600,000 Macs Worldwide Reportedly Infected by Flashback Trojan

[pooprscooper]

Thanks for your reply GJJstudios. That makes sense now. I feel kinda dumb for totally forgetting I never even installed java when I set up my new iMac recently. Does the fact I never installed java decrease, increase or not change my vulnerability to this Trojan?

If you don't have Java on your system, or you have an up-to-date version of Java, you have 0% chance of being infected by this.

 

[LostSoul80]

Every single day.

 

[RMDI]

What's the easiest way to determine if you're infected?...

In terminal run:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

You should get this error:

The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist

Then run:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

You should get this error:

The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

If you do you are clean of this variant!
If this doesn't happen go here to fix it:
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

 

[Roc P.]

If you don't have Java on your system, or you have an up-to-date version of Java, you have 0% chance of being infected by this.

Oh wow good to know. I will still check my machine when I get home just in case.

 

[OldSchoolMacGuy]

Because Apple is the only business in Cupertino that uses Macs.

 

[Lershac]

Before going into panic mode, try to analyse what you have here. End user has to manually accept a self sign certificate from "Apple" for a Java application. One has to be very dumb to do that.

You cannot protect ignorant people, even if you like.

Difference here is that you only get infected if you explicitly allow malware to run. In MS world you get infected without even knowing it.

Thank god its that way in windows or I would starve lol.

 

[GGJstudios]

It can not write to /Applications/Safari.app/ if you didn't manually give it your admin credentials(assuming you even have it in the first place)... It can not keylog you or spread to other accounts or computers. It can not touch anything outside your limited user account without you manually giving it permission to do so. You have no clue what you're talking about.

Here's a little experiment you can try to prove to yourself that I do, indeed, know what I'm talking about.

1. Right-click on your Desktop and select "New Folder".
2. Browse in Finder to your /Applications folder
3. Right-click on Safari.app and select "Show Package Contents"
4. Double-click on "Contents", then on "Resources"
5. Drag the folder you created in step 1 to the Resources folder
6. Now close all Finder windows
7. Go back and repeat steps 2-4 and verify that the folder you created is in Safari.app
8. Notice that at no point in time were you prompted for your admin password

You can modify the contents of the /Applications folder without elevated privileges. Many apps are installed simply by dragging them to that folder... no password required.

 

[pooprscooper]

Here's a little experiment you can try to prove to yourself that I do, indeed, know what I'm talking about.

1. Right-click on your Desktop and select "New Folder".
2. Browse in Finder to your /Applications folder
3. Right-click on Safari.app and select "Show Package Contents"
4. Double-click on "Contents", then on "Resources"
5. Drag the folder you created in step 1 to the Resources folder
6. Now close all Finder windows
7. Go back and repeat steps 2-4 and verify that the folder you created is in Safari.app
8. Notice that at no point in time were you prompted for your admin password

You can modify the contents of the /Applications folder without elevated privileges. Many apps are installed simply by dragging them to that folder... no password required.

Create a bash file to do the following and see if it works.

Infection Type 1

If the user inputs their administrator password, the malware will create the following files:

/Applications/Safari.app/Contents/Resources/.%decoded_filename%.png - contains %decoded_binary1_contents% and %decoded_payload_config%
/Applications/Safari.app/Contents/Resources/.%decoded_filename%.xsl - contains %decoded_binary2_contents%
The malware then creates a launch point, inserting the following line into "/Applications/Safari.app/Contents/Info.plist":

<key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key>
<string>/Applications/Safari.app/Contents/Resources/.%decoded_filename%.xsl</string></dict>
This in effect will inject binary2 into Safari when the browser is launched.

If the malware was able to infect the system this way, it reports success to the following URL:

h t t p ://95.215.63.38/stat_d/
If it failed to infect the system, the malware reports to the following URL:

h t t p ://95.215.63.38/stat_n/

Infection Type 2

In cases where the user did not input their administrator password, the malware checks if the following path exists in the system:

/Applications/Microsoft Word.app
/Applications/Microsoft Office 2008
/Applications/Microsoft Office 2011
/Applications/Skype.app
If any of these are found, the malware again skips the rest of its routine and proceeds to delete itself, presumably to avoid infecting a system that has an incompatible application installed.

