Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Flashback Malware Authors Using Twitter to Talk to Infected Machines

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
68,545
39,400



twitter_ios_icon.jpg


We've been following for some time the story of the Flashback trojan that has been targeting Mac users by masquerading as a Flash Player installer but which has also been evolving to include increasingly sophisticated tactics for infecting users' computers.

Antivirus firm Intego now reports that Flashback's creators are using an interesting new tactic for communicating with machines infected by the trojan: Twitter. According to the report, Flashback is programmed to search Twitter for Tweets containing a unique 12-digit code that changes daily, with the malware's authors being able to issue commands to infected computers by posting from any number of Twitter accounts simply by including the appropriate code as a hashtag.
These hashtags aren't as simple as, say, #Flashback or #MacMalwareMaster, but are seemingly random strings of characters that change each day. Intego's malware research team cracked the 128-bit RC4 encryption used for Flashback's code and discovered the keys to this system.

The hashtags are made up of twelve characters. There are four characters for the day, four characters for the month, and four characters for the year. [...]

So, for today, March 5, 2012, the hashtag would be #pepbyfadxeoa.
Click to expand...
Intego is monitoring Twitter to look for any commands being issued using the hashtag codes, also noting that Flashback uses a number of different user agent strings in its web queries looking for the Twitter contacts, seeking to avoid detection and removal.

Article Link: Flashback Malware Authors Using Twitter to Talk to Infected Machines
 
Article Link
https://www.macrumors.com/2012/03/05/flashback-malware-authors-using-twitter-to-talk-to-infected-machines/
Nasty!!

(I'm breaking my arm patting myself on the back for my non-involement with social media.)

I do feel bad for the majority of the world who does use social media...this is really lousy.

Much crap on social media, but a tremendous amount of good in places where free expression is only possible through Twitter, etc. It's a powerful tool for many in the world, and any sympathy I might have for certain hackers is totally absent in situations like this.
 
I just upgraded my gfs flashplayer last week ... What are the chances that it's this Trojan ?? How can I check?
 
Shrink said:
Nasty!!

(I'm breaking my arm patting myself on the back for my non-involement with social media.)

I do feel bad for the majority of the world who does use social media...this is really lousy.
Click to expand...

I think this uses twitter even if you don't use it personally, they are just using the open nature of the site as a means to communicate with the malware.
 
The claim is interesting, but a quick search on Twitter doesn't show that #pepbyfadxeoa is actually being used by any program for anything. If the vendor's claim is true, they should be able to tell us a prior hashtag which shows actual nefarious activity.

We are still suffering from Adobe's lax attitudes for security around their products. All of the "Get Flash Player" and "Get Adobe PDF Reader" links that Adobe encouraged in the past have helped foster a lackadaisical attitude towards the clear risk of installing a trojan horse on machines. I will be happy as Flash on the WWW continues to fade into the sunset.

lavem said:
I think this uses twitter even if you don't use it personally, they are just using the open nature of the site as a means to communicate with the malware.
Click to expand...

Bingo. If the trojan is actually using twitter as a conduit, it's probably using accounts that were embedded in the trojan. Blocking those would require the blocking of connections to twitter servers with something like Little Snitch
or outbound blocks in your network's firewall.

To repeat: the vendor has provided no actual evidence that such messages are happening. I see no evidence with todays hashtag.

One other note: the Twitter stream is a real cesspool these days. As far as I can tell, Twitter does nothing to automatically remove the 'bot accounts that send out Amazon Associates link-spam. They're also doing nothing to automatically censor accounts that send @mentions that spam the "adult" dating sites. Doesn't Twitter have any friends in the Valley who could help them keep the toxic pollution out of their stream?
 
Last edited:
I'm always suspicious of anti-virus firms who seem to know very specific details of viruses/malware/trojans.
 
Shrink said:
Nasty!!

(I'm breaking my arm patting myself on the back for my non-involement with social media.)

I do feel bad for the majority of the world who does use social media...this is really lousy.

Much crap on social media, but a tremendous amount of good in places where free expression is only possible through Twitter, etc. It's a powerful tool for many in the world, and any sympathy I might have for certain hackers is totally absent in situations like this.
Click to expand...

And how exactly does that help you in this case? The trojan is using twitter - that does not mean that you have to use it to get the negative benefit. If it would use the torrent network, it wouldn't make a difference. The novelty is that it uses a social network to exploit them for the spying instead of uploading it to a certain IP. They just cover their tracks better. You don't get the trojan from social media. It hides as a flash updater pop-up telling it is a genuine Apple distribution.
 
Kilamite said:
I'm always suspicious of anti-virus firms who seem to know very specific details of viruses/malware/trojans.
Click to expand...

