Lets Have A Discussion About Flashback

[ixodes]

First a qualifier...

The intent of this post is to establish an open intelligent conversation and discussion about Flashback and the public's perception of Apple.

Please refrain from attacks on the publications cited. Avoid the temptation to compare to OS X to Windows.

What this post is *not* is an attack on Apple.

Nor is it a comparison of platforms. It's simply an open invitation to read the articles, that millions of Americans have at their disposal today, and to comment on your take on this situation.

I challenge you to be civilized and simply have a discussion about how these mainstream articles impact the public's perception of Apple.

Thank You.
-----------

We all know that people's perception is their reality.

It bothers me that a company I think highly of, whose computers I use, allows their reputation to be sullied by being silent, and failing to get in front of the headlines. Or at least respond in some respectable fashion.

Here are two excerpts from the mainstream press. One from the Washingpost, and one from CNN Money. Please resist the urge to discredit these publications, they are what the mainstream consumer rely on. Like it or not.

Here's the articles:

"Flashback trojan shows Macs do get viruses"

"Yet while Oracle had patched the problem with Java that caused this problem months ago, Apple had yet to address the problem until April 3, when it issued a patch for the vulnerability. It then released a second patch on April 5.

“Oracle had patched this but Apple didn’t patch it until very recently,” he said. “Exploits were seen in the wild since around early to mid-March. That has been a full month of lead time to do bad stuff.”
http://www.washingtonpost.com/busin...-get-viruses/2012/04/09/gIQAHkPs5S_story.html


"Apple's Flashback fixes: Three belts and a pair of suspenders"

"What Apple didn't do was tell users that the tool existed. Not with a Software Update, not with a press release (see update below). It isn't listed on the Mac App Store and it doesn't show up in a search of the Apple website. And if you do somehow find and install it on your computer, it will disappear into the underlying code, making its presence known only if Flashback shows up."
http://tech.fortune.cnn.com/2012/04...pair-of-suspenders/?section=magazines_fortune

If you're interested, read the articles and post your thoughts.

Thanks

 

[McGiord]

My first thoughts, after reading your post:
- Apple always sees anything not made by them, as something that is not an Apple product.
- Even when something made by Apple is not working right, they are mute about it, unless they have something already cooked, and is in their best interest to publicly address it
- Not all the Macs got "infected".

Let's say, Apple is a company that designs, manufactures and sell houses.
With your Apple house, you have several options to get mail and communication with the world around you. And you as home owner decide what is going on inside your house.
If you got a critter inside your basement because you didn't close the garage door, or you accepted this disguised critter in your house thinking it was someone's mascot disguised with a fun halloween costume. Who is responsible to keep the house in order?
Why is it Apple responsible to teach you how to keep critters away from your basement?
It is considered within the Apple house design, that critters will have no appeal to get into your house, as they prefer to nest in more cozy places fabricated by other companies.

This is their approach.

After it is needed for them to keep doing business as they want to, they can offer a free update to your garage door, so that type of critter will not be able to get in again, and also maybe give you a free product to kill the critter inside your Apple house if you make the move to obtain their updated product.

One nice thing after all these things is that many people volunteered to offer solutions for free, while Apple didn't offer something. And after sometime they offer something.
Was it fast enough? No.
But as always with Apple, the issue will fade away in time, and they will continue their focus and efforts in the things that matter to them.

 

[dknightd]

I think apple needs to do a better job keeping java updated - or let/help oracle do it for them.

 

[east85]

I side with the sentiment that individuals using a computer should take responsibility for what they own if they wish to keep a clean system. It's important to keep current, even about Java. I'm subscribed to a number of blogs I read daily concerning Mac (I could skim through them in about 30 minutes). As soon as I had word of it, through my own research- I immediately disabled Java on my browser. Is it really so hard for users to attempt to educate themselves? Obviously Apple released a fix as any good software company would do, and while I definitely don't have a problem with that, I do have a problem with the overall sentiment of disappointment in Apple over this. On some level you need to be an educated consumer and not blindly put your faith in any company, even Apple. Companies, as is the case with people, are not perfect.

 

[5aga]

security should definitely a user priority however Apple should have updated Java sooner. Not every user stays up to date or even understands how malware works.
Also security has been one of Apple's selling points for quite some time. If they wish to retain that claim they really need to step up and develop a proactive approach in dealing with malware.

