Apple Updates Malware Definitions to Protect Against Botnet Threat Coordinated Via Reddit

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Oct 4, 2014.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Last week, Russian anti-virus firm Doctor Web disclosed a newly discovered piece of OS X malware known as Mac.BackDoor.iWorm that at the time had affected roughly 17,000 machines around the world. While the exact mechanism of infection was unclear, an interesting twist to the story involves compromised machines running search queries on Reddit to obtain instructions about which command and control servers should be used to manage the botnet.
    Once connected to a command and control server, the backdoor opened by the malware on the user's system can receive instructions to perform a variety of tasks, from stealing sensitive information to receiving or spreading additional malware.

    In an effort to address the threat, Apple has now updated its "Xprotect" anti-malware system to recognize two different variants of the iWorm malware and prevent them from being installed on users' machines.

    [​IMG]
    First introduced with OS X Snow Leopard, Xprotect is a rudimentary anti-malware system that recognizes and alerts users to the presence of various types of malware. Given the relative rarity of malware targeting OS X, the malware definitions are updated infrequently, although users' machines automatically check for updates on a daily basis. Apple also uses the Xprotect system on occasion to enforce minimum version requirements for plug-ins such as Flash Player and Java, forcing users to upgrade from older versions known to carry significant security risks.

    Article Link: Apple Updates Malware Definitions to Protect Against Botnet Threat Coordinated Via Reddit
     
  2. Michaelgtrusa macrumors 604

    Joined:
    Oct 13, 2008
    #2
    I will have to check and see if this update is via the store or the site.
     
  3. Parasprite macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #3
    I can't say I expected any part of this story to happen.
     
  4. Parasprite macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #4
    You won't find it in either because the update is via xprotect, which is updated automatically. I know there used to be a way to force an update using a terminal command, but iirc there isn't a way to do this in Mavericks (yet).
     
  5. mikethebigo macrumors 68000

    Joined:
    May 25, 2009
    #5
    It has been discovered how the botnet is installed. You have to download a pirated app, such as Photoshop, and then give the pirated installer administrator privileges.

    No amount of malware security can fix stupid.

    EDIT: Link to evidence: http://www.thesafemac.com/iworm-method-of-infection-found/
     
  6. smithrh macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #6
    Good update - a lot of the "Hey look! Mac malware!" hue and cry has, of course, come from the usual places, namely antivirus software houses - and that hue and cry has not mentioned how the damn thing gets in your Mac in the first place.

    That was a glaring omission, and it was right for MacRumors to hold off until now.
     
  7. nagromme, Oct 4, 2014
    Last edited: Oct 4, 2014

    nagromme macrumors G5

    nagromme

    Joined:
    May 2, 2002
    #7
    You can NAME your trojan “worm,” but that does not make it a worm. (It does make good attention-bait for security firms’ PR departments.)

    IF this bad software actually did spread BY ITSELF, then it would seem to be the first real-world successful OS X “virus.” (Technically, “worm” is the better term: a “virus” specifically infects/alters apps, while a “worm” is less specific: any malware that spreads on its own.)

    But that doesn’t appear to be the case—making this just another trojan.

    Any OS is vulnerable to lies, and that’s what a trojan is: someone lies to you and says “trust this program with your system!” Luckily, OS X makes trojans pretty hard to get these days: you have to go to some very specific effort to run un-trusted, unsigned code. If you know how to do that, you should know better! (Signed code can be remotely shut down by Apple if it's determined to be bad--even outside the App Store.)

    Pirates beware: don’t trust shady downloads.
     
  8. Parasprite macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #8
    That was almost interesting while it lasted.

    Arguments about viruses vs trojans and how it affects OS X below this line:
    _________________________
     
  9. Chad-VI macrumors 6502

    Chad-VI

    Joined:
    Mar 31, 2014
    #9
    What about the "Attention required Cloudflare" message that appears when opening some sites on some iOS devices ? Does that mean that these iOS devices are also infected by some kind of malware?
     
  10. cr2 macrumors regular

    Joined:
    Feb 19, 2011
    #10
    How do I check if xprotect is running properly (installed and not disabled) on my Mac? Thanks in advance.
     
  11. Dorje Sylas macrumors 6502

    Joined:
    Jun 8, 2011
    #11
    Relevant to your question.
    https://discussions.apple.com/thread/6532812

    Short answer no. Its HTML/Javascript scare tactic trickery that's been in use since infinite pop-up windows.
     
  12. tywebb13, Oct 4, 2014
    Last edited: Jul 28, 2015
  13. Parasprite macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #13
    I actually don't have an answer to that. However, there is an indirect way to do it. Go to Finder->Go->Go To Folder. Copy this into the box:
    /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/ ​

    Scroll to the bottom to a file called "xprotect.meta.plist". The date it was last changed will be the last time it was modified. Mine shows 9/18/14 (I think that was when I installed 10.9.5) but yours may be different. Apple doesn't update it very often so I wouldn't be that surprised if it looks more out-of-date than this. You can check back periodically to see if it gets modified.
     
  14. 76ShovelHead macrumors 6502a

    76ShovelHead

    Joined:
    May 30, 2010
    Location:
    Florida
    #14
    Okay. Just to be clear here, this is not a virus? A virus is something that can manipulate/alter specific programs and spread itself, whereas a worm can do the same but not limited to specific softwares? So that makes this just another Trojan, and by trojan I mean malware that was somehow authenticated by the user and will collect sensitive information. Bottom line is, OS X is still as secure as it ever was, and non-pirate users have zilch to worry about?

    Did I just answer my own question?

    My only other concern is if OS X's gain in popularity may have caused this, but if I did answer my own question, then OS X is as secure as it ever was and these trojans are just another exploit that will soon byte the dust. :apple:
     
  15. tywebb13, Oct 4, 2014
    Last edited: Jul 28, 2015
  16. Parasprite macrumors 68000

    Parasprite

    Joined:
    Mar 5, 2013
    #16
    See here:

     
  17. tywebb13, Oct 5, 2014
    Last edited: Jul 28, 2015
  18. impulse462 macrumors 68000

    impulse462

    Joined:
    Jun 3, 2009
  19. the-msa macrumors 6502

    Joined:
    Oct 24, 2013
    #19
    Le reddit army unite!!

    Anyway, if you install pirated software from shady websites, it's your own fault.
     
  20. dtich macrumors regular

    Joined:
    May 27, 2007
    #20
    i have definitions for iworm a, b and c. plist was updated yesterday it seems....
     
  21. inscrewtable macrumors 68000

    inscrewtable

    Joined:
    Oct 9, 2010
    #21
    Can you recommend a safe pirate site?

    <kidding>
     
  22. slattery69 macrumors regular

    Joined:
    Jun 16, 2009
    Location:
    Paid Shill
    #22
    Neither of my macs have updated with one showing a file last updated in may2014 and the other june 2014. Can't seem to see a way to force an update either .
     
  23. yansun macrumors regular

    Joined:
    Mar 26, 2010
    #23
    Yosemite PB4 seems not to be updated yet. Can anyone confirm this?
     
  24. tywebb13, Oct 5, 2014
    Last edited: Jul 28, 2015
  25. slattery69 macrumors regular

    Joined:
    Jun 16, 2009
    Location:
    Paid Shill
    #25

Share This Page