If none of the incompatible applications are found, the malware will create the following files:

~/Library/Application Support/.%decoded_filename%.tmp - contains %decoded_binary1_contents% and %decoded_payload_config%
/Users/Shared/.libgmalloc.dylib - contains %decoded_binary2_contents%
The malware then creates a launch point by creating "~/.MacOSX/environment.plist", containing the following lines:

<key>DYLD_INSERT_LIBRARIES</key>
<string>/Users/Shared/.libgmalloc.dylib</string>

It can not modify "/Applications/Safari.app/Contents/Info.plist" without you manually giving it permission to do so.
Neither does it modify pages you visit on anything other than Safari. Firefox/Chrome/Opera users aren't affected at all even if this on your machine.
It can not keylog you either unless you give it permission to do so. This perticular Trojan doesn't keylog anyways, if you do decide to give it permission.

 

[Starhorsepax]

Nice theory but it doesn't work in practice. Apple isn't releasing updates for the TENS OF MILLIONS of older computers that don't run the recent OS. Apple has abdicated both their responsibility to users and to shareholders.

Apple should be keeping the existing users safe. They built Macs to last and they do. But they need to be kept upgraded and Apple's not allowing that because they stop supporting older hardware.

Apple's not doing their fiscal duty to shareholders because they're abandoning all the profits they could be making from selling upgrades and support to the users of the older Macs. There is a lot of money Apple could be making by continuing to support the old hardware.

More over, Apple should support the old hardware from an environmental green principle. Don't throw it out just because new hardware comes out. Old computers still work fine. Pass them on.

Here Here. Says the person who can't upgrade past Snow Leopard and still has a imac with Panther. Call me sentimental. Or broke. I can't afford a new computer.
OF course....the imac can't get on the net' anyway, because I can't find a web browser that'll work anymore and if I did the sites wouldn't support it. But it does get light use and share files with my other mac.

I was grateful I already had Clamxav installed when I found out the trojan would decide my mac was not an appealing target. I mainly installed it to make sure I didn't pass anything onto PC users. Just for security sake, I rarely pay attention to those Flash pop ups. I always double check on the Adobe site just to be sure it's the real deal.

Has anyone else had issues with software updates or the Apple site lately? I had trouble installing any updates, even the java one. And sometimes I go to the support or discussions and they redirect me to the main page. That becomes rather urgent when it's a security upgrade you need.

 

[D.T.]

Here's a little experiment you can try to prove to yourself that I do, indeed, know what I'm talking about.

1. Right-click on your Desktop and select "New Folder".
2. Browse in Finder to your /Applications folder
3. Right-click on Safari.app and select "Show Package Contents"
4. Double-click on "Contents", then on "Resources"
5. Drag the folder you created in step 1 to the Resources folder
6. Now close all Finder windows
7. Go back and repeat steps 2-4 and verify that the folder you created is in Safari.app
8. Notice that at no point in time were you prompted for your admin password

You can modify the contents of the /Applications folder without elevated privileges. Many apps are installed simply by dragging them to that folder... no password required.

Just tried this and got prompted to authenticate the operation.

 

[subsonix]

Curious to know where they got this number from, how can they know etc.

 

[pooprscooper]

has a imac with Panther.

.the imac can't get on the net' anyway, because I can't find a web browser that'll work anymore and if I did the sites wouldn't support it.

Have you tried Opera or iCab? They support Panther.

 

[GGJstudios]

Just tried this and got prompted to authenticate the operation.

It appears to depend on which version of Mac OS X you're running, whether it prompts or not.

 

[peb123]

How is it important that is a trojan and not a virus?? Are you happy to have Trojans on your computer??

Running Avast on my PC I feel very safe at the moment. I am less cocky on my mac though. The current detection system for mac malware seems to be news headlines..... its the windoze guys who are laughing at us, a click of a button, they can scan their systems with the latest nightly malware/virus definitions.

...Then those Windows users have a false sense of security. I had a PC infected with Torpig that no virus scanner could detect, and was fully protected and up to date. I only detected it after blowing the partition away and starting from scratch. Was hiding in the boot sector. I'm still not sure how it got infected.

I'm not saying that a virus scanner is not a good idea, its just you should not trust that you are safe even with scanners and security updates.

 

[D.T.]

It appears to depend on which version of Mac OS X you're running, whether it prompts or not.

Oh yeah, sorry, I should’ve indicated my version for reference: Lion 10.7.2



I’ll check it out on our SL machine too.

Same behavior: Snow Leopard 10.6.8

 

[adamw]

I was infected with this!

I checked, and sure enough my Mac Pro running Lion 10.7.3 with all updates installed (including the Apple Java update from 2 days ago) was INFECTED with this trojan!