 

[GGJstudios]

I love this line:

"Flashback trojan shows Macs do get viruses"

It shows the media's ignorance. It's one thing for an individual user not to know the difference, but the media has a responsibility do their homework and at least know what they're talking about before publishing something. Of course, they've been derelict in that responsibility for a very long time.

Regarding Flashback, there is no question that the Java vulnerability was patched months before Apple issued a patch for their version. For that, I understand how people would be disappointed in Apple's responsiveness. However, ranting about it endlessly in forums isn't going to change a single thing. Apple isn't reading this forum and making corporate decisions based on what's posted here. Ranting about Apple won't undo what's been done. It's in the past. The patches are now available, but not to users of earlier versions of Mac OS X. People can complain about that, too, but again, Apple isn't basing their decisions on what's posted here.

Ultimately, it's every user's responsibility to make sure they take whatever steps are necessary to ensure the security of their computers. You can defer the responsibility to the OS or application developers, but if you do, you won't like the result. I've watched several reports of Mac OS X malware being discovered in the wild over the years, and I've never been affected by any of them. It's not because I run antivirus software, because I don't. They aren't 100% effective in detecting and preventing malware.

Every single instance of Mac OS X malware that has ever been released in the wild can be completely avoided by practicing safe computing, as described below. This includes all Flashback variants. It doesn't matter if you run Leopard, Snow Leopard or Lion; the same holds true for all. So you can rant about how Apple failed to respond quickly enough or that their response wasn't complete enough, or you can take responsibility to secure your Macs and get back to business as usual, malware-free.

Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. The only malware in the wild that can affect Mac OS X is a handful of trojans, which can be easily avoided by practicing safe computing (see below). Also, Mac OS X Snow Leopard and Lion have anti-malware protection built in, further reducing the need for 3rd party antivirus apps.

Mac Virus/Malware FAQ​

1. Make sure your built-in Mac firewall is enabled in System Preferences > Security > Firewall
   
   
2. Uncheck "Open "safe" files after downloading" in Safari > Preferences > General
   
   
3. Disable Java in your browser. (For Safari users, uncheck "Enable Java" in Safari > Preferences > Security.) This will protect you from malware that exploits Java in your browser, including the recent Flashback trojan. Leave this unchecked until you visit a trusted site that requires Java, then re-enable only for the duration of your visit to that site. (This is not to be confused with JavaScript, which you should leave enabled.)
   
   
4. Change your DNS servers to OpenDNS servers by reading this.
   
   
5. Be careful to only install software from trusted, reputable sites. Never install pirated software. If you're not sure about an app, ask in this forum before installing.
   
   
6. Never let someone else have access to install anything on your Mac.
   
   
7. Don't open files that you receive from unknown or untrusted sources.
   
   
8. For added security, make sure all network, email, financial and other important passwords are long and complex, including upper and lower case letters, numbers and special characters.
   
   
9. Always keep your Mac and application software updated. Use Software Update for your Mac software. For other software, it's safer to get updates from the developer's site or from the menu item "Check for updates", rather than installing from any notification window that pops up while you're surfing the web.

That's all you need to do to keep your Mac completely free of any virus, trojan, spyware, keylogger, or other malware. You don't need any 3rd party software to keep your Mac secure.

 

[ixodes]

Let's keep this discussion going...

First off, I want to sincerely thank all who have contributed to this thread thus far.

Especially GGJstudios, someone who like myself is very passionate about OS X, and knows it's true value in the world of computing.

I value everyones thoughts and opinions about Apple. This is a company I have a lot of respect for. How they are being perceived during this period in which the mainstream press is publishing some very erroneous information, is of great interest to me, and thus the reason I created this thread.

This is a thread which I hope many others will participate in, since we as a Mac community are under attack, using the typical sensationalist approach that is so frequently practiced by mainstream and not so mainstream publications, web sites, et al.

A discussion is a terrific way for us to be heard, even if only amongst ourselves, as this is a very important topic.

Thanks again to all who keep this discussion going.

Cheers...

 

[heisenberg123]

dont follow installation instructios for something you didnt plan on installing

 

[0dev]

I think apple needs to do a better job keeping java updated - or let/help oracle do it for them.

Or stop including it with Macs. They can't say "it's not an Apple thing" if they're pre-installing it, especially since they don't give users any easy way to uninstall it.

