Tweaked Trojan Disables Automatic Updating of OS X Anti-Malware Tools

MacRumors · Oct 19, 2011, 10:13 AM

Last month, we noted as part of a report on an update to the anti-malware tools in OS X that a new trojan horse threat known as Flashback.A had surfaced, with the malware masquerading as a Flash Player installer. While Apple has continued to update its XProtect.plist to detect Flashback.A, security firm F-Secure now reports (via ZDNet) that a revised version of the trojan which disables the auto-updating feature of Apple's anti-malware tools has appeared.

Quote:

There's something new brewing in Mac malware development (again).

Recent analysis has revealed to us that Trojan-Downloader:OSX/Flashback.C disables the automatic updater component of XProtect, Apple's built-in OS X anti-malware application.

The report walks through how the modified trojan overwrites XProtectUpdater files, preventing infected systems from performing their daily check for updated malware definitions and thus keeping the door open for future attacks.

Flashback.C installer

The Flashback.C trojan is capable of connecting to a remote host in order to download and execute further code, but it is unclear what the exploit is being used for at this time. Users are of course advised to download Flash Player and other software from trusted sources so as to avoid infecting their systems with trojans such as Flashback.C.

Update: MacRumors has heard and Sophos has confirmed that Apple had already updated its XProtect.plist entries to detect Flashback.C by the time news of it broke to the public. Consequently, users encountering the malware on Mac OS X Snow Leopard or OS X Lion should be automatically warned of the threat prior to mounting the package.

Article Link: Tweaked Trojan Disables Automatic Updating of OS X Anti-Malware Tools

MultiMediaWill · Oct 19, 2011, 10:16 AM

i tH0uGh7 m4c d0Nt g3T v1rus

Unggoy Murderer · Oct 19, 2011, 10:19 AM

Quote:

Originally Posted by MultiMediaWill

i tH0uGh7 m4c d0Nt g3T v1rus

They don't, this is a Trojan. Big difference

Aduntu · Oct 19, 2011, 10:21 AM

Quote:

Originally Posted by Unggoy Murderer

They don't, this is a Trojan. Big difference

Your sarcasm meter is obviously broken.

jmpnop · Oct 19, 2011, 10:21 AM

Quote:

Originally Posted by MultiMediaWill

i tH0uGh7 m4c d0Nt g3T v1rus

tRoj4n is n0t v1rus.

Sacird · Oct 19, 2011, 10:21 AM

OH noes!!!

bender o · Oct 19, 2011, 10:21 AM

Damn you Flash!! When are you gonna go extinct!! you suck!!

daxomni · Oct 19, 2011, 10:21 AM

Quote:

Originally Posted by MultiMediaWill

i tH0uGh7 m4c d0Nt g3T v1rus

The Reality Distortion Field that previously protected all Macs from all attacks appears to have dissipated.

iStudentUK · Oct 19, 2011, 10:22 AM

Quick everyone download MacDefender!

(My team of lawyers require me to note that I'm not actually suggesting anyone download MacDefender.)

roadbloc · Oct 19, 2011, 10:22 AM

It's happening more and more.

RoboCop001 · Oct 19, 2011, 10:23 AM

I don't understand why these fools waste everyone's time by writing viruses, and I mean for any platform. Can't they put that energy and effort into something positive?

igazza · Oct 19, 2011, 10:24 AM

iOS is the future

Mad-B-One · Oct 19, 2011, 10:25 AM

Quote:

Originally Posted by daxomni

The Reality Distortion Field that previously protected all Macs from all attacks appears to have dissipated.

It changed size and is only hovering over iOS at this time.

Quote:

Originally Posted by iStudentUK

Quick everyone download MacDefender!

(My team of lawyers require me to note that I'm not actually suggesting anyone download MacDefender.)

Would be a solution. Two Trojan horses fighting each other. Maybe they block each other then? Someone please try that in a VM

CodeBreaker · Oct 19, 2011, 10:25 AM

So have they managed to scare anyone?

