A new semi-functional malware has been found for OSX. Discovered on a computer at the Oslo Freedom Forum by researcher Jacob Appelbaum, the OSX/KitM.A is a backdoor application which launches on boot and captures screenshots on a regular basis, which are then dumped in a folder.
A bit of malware -- a Trojan horse file that tries to redirect to a website -- has been found inside an iOS app, but the code has turned out to be harmless. The app in question is called Simply Find It ($2) and comes from a legitimate developer that has produced a number of legitimate games -- suggesting that the malware was probably inserted into the app accidentally. The bigger issue (since there is no direct threat posed by the bad code) is how Apple's testing procedure missed it -- and how two well-known anti-malware scanners couldn't pick up on it either.
(Updated with Phil Schiller Twitter post) For years, Mac owners have gently rebuffed the myth that the Mac is so resistant to viruses because of "security through obscurity." No, they'd say, it's because the OS is better hardened against threats. Now the malware discussion has moved on to mobile, and that case is being debated anew: the most popular and one of the fastest-fading current cellphone OSes are responsible for a whopping 89 percent of all mobile device malware, while three of the most well-known smartphone platforms -- iOS, Blackberry and Windows Mobile -- have the fewest issues.
Adobe has issued a patch to update Flash on both the Mac and Windows platform in order to fix two new vulnerabilities already being exploited "in the wild" to spread malware. One of the targeted attacks using the exploit works equally well against Mac users as it does against Windows users. Visitors are tricked into downloading and opening MS Word files that contain malicious Flash content, while the other vulnerability users a similar technique but only affects Windows users.
Microsoft and Symantec have shut down the Bamital botnet, after obtaining a court order to seize the network's controlling servers. The network, dedicated to redirecting users of computers infected with malware to incorrect search results and online advertisements, is estimated to have earned around $1 million per year for it's operators.
Security Essentials, the anti-virus and anti-malware software supplied by Microsoft has failed in anti-virus certification tests. Out of 25 consumer antivirus programs tested by independent laboratory AV-Test in late 2012, only three failed to pass muster, with Microsoft Security Essentials 4.1 being joined by PC Tools Internet Security 2012 and AhnLab Internet Security 8.0.
A previously unknown vulnerability in Java is being used online by hackers, according to security researchers. The 0-day exploit has also reportedly been included in two malware toolkits used by hackers, with the best form of protection currently being to turn off the Java plug-in for all browsers until the hole is patched.
A Russian security firm with a mixed track record is warning about a new malware threat for the Mac, which masquerades as an installer for various types of software. Doctor Web, who claimed to have discovered the malware, says it is widely available on various sites -- though at present it is targeting Russian Mac users. The Trojan is apparently a Mac variation on a widespread Windows and Android trickware ruse that asks users for their cell number in order to send an activation code by SMS.
Adobe warned today that an internal digital code signing server was hacked by "sophisticated threat actors" focusing on Adobe. The early-July hack led to the compilation of a minimum of two malicious files that were digitally signed and authenticated as Adobe genuine software. The hack gave the attackers the means to build malware that the operating system views as legitimate Adobe-created software, making it that much harder for security packages to detect and eliminate the threat.
Although iOS is widely considered to be all but completely malware-free, Mac security company Intego has created an iOS version of its malware scanner VirusBarrier that works with all iOS 4.0 and higher devices. The program is mainly used to scan email attachments for potential Windows viruses, but can also detect any Mac or UNIX malware, adware, keyloggers and Trojan Horse-type programs. The program can also scan ZIP archives and files stored in some cloud locations such as Dropbox, FTP and websites or WebDAV disks.
Microsoft announced Thursday that it was granted permission by the US District Court for the Eastern District of Virginia to wrest control of the "Nitol" botnet. In the filing, Microsoft described how it purchased computers from several districts in China, and approximately 20 percent of them came pre-infected with the malware. Titled "Operation B70" by Microsoft, the seizure of the botnet hubs is the latest attack that the manufacturer has undertaken in an attempt to derail large-scale internet crime operations based off of its operating system.
