Flashback Trojan Returns With a Multi-Pronged Infection Strategy

[georgB]

There's zero viruses for OSX. There's always the possibility that there might be one in the future though.

I believe that should read "... zero viruses for OSX in the wild ... " There have been regular competitions for years - official, with prize money and all - to see who can break into computers running the different OS's, and almost every year (maybe every year) someone makes it into a Mac OS machine. I believe their methods are viruses, technical details otherwise kept secret and divulged exclusively to legitimate "need-to-know-ers", but remain as proof of concept.

What that means, for the record, is that viruses for the Mac OS are a proven fact, do exist as we speak, but have so far not spread in the wild. So rest easy, but not entirely without caution.

 

[Small White Car]

Small White Car, normally I'd agree with you; you always know what you're talking about. However, Apple's own commercial and ad campaign from a few years back says differently. The theme of the ad, from Apple itself; 114,000 Viruses? Not On A Mac. See the commercial here. They also sent out emails that touted "PCs get infected with a 100,000 new viruses a year. Macs don’t. Get a Mac." A writeup about those emails can be seen here.

I thought I'd point that out. Apple used to tout that Viruses didn't effect Macs.

This is why I hate weaselly marketing, which is what that is. It sure does muddy things up.

Apple's not saying Macs don't get viruses in that ad. They're saying Macs don't "get 100,000 viruses." (Thus implying that 1 or 2 could be possible.) I can promise you their lawyers made sure it was worded precisely that way so that they could make that argument.

I feel dirty just typing that, so trust me, I don't agree with their decision to run ads like that.

Nonetheless, thank you for bringing that ad to my attention. It does cause me to revise my statement to that original poster:

Take 2:

Apple computers do not get a virus. Yeah right. (as the Tui advertisment goes).

No one here actually thinks Macs can't get viruses, so telling us they can is not a 'told you so' moment. Now, Apple has sneakily tried to cultivate that impression, but please don't try to pin these lame marketing techniques onto the members of this forum as if they are our opinions. We've always known better and don't actually support such ads. Thus, it's not really ok to act like you're teaching us all a lesson when, in fact, we're quite aware of these things.

 

[BaldiMac]

Small White Car, normally I'd agree with you; you always know what you're talking about. However, Apple's own commercial and ad campaign from a few years back says differently. The theme of the ad, from Apple itself; 114,000 Viruses? Not On A Mac. See the commercial here. They also sent out emails that touted "PCs get infected with a 100,000 new viruses a year. Macs don’t. Get a Mac." A writeup about those emails can be seen here.

I thought I'd point that out. Apple used to tout that Viruses didn't effect Macs. Most people (see this thread) have no idea what the definition of a Virus actually is, and why Macs can't get "Viruses", per se. So that ad campaign stopped.

While it's still true that Macs don't get Viruses, Apple itself doesn't say so out loud anymore.

I'm not sure how either of those ads contradicts what Small White Car said. The commercial said that there aren't 114,000 viruses on Macs. Which is true. The email add campaign is a matter of semantics. Seems to me like the statement Apple made was "Macs don't [get infected with 100,000 new viruses a year.]" Which is also true. Neither contradicts what Small White Car said. Neither said that Macs can't or don't get any viruses or malware.

 

[azurehi]

You do realize that a huge number of people still run XP. Heck, at work, we still use XP. They see no need to upgrade, because it will cost too much to upgrade 290,000 employees.

I dual boot with XP and Linux Mint Debian Edition on my desktop, Windows 7 and Lubuntu on my HP laptop. I have Never had any kind of malware using Linux...that's not to say it couldn't happen.

 

[GGJstudios]

I'll start with the basics:

You don't need any 3rd party antivirus app to keep your Mac malware-free. Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. You cannot infect your Mac simply by visiting a website, unzipping a file, opening an email attachment or joining a network. The only malware in the wild that can affect Mac OS X is a handful of trojans, which cannot infect your Mac unless you actively install them, and they can be easily avoided with some basic education, common sense and care in what software you install. Also, Mac OS X Snow Leopard and Lion have anti-malware protection built in, further reducing the need for 3rd party antivirus apps.