Sacird · Oct 19, 2011, 10:25 AM

Quote:

Originally Posted by RoboCop001

I don't understand why these fools waste everyone's time by writing viruses, and I mean for any platform. Can't they put that energy and effort into something positive?

I'm actually with ya on that. I feel so bad when anyone on any platform has to deal with this crap. Lock as many up as possible and throw em in camps. Put em on a PPV where they are tortured like in Hostel, they'll learn sooner or later.

Not actually serious about torture and stuff to be clear.

ndpitch · Oct 19, 2011, 10:25 AM

Looks like this could be a leadup into needing anti-virus/anti-malware/anti-spyware on the Mac.

hobo.hopkins · Oct 19, 2011, 10:25 AM

I foresee this discussion degrading very quickly...

In reality all one needs to do is be cautious of where they are downloading files, and this wouldn't be a problem.

tubular · Oct 19, 2011, 10:26 AM

1 - how can we tell if a machine is infected?
2 - how, if infected, can we remove it, short of a clean install?

Shrink · Oct 19, 2011, 10:27 AM

Quote:

Originally Posted by MultiMediaWill

i tH0uGh7 m4c d0Nt g3T v1rus

Oh, god, here we go again with the virus vs malware vs trojan vs etc., etc.

Malware is a generic category (malicious software). Viruses, trojans, spyware and all other crap that f***ks with your computer are malware.

Macs have never been infected by a virus up to this date. Yes, it is possible sometime in the future a virus could be developed that will infect a Mac. Nothing to this date!

Trojan is NOT a virus - it is a form of malware. Unlike a virus which can infect a computer without action on the part of the user, trojans have to be invited in. In short - the user has to screw up.

The best defense is an educated user.

(GGJstudios - How did I do??

)

stage1 · Oct 19, 2011, 10:28 AM

CRAP!! I downloaded a flash update today on my macbook!

What should I do help!! I'm not joking.

Memo86 · Oct 19, 2011, 10:28 AM

Well... i was a PC user in the XP era and i didn't get any virus (and there are thousands of windows wiruses, right?) so, I think that is REALLY HARD to get your mac infected. ¿Who would download flash from other site than Adobe.com?

igazza · Oct 19, 2011, 10:29 AM

Best idea is to use chrome as your browser

RoboCop001 · Oct 19, 2011, 10:30 AM

Quote:

Originally Posted by tubular

1 - how can we tell if a machine is infected?
2 - how, if infected, can we remove it, short of a clean install?

I can't completely give you those answers but one way is Time Machine. If you're infected or fear that you are infected just restore your whole HD to a previous state.

Memo86 · Oct 19, 2011, 10:30 AM

Quote:

Originally Posted by stage1

CRAP!! I downloaded a flash update today on my macbook!

What should I do help!! I'm not joking.

If you downloaded from Adobe Updater or from Adobe.com i'm sure you're safe... if you downloaded from some pr0n site or crappy page maybe you're in trouble... :P

Unggoy Murderer · Oct 19, 2011, 10:30 AM

Quote:

Originally Posted by Aduntu

Your sarcasm meter is obviously broken.

No, not really. Functioning perfectly fine the last time I checked.

Oct 19, 2011, 10:16 AM	#2
MultiMediaWill macrumors 65816 Join Date: Aug 2010 Location: Illinois	i tH0uGh7 m4c d0Nt g3T v1rus __________________ Click here for the iPhone 5 iOS 6.0 Jailbreak! MacBook Pro 15" 2011 , 2.2 GHz Quad i7, 750GB HDD, 8GB RAM, Anti-Glare iPhone 5 32gb iPad 3 16gb
	-23