They are usually ex-hackers and I think there was one case where a Russian anti virus company was creating them as well. But in general, they have computers in sandbox mode running all over the internet trying to catch viruses and then reverse engineer them or find out what they do and how to protect from them. It's just their business.
 
With my flash player I'm careful. I never click on a pop-up when it tells me it's out of date.

I go to Adobe's site and update there.

Same process with software updates then with banking information.

Only Google Chrome does the update by itself. Hopefully there's not back door that this automatic update can be fooled by hackers.

In regards to the 12-digit-code: this allows for an easy reverse search, no matter if the number changes - it's always 12 digits. Then you can send a message to the hacker how dumb he was. With the same amount of work he had put into this malware he could have created an app and probably made some money.
 
DaZerVin said:
I just upgraded my gfs flashplayer last week ... What are the chances that it's this Trojan ?? How can I check?
Click to expand...

If it was an update issued by Adobe and prompted from your current Flash installation, not likely. If it was a clean install, possibly. Always make sure that your Flash software is digitally signed and trusted by Adobe (not Apple). If it says in red letters "this root certificate is not trusted," at any point in the install process, cancel it and delete the installer.

You are really better off just to not install Flash at all on your mac. Most websites have HTML 5 alternatives to the Flash content (which consist mostly of ads you don't want to see anyway). It will run better and you won't have any issues with this trojan.
 
Kilamite said:
I'm always suspicious of anti-virus firms who seem to know very specific details of viruses/malware/trojans.
Click to expand...

Word, bro. And what about those pesky "doctors" who seem to know all about illnesses and bacteria and whatnot? Damned scientists!
(Fricking magnets, how do they work?)

----------
Nostromo said:
Then you can send a message to the hacker how dumb he was. With the same amount of work he had put into this malware he could have created an app and probably made some money.
Click to expand...

You mean he has no bussiness plan for this?
 
Shrink said:
Nasty!!

(I'm breaking my arm patting myself on the back for my non-involement with social media.)

I do feel bad for the majority of the world who does use social media...this is really lousy.

Much crap on social media, but a tremendous amount of good in places where free expression is only possible through Twitter, etc. It's a powerful tool for many in the world, and any sympathy I might have for certain hackers is totally absent in situations like this.
Click to expand...

Well, don't over pad yourself. The infection doesn't come from Twitter, but from a fake Adobe Flash Installer. Twitter is only one of the many ways hackers use to communicate with the hacked Macs.
 
DaZerVin said:
I just upgraded my gfs flashplayer last week ... What are the chances that it's this Trojan ?? How can I check?
Click to expand...
Go to your /Users/yourusername/Library/ folder and look to see if you find any of these files:
~/.MacOSX/environment.plist
~/Library/LaunchAgents/com.apple.SystemUI.plist
~/Library/Preferences/perflib
~/Library/Preferences/Preferences.dylib
~/Library/Logs/swlog​
If you don't have any of these files, you're not infected.

Your Library folders are hidden by default in Lion. To get to your /Library or /Users/yourusername/Library (also known as the ~/Library) folders in Lion, Launch Finder and click Go > Go to Folder and type: /Library or ~/Library

Here's how to avoid any question:
Nostromo said:
With my flash player I'm careful. I never click on a pop-up when it tells me it's out of date.

I go to Adobe's site and update there.
Click to expand...
This is very important:
FloatingBones said:
To repeat: the vendor has provided no actual evidence that such messages are happening.
Click to expand...
In fact, while I may have missed it, I've seen no corroborating evidence supporting the recent reports coming from Intego. I haven't seen any other security firm confirming the presence of these variations, or the variation that supposedly installs itself without user intervention, as they also claim. Until such claims are proven by other companies, I'll continue to find Intego's claims suspicious, at best.

Generally speaking, these reports by security firms are little more than thinly veiled attempts to scare users into buying their security software, which you don't need. However, such reports can be useful reminders for users to continue to practice safe computing.
  1. Make sure your built-in Mac firewall is enabled in System Preferences > Security > Firewall

  2. Uncheck "Open "safe" files after downloading" in Safari > Preferences > General

  3. Uncheck "Enable Java" in Safari > Preferences > Security. Leave this unchecked until you visit a trusted site that requires Java, then re-enable only for your visit to that site. (This is not to be confused with JavaScript, which you should leave enabled.)

  4. Check your DNS settings by reading this.

  5. Be careful to only install software from trusted, reputable sites. Never install pirated software. If you're not sure about an app, ask in this forum before installing.

  6. Never let someone else have physical access to install anything on your Mac.

  7. Always keep your Mac and application software updated. Use Software Update for your Mac software. For other software, it's safer to get updates from the developer's site or from the menu item "Check for updates", rather than installing from any notification window that pops up while you're surfing the web.
That's all you need to do to keep your Mac completely free of any virus, trojan, spyware, keylogger, or other malware.