Mac Virus/Malware FAQ​

1. Make sure your built-in Mac firewall is enabled in System Preferences > Security > Firewall
2. Uncheck "Enable Java" in Safari > Preferences > Security.
3. Uncheck "Open "safe" files after downloading" in Safari > Preferences > General
4. Be careful to only install software from trusted, reputable sites. Never install pirated software. If you're not sure about an app, ask in this forum before installing.
5. Never let someone else have physical access to install anything on your Mac.

That's all you need to do to keep your Mac completely free of any virus, trojan, spyware, keylogger, or other malware. You don't need any 3rd party software to keep your Mac secure.

Apple computers do not get a virus. Yeah right. (as the Tui advertisment goes).

where is that guy who always writes on peoples post who think they have a virus. he always writes macs cant get viruses

For current Macs to get a virus, first one needs to be created and released into the wild. Macs CAN get viruses, but they DON'T, since no Mac OS X viruses exist in the wild.

And to think people said that the fact that OS X lacked malware had nothing to do with it's marketshare.

It doesn't. Prior to Mac OS X, Macs had much smaller marketshare and installed base, but they had far more viruses, trojans, etc. than they do now. Market share and installed base has grown, yet the number of viruses declined... to zero.

Whatever, still malware.

No, not "whatever". There's a significant difference between trojans and viruses, both in how they function and in how a user needs to defend against them.

The technical distinctions among them (virus, trojan, etc.) are likely to be useful to only a very small segment of the entire user population.

The average user doesn't care or know the difference between a trojan, virus, malware, etc.

The distinctions are important to any user, whether they take the time to learn them or not.

Is this a virus created for the purpose of allowing a hacker to access a user's computer or is it simply a destructive troll virus?

It's not a virus.

Im thinking of installing Sophos ...

Does Sophos detect this one yet?

I use Sophos

I use Sophos

I've got Sophos, free from my school.

Sophos should be avoided, as it could actually increase your Mac's vulnerability, as described here and here... and here.

Could some who *KNOWS* please answer this. I got a prompt this morning supposedly from Adobe saying there was an update to Flash.

You're always safer going to the site and downloading updates directly, rather than responding to an unexpected pop up notification.

This is not true, Sentry can be set to scan the hard drive as you work.

Don't use Sentry. If it's enabled, it will use significant system resources to constantly scan. Disable the Sentry feature. You don't need it.

There have been regular competitions for years - official, with prize money and all - to see who can break into computers running the different OS's, and almost every year (maybe every year) someone makes it into a Mac OS machine.

Hacking into a Mac and introducing a virus are two very different things.

I believe their methods are viruses,

No, they have not used viruses in those hacking competitions.

What that means, for the record, is that viruses for the Mac OS are a proven fact, do exist as we speak...

Name one.

 

[Vegasman]

So developed that the user needs to run 3rd party Antivirus/malware/spyware blocking/cleaning software to prevent the whole system from falling on its face?

Windows 7 is still affected by 70% of the old Windows viruses. And there were over 200,000 of them.

And the reason you needed a third party product is because of anti-trust reasons. If Microsoft had produced an anti-malware solution built in, it would have gone through the same scrutiny as when they included a web browser built in. And we saw how well that went. They couldn't even inlclude the IE auto-update as part of Windows, which is why it took so long to kill IE6.

Anyway, the anti-trust case is over now. You can already see the Microsoft eco-system integration happening.

And we will need some links to support that last sentence of yours.

 

[georgB]

GGJstudios, I stand corrected, and thank you. But I thank you even more for the informative and useful information in your post.

That said, I, myself, am a kind of "proof of concept". Not any kind of computer expert, simply an interested user since the first Apple// was sold, I thought I pretty much did the right things and knew what I was talking about. And I was wrong, wrong enough not to know all the current best-practice guidelines, and opened myself to a level of risk only a bit better than that of a completely uninformed newbie.

 

[AidenShaw]

As long as you're running some form of antimalware and update your OS regularly, your chances of catching any bugs is only a half step above nil.

Be the tiniest bit proactive, and don't be stupid. There you go. You're bug free.

However, just being connected to the internet without clicking anything could get you a virus.

And a firewall.

Even having your home network behind a NAT router means that most port-scanning malware is unable to find you (unless you keep your system in the DMZ - then you've chosen to have unsafe internet).