Oct 19, 2011, 10:21 AM	#7
bender o macrumors 6502 Join Date: Mar 2009	Damn you Flash!! When are you gonna go extinct!! you suck!! __________________ 13" Macbook Pro 2.4Ghz 8Gb RAM 500Gb Mid 2010; iPhone 4 32Gb 4.2.1 Jailbroken; iPad sux for studying => SOLD
	-12

Oct 19, 2011, 10:22 AM	#9
iStudentUK macrumors 65816 Join Date: Mar 2009 Location: London	Quick everyone download MacDefender! (My team of lawyers require me to note that I'm not actually suggesting anyone download MacDefender.) __________________ UK students may want to read about Apple education discounts and free student warranties here
	17

Oct 19, 2011, 10:22 AM	#10
roadbloc macrumors 603 Join Date: Aug 2009 Location: UK	It's happening more and more. __________________ Roadbloc
	3

Oct 19, 2011, 10:23 AM	#11
RoboCop001 macrumors 65816 Join Date: Oct 2005 Location: Toronto, Canada	I don't understand why these fools waste everyone's time by writing viruses, and I mean for any platform. Can't they put that energy and effort into something positive?
	31

Oct 19, 2011, 10:21 AM	#6
Sacird macrumors 6502a Join Date: May 2010 Location: Northern, VA	OH noes!!!
	1

Oct 19, 2011, 10:24 AM	#12
igazza macrumors 6502a Join Date: Aug 2007 Location: earth	iOS is the future __________________
	-10

Oct 19, 2011, 10:25 AM	#14
CodeBreaker macrumors 6502 Join Date: Nov 2010 Location: Sea of Tranquility	So have they managed to scare anyone? __________________ .
	-3

Oct 19, 2011, 10:25 AM	#16
ndpitch macrumors regular Join Date: Jun 2010	Looks like this could be a leadup into needing anti-virus/anti-malware/anti-spyware on the Mac.
	-3

Oct 19, 2011, 10:25 AM	#17
hobo.hopkins macrumors 6502a Join Date: Jul 2008	I foresee this discussion degrading very quickly... In reality all one needs to do is be cautious of where they are downloading files, and this wouldn't be a problem. __________________ Think morality requires religion? Name me an ethical statement made or an action performed by a believer that could not have been made or performed by a non-believer. I'm waiting...
	12

Oct 19, 2011, 10:26 AM	#18
tubular macrumors newbie Join Date: Oct 2011	A couple questions 1 - how can we tell if a machine is infected? 2 - how, if infected, can we remove it, short of a clean install?
	9

Oct 19, 2011, 10:28 AM	#20
stage1 macrumors newbie Join Date: Oct 2011	CRAP!! I downloaded a flash update today on my macbook! What should I do help!! I'm not joking.
	-3

Oct 19, 2011, 10:28 AM	#21
Memo86 macrumors newbie Join Date: Sep 2011	Well... i was a PC user in the XP era and i didn't get any virus (and there are thousands of windows wiruses, right?) so, I think that is REALLY HARD to get your mac infected. ¿Who would download flash from other site than Adobe.com?
	2

Oct 19, 2011, 10:29 AM	#22
igazza macrumors 6502a Join Date: Aug 2007 Location: earth	Best idea is to use chrome as your browser __________________
	0

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
thread	Thread Starter	Forum	Replies	Last Post
Disable automatic downloading of iTunes Match songs on iOS	Scriz	iCloud and Apple Services	10	Apr 10, 2012 11:35 AM
Networked Drives - Disabled Automatic Opening of Finder Window?	dylanbrown	OS X	0	Feb 9, 2011 05:28 PM
Alarm Clock Radio App - disable automatic start of iPod	hoymevoy	iPhone Tips, Help and Troubleshooting	0	Dec 29, 2010 02:20 PM
Disable automatic updates	chrisblaze	OS X	7	Aug 18, 2010 10:52 AM
disabling automatic update for ipod	jaypeebee	Mac Applications and Mac App Store	0	Oct 22, 2003 12:08 AM