I followed the F-Secure instructions, found out where the offending files had been installed, and followed the removal procedure. Getting this trojan through the previously unpatched Java exploit rattled me a bit, as I felt Macs were safer than this. This Java exploit was fixed by Oracle back in February, but it took Apple until 2 days to release the updated Java patched version.

So even if you ran the latest Apple Java update that was recently released 2 days ago, check via Terminal to make sure you weren't infected before that date via the Java exploit, as mine was.

Turns out my Mac was infected around March 3rd (from the date the trojan was installed), so who knows what data they scammed from my Mac in the last month. Hopefully I am free of this trojan now, but I am not at all pleased with finding out I was infected, and my Mac system was compromised.

 

[geesix]

Im I infected?

I typed this in to terminal and this is what came up...

THANKS

 

[D.T.]

I typed this in to terminal and this is what came up...

defaults read/Applications/Safari.app/Contents/Info LSEnvironment
Command line interface to a user's defaults.
Syntax:

Or did I not do it right?

The syntax response means it was not entered correctly, and that could be simply because you do not appear to have a space between read and the path.


The command has 4 parts:

defaults
read
<path>
<key>

that should be separated by a space (so the parser can delineate the different parts).

 

[pooprscooper]

I checked, and sure enough my Mac Pro running Lion 10.7.3 with all updates installed (including the Apple Java update from 2 days ago) was INFECTED with this trojan!

I followed the F-Secure instructions, found out where the offending files had been installed, and followed the removal procedure. Getting this trojan through the previously unpatched Java exploit rattled me a bit, as I felt Macs were safer than this. This Java exploit was fixed by Oracle back in February, but it took Apple until 2 days to release the updated Java patched version.

So even if you ran the latest Apple Java update that was recently released 2 days ago, check via Terminal to make sure you weren't infected before that date via the Java exploit, as mine was.

Turns out my Mac was infected around March 3rd (from the date the trojan was installed), so who knows what data they scammed from my Mac in the last month. Hopefully I am free of this trojan now, but I am not at all pleased with finding out I was infected, and my Mac system was compromised.

If you don't use Safari, then it hasn't manipulated any webpages you've visited. It doesn't keylog you either. I would suggest getting LittleSnitch for your Mac, even if having nothing to do with this particular Trojan. If something did get on your system in the future, and it attempted to communicate with someone outside of your computer, LittleSnitch would warn you and let you choose whether to let it communicate.

I personally disable Java and any other plugins in all my browsers to begin with. Unless you have a reason to use Java regularly, you should disable it.
For Safari, just move the Java files located @ /Library/Internet Plug-Ins/ to /Library/Internet Plug-Ins/Disabled Plug-Ins/
For Firefox and Chrome, just type

about:plugins

in the address bar.

 

[geesix]

The syntax response means it was not entered correctly, and that could be simply because you do not appear to have a space between read and the path.


The command has 4 parts:

defaults
read
<path>
<key>

that should be separated by a space (so the parser can delineate the different parts).

Thanks a lot, I redid it and Im clean.

 

[Zendokan]

Not infected, like I suspected.

First there's a Trojan that doesn't install if you have an antivirus application running or MS Office for Mac, Xcode and Skype.
Something that I find really wierd, because Trojans on Wintel systems really don't care if an antivirus is running to install themselfs.

Makes me suspicious about the 'design' of the Trojan, especially when you know that present day hackers are just guns for hire.
AV software selling for 32 million Macs can be considered a lucrative deal.

Also everyone that posts in this thread about keeping your head cool and following the instructions of f-secure, in short people that say that you still don't need AV software get "negative varrots" (always a max of -4), while people that advocate getting AV software get "positive varrots" (also always a max of +4).

At GGIstudio, yes I was mistaken by name, it's not your Apple-id and password, but your Mac admin-Id and password that most Trojans ask, before they can install. But you get the idea that I was trying to explain: it takes human interaction.

 

[the8thark]

You had to install a program that looked shady at best.

The program looked shady. But did it also look slim?

 

[Morod]

Thanks for the instructions, all!

I get nervous in Terminal, but I was able to copy and paste the Terminal commands posted here.
I'm clean on SL 10.6.8 with the Java update.

 

[sngx1275]

Does the fact I never installed java decrease, increase or not change my vulnerability to this Trojan?

Eliminates. Without Java, this can't exist on your Mac.

 

[Aviboy97]

How to run terminal

I'm not very tech savvy when it comes to this, but how do you run terminal or access the terminal? Once you are there, I'm confused as to what command you enter to determine if you are infected. What will it say? Pardon me for being stupid!