If you do have firewall software on your system, you have more protection. Since August 2004, up-to-date Windows systems have included firewall software.

Windows 7 is still affected by 70% of the old Windows viruses. And there were over 200,000 of them.

This is pure BS, I think.

Show us the link that says that 70% of historical Windows viruses can affect Windows 7 x64 - or admit the fabrication.

We don't have this Trojan on the Windows side of the world

LOL +1

And the reason you needed a third party product is because of anti-trust reasons.

Exactly - Microsoft has to be very careful adding features that duplicate 3rd party software.

 

[linuxcooldude]

We can discount anything we want. As I said - the average user doesn't and won't.

Whether they have to take 20 steps to actually install malware or visit some random site and pick it up without any interaction. The general public sees it as the same. Especially since people never want to own up for their own gullibility.I have dealt with many issues from friends and relatives that I knew stemmed from downloading/running/etc things they should never have opened. But they insisted otherwise.

Worsening the issue is the perception that Macs can't get infected. No matter what. I don't mean to imply Apple is perpetuating this "fact" - but if you ask around - people will say get a mac - they can't/don't get viruses.

But see my earlier point. Whether or not they get VIRUSES doesn't matter if the general user sees all malware, etc the same.

It does not matter what public opinion may think, it does not change the facts, or make it any less true.

I believe that should read "... zero viruses for OSX in the wild ... " There have been regular competitions for years - official, with prize money and all - to see who can break into computers running the different OS's, and almost every year (maybe every year) someone makes it into a Mac OS machine. I believe their methods are viruses, technical details otherwise kept secret and divulged exclusively to legitimate "need-to-know-ers", but remain as proof of concept.

What that means, for the record, is that viruses for the Mac OS are a proven fact, do exist as we speak, but have so far not spread in the wild. So rest easy, but not entirely without caution.

Quite different senario. These competitions most often use know exploits months in advance. These competitions most likely DO NOT condone the use of virus/malware/trojans because of the possibility to be released into the wild.

A big difference exists between hacking into a computer to release a virus/malware, then one that is downloaded and installed with the users knowledge and enters his own password. Or even a virus that is undetected by the user.

 

[sha4000]

First off let me state that I prefer Mac to Windows and the AV issue is one of the biggest reasons. That being said i have had a windows desktop since 2000 and have not had a virus. Plenty of malware that i had to clean out from time to time though nothing harmful. I'm always on my kids about what not to download and links not to click. Its much easier these days with Microsoft Security Essentials so i don't have to be as diligent. With my mac I don't even think about this stuff until I read threads like these lol. I just checked after I read GGJstudios post and my firewall in OSX was not even turned on!!!!!!

 

[LiesForTheLiars]

First off let me state that I prefer Mac to Windows and the AV issue is one of the biggest reasons. That being said i have had a windows desktop since 2000 and have not had a virus. Plenty of malware that i had to clean out from time to time though nothing harmful. I'm always on my kids about what not to download and links not to click. Its much easier these days with Microsoft Security Essentials so i don't have to be as diligent. With my mac I don't even think about this stuff until I read threads like these lol. I just checked after I read GGJstudios post and my firewall in OSX was not even turned on!!!!!!

The OS X firewall is turned off by default and I don't know why exactly. Even in ML. You'd think with all the precautionary security measures Apple has taken lately that it would be on by default. Kinda silly.

 

[macpeach55]

Sophos should be avoided, as it could actually increase your Mac's vulnerability, as described here and here... and here.

Just to be accurate with all these items about Sophos, the last quote is about the Windows Version, not the Mac version, and I quote from the paper:-

Version Information
The results presented below were obtained using Sophos Antivirus 9.5 for Windows, the latest version available at the time of writing. Detailed version information is available in the Appendix.

I think it is only fair that readers are made aware of this.

 

[GGJstudios]

Just to be accurate with all these items about Sophos, the last quote is about the Windows Version, not the Mac version, and I quote from the paper:-

I think it is only fair that readers are made aware of this.

Thanks for pointing that out. It just shows that Sophos is not recommended for either platform.

 

[linuxcooldude]

The OS X firewall is turned off by default and I don't know why exactly. Even in ML. You'd think with all the precautionary security measures Apple has taken lately that it would be on by default. Kinda silly.

