, 2012.
  14. ↑ "Mac Security: A Myth?". eSecurity Planet. April 13, 2012. Retrieved April 16, 2012.
  15. ↑ "It's alive! Once-prolific Flashback trojan still infecting 22,000 Macs". January 9, 2014. Retrieved January 9, 2014.

External links

This article is issued from Wikipedia - version of the Saturday, December 12, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.