You don't need any 3rd party antivirus app to keep your Mac malware-free. Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. You cannot infect your Mac simply by visiting a website, unzipping a file, opening an email attachment or joining a network. The only malware in the wild that can affect Mac OS X is a handful of trojans, which cannot infect your Mac unless you actively install them, and they can be easily avoided with some basic education, common sense and care in what software you install. Also, Mac OS X Snow Leopard and Lion have anti-malware protection built in, further reducing the need for 3rd party antivirus apps.
 
Social Media is Malware

I am getting obsessed with this topic. Social media is neither social nor media. It is a commercial enterprise whose purpose is to x-ray your wallet and get you to spend. Then they present you with this nice shopping mall to talk with the world in. And the advertisers are listening to you.

I'm not against any of these things, but it's quite relevant that the Flashback malware may be the first thing on the Mac that does damage, and that, really, if you want to make a commercial enterprise out of human socialization, you have to guarantee your customers' safety. You have to be provided with the ability to see what they have on you, and what you don't want others to see.

Much like life, if you hang around in bars, you can come down with diseases.
 
Great guide

GGJstudios said:
[Removed actual post due to its length]
Click to expand...
Thank you for that great guide to protecting a Mac against Trojans and other malicious software. I wish there was a "+2" arrow/button for posts like these.

As one user mentioned, the best thing to do would be to just not have Flash installed whatsoever. There are some disadvantages to this, however. Although HTML 5 is the obvious next generation of Flash, many websites today still continue to use Flash. Yes, Flash is prominently used for advertisements, but there are many other ways websites utilize Flash, most notably, games, animations, and audio/video streaming services. If I am not mistaken, I believe all YouTube videos run on Flash. Thus, until HMTL 5 begins to conquer the majority of the web, which is both imminent and inevitable, Flash still seems to be an important program to have installed for surfing the web.

However, there is a solution to avoiding the potentially threatening install and update windows! Google Chrome comes with Flash preinstalled, and it updates Flash automatically. This means that unless you are an avid user of Safari or another browser requiring a separate install of Flash, Flash is not required to be installed on your Mac! It's things like these why I highly recommend and love Google Chrome.
 
Exotic-Car Man said:
If I am not mistaken, I believe all YouTube videos run on Flash.
Click to expand...
Many YouTube videos are available as HTML5. See the link below:
For Flash-related issues:
 
GGJstudios said:
So if you don't hang around in bars, you won't catch any diseases???
Click to expand...

I'm a long-term volunteer in a influenza-study, and one of the findings so far is that avoiding places with large numbers of other people greatly reduce your chances of getting infected with common cold or influenza. 'won't' is probably overoptimistic, however, unless you're a hermit.
 
I spent a long time on the phone with Apple, eventually with a specialist, trying to figure out why suddenly none of my PPC applications would open in Rosetta on Snow Leopard.

All of my Apple software was updated, including the revised security update that fixed the first one's problems with Rosetta. I update Flash from the preference pane and rarely let it past ClickToFlash.

I found the answer at http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

I had seen an unexpected request for admin privileges from an app I didn't recognize, but most definitely did not click okay. I took a screenshot of it instead. I also ran ClamXav, which found nothing.

That still left me with the invisible files in Application Support in my User library and in Shared Users that F-Secure describes. Once they were removed, all the PPC apps opened again.

I'd done everything suggested above, except disable Java in Safari. I'd only been browsing at very mainstream sites.

Apparently having Java enabled, without user intervention, was enough to get Intel code injected into every PPC app, causing it to crash. I might well have noticed nothing if only Intel apps had been installed.

I don't know what else the thing did.

Others have reported the same trojan on the Apple boards. People using PPC apps are often long-term Mac users who need them for business.

This one seems real.

Does anyone know of anything like NoScript for Safari? Any other advice?
 
kcjames said:
I'd done everything suggested above, except disable Java in Safari.

Apparently having Java enabled, without user intervention, was enough to get Intel code injected into every PPC app, causing it to crash.
Click to expand...
That's exactly why I recommended disabling Java.
 
Go to your /Users/yourusername/Library/ folder and look to see if you find any of these files:
~/.MacOSX/environment.plist
~/Library/LaunchAgents/com.apple.SystemUI.plist
~/Library/Preferences/perflib
~/Library/Preferences/Preferences.dylib
~/Library/Logs/swlog​
If you don't have any of these files, you're not infected.


I did this, the only thing I found that resembled any of these was

~/Library/Preferences/com.apple.systemuiserver.plist

is this anything to worry about?
thx:confused:
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back