My guess is that it depends what type of network you have it connected too. If you have a router, many have built in firewall protection. Businesses usually already have dedicated firewalls.

The time I could see using it if you have it directly attached to a modem or a laptop using someone else's wireless connection when away from home.

 

[SBlue1]

who gets fooled by this?

 

[xplora]

Gatekeeper distinction...

'... with the introduction of Gatekeeper, a system by which users can limit installation of apps to sources such as the Mac App Store and developers who have registered with Apple as "identified developers".'

Small error, Gatekeeper doesn't limit installation, Gatekeeper limits execution.

To limit installation, Gatekeeper would have to limit the ability to copy files, which it does not do. The nearest Gatekeeper comes to limiting installation is that it will probably be used by the installer app to limit installation of app's that would be installed through its package installation system (i.e. those apps that come packaged in .pkg or .mpkg files).

Also regarding virus vs trojan vs malware

To the pedantic, get over it, the average consumer considers them all to be the same thing, a virus. Blame the confusion on the fact that anti-virus software goes after all 3.

 

[GGJstudios]

Small error, Gatekeeper doesn't limit installation, Gatekeeper limits execution.

To limit installation, Gatekeeper would have to limit the ability to copy files, which it does not do.

You need to read what you quoted more carefully, as Gatekeeper doesn't limit anything:

'... with the introduction of Gatekeeper, a system by which users can limit installation of apps to sources such as the Mac App Store and developers who have registered with Apple as "identified developers".'

To the pedantic, get over it, the average consumer considers them all to be the same thing, a virus. Blame the confusion on the fact that anti-virus software goes after all 3.

Since our role in this forum is to educate, inform and assist those who come here looking for help, we should use proper malware definitions. It is misleading to continue perpetuating the false assumption that any malware is a virus, despite what any uninformed user in the general public may think.

Reason: that is a horrible feature having it combine post automatically like that

That's a good feature, since consecutive posts are frowned upon in this forum.

 

[xplora]

You need to read what you quoted more carefully, as Gatekeeper doesn't limit anything:

I guess you do too, assume I meant when enabled. however my point is still valid, it doesn't limit installation, it limits execution.


As for my virus comment, as I said, to the pedantic, get over it.

 

[Apple fanboy]

As someone about to take the plunge on a an iMac for the first time, I truly believed you couldn't get a virus.

 

[GGJstudios]

As someone about to take the plunge on a an iMac for the first time, I truly believed you couldn't get a virus.

You can't, until they create one and introduce it into the wild, where you could possibly encounter it. Read the first link in post #130 in this thread.

 

[Mr. Retrofire]

Disable all plugins & Java (not JavaScript), and enable them only, if necessary. Why is that so difficult? Firefox users can use the NoScript Add-on, which blocks all Plugin & Java content. If you have this Trojan, then it is your fault.

 

[xplora]

As someone about to take the plunge on a an iMac for the first time, I truly believed you couldn't get a virus.

By the pedantic definition of a virus, you can't, however trojans and other malware are still possible since they rely on tricking the user into doing something they did not intend to do.

 

[LiesForTheLiars]

As someone about to take the plunge on a an iMac for the first time, I truly believed you couldn't get a virus.

It happens to the best of us, but common sense will take you a long way, whether it's on a Mac or Windows platform. There still aren't any viruses for the Mac, however... but there might be somewhere down the road.

http://en.m.wikipedia.org/wiki/Malware

 

[GGJstudios]

By the pedantic definition of a virus, you can't, however trojans and other malware are still possible since they rely on tricking the user into doing something they did not intend to do.

It's not "the pedantic definition of a virus", it's the accurate definition.

 

[Porco]

(With all due deference to Monty Python... )

And so, after a long, drawn-out war, the Greeks decided to build a huge wooden badger in order to sneak into their enemy's city.

Their enemies, the Viruses, were far too small to wheel the gigantic wooden gift into the city of Viru, and so the Greeks failed in their audacious plan.

Ever since that day, those who copied the failed plan are said to have build a Virus Badger, as I'm sure you'll all have heard of. Or ... not.

But it's all the same thing isn't it?