As for Flashback itself, this is a pivotal moment. Macs now have a real virus to worry about. Not a trojan horse, but something which will install itself without alerting you. Bit scary.

Protip: Running NoScript and Little Snitch is good security practice.

 

[GGJstudios]

As for Flashback itself, this is a pivotal moment. Macs now have a real virus to worry about. Not a trojan horse, but something which will install itself without alerting you.

... except it's not a true virus. It is, indeed, a trojan, and easily avoidable by user action.

 

[0dev]

... except it's not a true virus. It is, indeed, a trojan, and easily avoidable by user action.

It installs itself without the user having to specifically allow the installation. That's not a trojan horse.

 

[simsaladimbamba]

Macs now have a real virus to worry about. Not a trojan horse, but something which will install itself without alerting you. Bit scary.

It is NOT a virus, it is a trojan:


Flashback downloaded itself, but the user had to enter the password to actually allow the application to install or execute the installer.

Flashback.I

Infection

Only after downloading the payload does Flashback.I proceed with infecting the machine. To do so, the malware prompts for the administrator password, as in the following screenshot:

The icon indicated by the red box in the screenshot is the PNG content returned by the remote host. This is dropped to the location '/tmp/.i.png' on the system. Since this image is controlled by the remote host, it can be changed any time the author deems necessary.

Flashback.K

Installation

There are two files that are dropped and executed on the system when users visited a malicious webpage.

The first file is an updater component. It is dropped in the users home folder. It may have the default filename ".jupdate" or a filename supplied by the malicious webpage. The filename will always start with a ".".

A launch point is then created for the updater component in the ~/Library/LaunchAgents folder. It may have the default filename "com.java.update.plist" or a filename supplied by the malicious webpage.

On the first execution, this component reports to the following:

http://[...]31.31.79.87/[...]/stat_svc/
On the second execution and onwards, it connects to a hard coded list of addresses to download it's update.

The second file is the downloader component just like the previous variants. It is dropped and executed in the /tmp folder. It may have the default filename "Update" or a filename supplied by the malicious webpage.

The malware then reports to the following location whether it successfully exploited the system or not:

http://[...]31.31.79.87/[...]/stat_j/%result%

 

[GGJstudios]

It installs itself without the user having to specifically allow the installation. That's not a trojan horse.

Read the Mac Virus/Malware FAQ for the definitions of a virus and a trojan. It's not a virus.

 

[GoCubsGo]

Decent movie, I'd watch it again.

 

[0dev]

Ahem...

Whether or not the user inputs their administrator password at the prompt determines the type of infection the malware subsequently performs:

Infection Type 1

If the user inputs their administrator password, the malware will create the following files:

/Applications/Safari.app/Contents/Resources/.%decoded_filename%.png - contains %decoded_binary1_contents% and %decoded_payload_config%
/Applications/Safari.app/Contents/Resources/.%decoded_filename%.xsl - contains %decoded_binary2_contents%

The malware then creates a launch point, inserting the following line into "/Applications/Safari.app/Contents/Info.plist":

<key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key>
<string>/Applications/Safari.app/Contents/Resources/.%decoded_filename%.xsl</string></dict>

This in effect will inject binary2 into Safari when the browser is launched.

If the malware was able to infect the system this way, it reports success to the following URL:

http://[...]31.31.79.87/[...]/stat_d/

If it failed to infect the system, the malware reports to the following URL:

http://[...]31.31.79.87/[...]/stat_n/


Infection Type 2

In cases where the user did not input their administrator password, the malware checks if the following path exists in the system:

/Applications/Microsoft Word.app
/Applications/Microsoft Office 2008
/Applications/Microsoft Office 2011
/Applications/Skype.app

If any of these are found, the malware again skips the rest of its routine and proceeds to delete itself, presumably to avoid infecting a system that has an incompatible application installed.

If none of the incompatible applications are found, the malware will create the following files:

~/Library/Application Support/.%decoded_filename%.tmp - contains %decoded_binary1_contents% and %decoded_payload_config%
/Users/Shared/.libgmalloc.dylib - contains %decoded_binary2_contents%

The malware then creates a launch point by creating "~/.MacOSX/environment.plist", containing the following lines:

<key>DYLD_INSERT_LIBRARIES</key>
<string>/Users/Shared/.libgmalloc.dylib</string>

This in effect will inject binary2 into every application launched by the infected user.

