Janicab.A Malware Targets Computers Running OS X and Windows

Discussion in 'Mac Blog Discussion' started by MacRumors, Jul 24, 2013.

  1. macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Researchers from F-Secure, Webroot, and Avast have uncovered Janicab.A, a new trojan that was discovered as a threat to Macs last week and Windows users on Monday, with findings being published recently.

    For OS X users, Janicab.A was signed with a valid Apple Developer ID and also uses a special unicode character known as a "right-to-left override" (RLO) that is used in email malware attacks. From there, the trojan uses a YouTube page to hijack infected computers, directs them to command-and-control (C&C) servers, and then leaves the server and hides the infection by making the malware appear as a harmless PDF or DOC file.

    [​IMG]
    Webroot writes:
    This news comes after Apple updated security definitions to combat 'Yontoo', an adware trojan this past March, while also regularly dealing with Java-related vulnerabilities. Apple introduced Gatekeeper in OS X Mountain Lion in order to better deal with security threats, offering a way for users to restrict installation of apps to those signed by Apple-issued Developer IDs.

    Article Link: Janicab.A Malware Targets Computers Running OS X and Windows
     
  2. macrumors regular

    Bhatu

    Joined:
    Apr 1, 2013
    #2
    :OMG: somebody call that Researcher cum Hacker!
     
  3. macrumors 603

    whooleytoo

    Joined:
    Aug 2, 2002
    Location:
    Cork, Ireland.
    #3
    Cross-platform malware? And the Mac version was released first? Yaaaay!
     
  4. macrumors 65816

    Joined:
    Mar 10, 2003
    #4
    If it's signed with a valid developer ID shouldn't that mean Apple should've already revoked it? Which brings up a question, if Apple revokes a developer ID because of malware, does OS X notify you that was the reason? Or do they just say it's "invalid" (in which case lots of people will still right click and open it :)

    (I'm guessing the File Quarantine feature should have this added as well by now)
     
  5. macrumors regular

    Joined:
    Jul 25, 2011
    #5
    Mimic normal files using fake icons? It looks like the malware I coded in VB back to my middle school...
     
  6. macrumors regular

    iThinkIt

    Joined:
    Mar 21, 2012
    Location:
    Florida, USA
    #6
    I love the idea of getting screwed over by malware... NOT

    [​IMG]
     
  7. macrumors 6502

    jeznav

    Joined:
    Aug 10, 2007
    Location:
    Eh?
    #7
    Not all OSX users have Adobe Acrobat Reader installed. Icon FAIL.

    Should've used Preview.app PDF icon instead.
     
  8. macrumors regular

    redsoxunixgeek

    Joined:
    Dec 1, 2006
    Location:
    Salt Lake City YOOTah
    #8
    Apple's dev team is busy re-building a broken dev portal. We might have to wait until after they get us back on line to revoke certs.
     
  9. macrumors 6502

    moderately

    Joined:
    Sep 7, 2010
    #9
    I really did laugh out loud.
     
  10. macrumors G3

    charlituna

    Joined:
    Jun 11, 2008
    Location:
    Los Angeles, CA
    #10
    Tin foils would say that he created it and then dropped his attack on the developer site hoping it would delay them revoking the certificate on his malware.

    Just to see what would happen of course. He isn't trying to hurt anyone.

    Tin foils also think he is the phisher.
     
  11. macrumors regular

    Joined:
    Jun 26, 2013
    #11
    Reminds me of the script I wrote to bypass my school's proxies. I hid it as a visual C++ .cpp file.
     
  12. macrumors member

    Joined:
    Mar 2, 2013
    Location:
    Under your bed...
    #12
    But what does it actually do? :confused:
     
  13. macrumors 68030

    Joined:
    Mar 4, 2011
    Location:
    NC
    #13
    It gets an article on MacRumors

    :D
     
  14. macrumors 603

    justperry

    #14
    Scaremongering by all highlighted in Bold, I don't expect anything more from them except from MR.
     
  15. macrumors P6

    Peace

    Joined:
    Apr 1, 2005
    Location:
    Space--The ONLY Frontier
    #15
    I don't think software engineers build web pages.

    Not in this case at least.
     
  16. macrumors 65816

    Morod

    Joined:
    Jan 1, 2008
    Location:
    On The Nickel, over there....
    #16
    Yep, that'll work.
     
  17. macrumors 65816

    Nightarchaon

    Joined:
    Sep 1, 2010
    #17
    Who says apple mac users don't get software first :D
     
  18. macrumors newbie

    Joined:
    May 24, 2013
    #18
    Dude... Don't give them ideas! :p
     
  19. macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #19
    New because of the .app part maybe, but .pdf.exe is not a new approach by any means.

    Also, who here uses Adobe for PDFs? (beyond filling out that one form that didn't work right in Preview for some reason)
     
  20. macrumors regular

    moxin

    Joined:
    Feb 25, 2011
    #20
    Reminds me of that 'New Folder' virus that used to infect XP back in the days. It used XP styled folder icon. So when you are using icon packages the threat was half gone.
     
  21. macrumors 65816

    antonis

    Joined:
    Jun 10, 2011
    #21
    Still, don't get surprised if people that don't even have the adobe reader installed on their mac will still open a "pdf" that is using the acrobat icon. There are users and users.
     

Share This Page