Another Mideast energy firm has been infected by malware, the second in as many weeks, with energy firm RasGas forced to disconnect itself from the Internet as a precautionary measure after an "unknown virus" overcame countermeasures. Natural gas production has thus far not been affected. Both attacks have been intended for data destruction rather than theft, and spread around internal networks by lurking on shared hard drives.
This week in the MacNN forums one forum member is trying to see if it's possible to install and run Mac OS X on a computer that previously ran Windows, click here to give advice. One disgruntled forum goer is concerned about a MacBook Pro possibly infected with malware, and seeks help to solve the problem.
The originators of the accidentally-discovered Flame malware may have sent commands to the controlled machines to delete and overwrite itself. Interestingly, rather than use a pre-existing command in the code, aptly titled SUICIDE, the controllers sent a whole new directive file that assisted in the auto-uninstallation.
Russian security firm Kaspersky has uncovered a massive malware attack, referred to as Flame, that is believed to have gathered sensitive data from a wide array of countries, including Israel and Iran. The malware is said to be modular and expandable in a manner reminiscent of a smartphone app library. The BBC reports that the complexity of the malware has led experts to believe that it could only have been developed with the assistance of a government entity.
Symantec has discovered a novel implementation of the Android.Opfake malware, one that takes users through a fraudulent app-download process before charging them for what was initially billed as a free app. The malware is notable because it actually directs users through the Google Play app store in the process of defrauding them of money.
Mobile security firm Lookout has issued an update alerting Android users to a new drive-by malware attack. In a first for mobile devices, the latest exploit uses hacked websites to target Android users. Users who have been affected have navigated unsuspectingly to a compromised website that has a hidden iframe at the bottom of each page triggering the NotCompatible Trojan to download to their Android device.
The Java-exploiting malware OSX.Flashback.K variant has ceased to be a meaningful threat to Mac owners, and the number of infected Macs has dropped to one-sixth its high point in just over a week, reports utility vendor Symantec. The malware, which was the most successful attack thus far in the Mac world due to a slow updating of Java, was never much of an actual security threat but did manage to reach around one percent of installed base, a record for malware penetration.
Windows anti-virus software maker Avira has released a free version of the software for Macs, called Avira Free Mac Security. It is available for consumers and businesses alike who may wish to guard against malware downloads and the accidental acquisition and passing on of Windows viruses. While Mac OS X is not affected by viruses and malware aimed at Windows, Mac users can inadvertently e-mail or otherwise share infected files.
A new malware threat dubbed Flashback.N, is actually a variant of an older one, claims anti-virus software maker Intego in a new blog post. Users who visit hacked or maliciously-crafted websites may see a delay, followed by a false password-request dialog box claiming to be from "Software Update." If accidentally installed, the malware inserts code into Safari's resources and will attempt to search network traffic for user names and passwords.
A new piece of Android malware is afflicting thousands of users. North Carolina State University professor Xuxian Jiang, who documented the nature and behavior of RootSmart last week, believes that between 10,000 to 30,000 user devices are connecting to a botnet without their knowledge everyday. Most of the affected users thus far are located in China and have installed the GingerBreak root access tool for Android 2.3 (Gingerbread).
The Mac platform saw a modest increase in malware outbreaks in 2011 over years past, but still "a small fraction" when compared to Windows, said security firm F-Secure. It added that while malware attacks were increasing, the rate of increase was not commensurate with the growth of the platform, suggesting that most exploits tend to come from programs rather than flaws in the OS itself. In all, the company identified 58 separate threats in 2011, most stemming from a handful of vulnerabilities.
Anti-malware makers Sophos and Intego have warned of a new Mac OS X Trojan Horse that hides inside pirated software, specifically GraphicConverter v7.4. The malware, known as OSX/Miner-D or "DevilRobber," steals GPU time to generate counterfeit Bitcoins (part of anonymous digital cash system) and also attempts to steal usernames and passwords through periodic screen captures. It also sends information about the Mac's security setup and browsing history to a remote server.