For this infection type, the malware reports the successful infection to the following URL:

http://[...]31.31.79.87/[...]/stat_u/

Even if you do not enter your password, it will infect your system anyway. This serves as a way to alert the user of the infection, yes, but it's not like you have to enter your password for it to work.

 

[GGJstudios]

Decent movie, I'd watch it again.

LOL! There were several movies by that name. Which one are you referring to? (Great avatar, btw!)

Even if you do not enter your password, it will infect your system anyway. This serves as a way to alert the user of the infection, yes, but it's not like you have to enter your password for it to work.

It still doesn't replicate itself like a true virus. It can't spread without user action.

 

[Mal]

Or stop including it with Macs. They can't say "it's not an Apple thing" if they're pre-installing it, especially since they don't give users any easy way to uninstall it.

That's exactly what Apple did with Lion. Java is not installed by default, and hence this exploit does not work on a vanilla 10.7.x install.

Of course, if you upgraded from a previous OS and had Java installed (and it was by default) it didn't uninstall it, so anyone who didn't buy a computer with 10.7 already installed would still potentially be at risk, if they didn't follow other good security steps.

jW

 

[GoCubsGo]

LOL! There were several movies by that name. Which one are you referring to? (Great avatar, btw!)
It still doesn't replicate itself like a true virus. It can't spread without user action.

The one with Dennis Hopper of course!

 

[GGJstudios]

The one with Dennis Hopper of course!

LOL! Poor Kiefer!

 

[0dev]

It still doesn't replicate itself like a true virus. It can't spread without user action.

True, it doesn't replicate itself. It spread to a f**kload of Macs regardless though.

Like I said, the real scary part is that it can install itself without the user doing anything. This is the kind of thing Apple used to insult Windows for and, due to their laziness pushing out patches, they've allowed it to happen to Macs too.

That's exactly what Apple did with Lion. Java is not installed by default, and hence this exploit does not work on a vanilla 10.7.x install.

Of course, if you upgraded from a previous OS and had Java installed (and it was by default) it didn't uninstall it, so anyone who didn't buy a computer with 10.7 already installed would still potentially be at risk, if they didn't follow other good security steps.

jW

Yes, they've seen the light with Lion, but a good percentage of users are still running Leopard or Snow Leopard, and Leopard users don't even get the update.

I think after all this I'm gonna update to Lion ASAP on a fresh install, especially since Charlie Miller praised its security so much. If I restore from a Time Machine backup after I've installed Lion so I can port my user files and apps over, that won't reinstall Java will it?

 

[ixodes]

... except it's not a true virus. It is, indeed, a trojan, and easily avoidable by user action.

I concur.

Why people insist on using the moniker "Virus" is rather disturbing.

Especially when in many cases they do not have the technical knowledge to know the difference. With all due respect to the members here, that use "virus" as a description, learning the difference between the two is quite useful.

If you are genuinely interested in elevating your knowledge of computers, (not just Macs) there's a lot of great information readily available via any search engine, that will help you understand why a Virus and Malware are not the same.

Taking responsibility for your education on this topic will give you great insight and a working knowledge of current and future challenges.

 

[ixodes]

Update as of April 17th @ 3:45 PST

Below is todays poll (@ Computerworld) regarding the publics perception of OS X.

Quite an interesting perspective from across the web.
---------
- QuickPoll -

- Confirms what we knew: OS X was never as secure as assumed. 41.01% (1,079 votes)

- It's a mixed blessing: Apple's popularity now makes it a target. 23.34% (614 votes)

- It's a sign that Mac users should install security software now. 10.45% (275 votes)

- If Apple is slow to respond, it could raise doubts about OS X. 5.89% (155 votes)

- No harm done, because no OS is 100% secure. 19.31% (508 votes)

Total Votes: 2,631


http://www.computerworld.com/

 

[0dev]

Lion is a very secure OS, Charlie Miller even called it the most secure OS of all. What this does show, however, is that Macs are still not invulnerable to self-installing malware. That's the big deal here.

It also reinforces that Java is terrible for security and that Apple needs to release patches quicker. But we knew that already.

 

[dknightd]

That's exactly what Apple did with Lion. Java is not installed by default, and hence this exploit does not work on a vanilla 10.7.x install.

But a lot of things needs java. I haven't researched it carefully, but as near as I can tell the only way to install java on a Mac is to use apple's. And apple is always quite a bit behind the Sun/Oracle version.