Several months after Google pulled a long list of titles from the Android Market to help protect users against Malware, the platform has reportedly been targeted by a fresh scam. Security software company NetQin claims to have found malware contained in over 20 Android apps, causing devices to auto-dial phone numbers or send text messages that lead to unwanted fees.
Intego today updated its free VirusBarrier Express anti-malware program to version 1.1, improving and simplifying the program's malware definition update system. The company will now update malware definitions at least once a month, and without charge (a change from the previous system) and will now limit itself to Mac malware definitions (another change). The company also introduced a new product, VirusBarrier Plus, also sold exclusively through the Mac App Store, that guards against both Mac and Windows malware so that Mac users don't pass on Windows viruses or malware (which won't affect the Mac) on to Windows-using friends accidentally.
Google has taken steps to address the rising malware problem that threatens to plague the platform. According to a report from Mashable, Google has pulled 21 apps from the Android Market that have been identified as being aimed at gaining root access to a user’s personal data. While proponents for Google’s platform often deride Apple’s iOS platform for being “closed” and for Apple’s App Store approval process, Google’s stance has seemingly left its users vulnerable to serious security threats.
Anti-virus software maker Sophos -- who recently introduced a free Mac Home Edition of their anti-malware program -- have gathered the statistics generated by their 150,000-strong Mac user base to compile a snapshot report on threats facing the platform. While the results tacitly admit the lack of actual Mac viruses and the low incidence of other Mac-specific malware, the company says the risk of Mac-specific or platform-independent non-virus malware -- and the need for detection software -- is growing.
The SecureMac team along with ESet Security have identified a new variant of the trojan horse malware they call "Boonana" (Intego and other firms refer to it as a form of the Windows trojan "Koobface," for reasons SecureMac disputes) that uses even crueler trickery in an attempt to convince users to install it. In addition, the companies has identified new servers actively collecting keylogged data such as user names and passwords. Though easy to prevent infection or remove if infected, the refined setup and misleading nature may fool novice users.
Intelus, makers of MacVide, have updated their network firewall application ProteMac NetMine to v2, bringing with it an all-new interface and new firewall rules editor as well as real-time connection requests. The two-way firewall protects Macs from malicious attacks or software from both internal and external network sources, providing protection from hackers, keyloggers, malware and unauthorized program use.
Intego has sent out an alert to a new form of Mac malware called HellRTS. It is a low risk backdoor code allowing remote users to take control of a computer. The RealBasic-built, universal code can set up its own server on an infected Mac, configure a server port and password. It duplicates itself, using the names of Mac applications, adding the new applications to a user's login items, ensuring that it starts up at login. It sends e-mail via its own mail server, contacting a remote server to give access to an infected Mac.
The Camino Project has released an update to its self-titled browser for Mac OS X. Version 2.0 adds a tab overview feature that allows users to quickly browse all open tabs in a layout preview. Tabbed browsing has also been improved with drag-and-drop rearranging, a scrollable bar, and a dedicated menu listing all of the open tabs.
The upcoming Snow Leopard update reportedly contains new anti-malware functionality, according to the Mac security company Intego. A number of beta testers have noticed a new warning screen that alerts users to malicious code. A leaked screenshot shows an alert dialog for an RSPlug Trojan contained in a disk image downloaded through Safari.
TrendMicro has spotted another Domain Naming System (DNS) Trojan targeting Mac systems. The malware, known as OSX/Jahlav-D, masquerades as a MacCinema Installer. Users are prompted to update QuickTime Player by downloading a QuickTimeUpdate.dmg file.
A new piece of Mac-targeted malware has entered the wild, say security researchers with ParetoLogic. Dubbed OSX/Jahlav-C, the software is currently associated with a website called PornTube, and is described as a Trojan concealing itself as an ActiveX object needed to run video. The approach is somewhat unusual in that ActiveX is uniquely associated with Windows, and therefore less likely to deceive a Mac user.
Apple has changed its attitude towards viruses and malware on the Mac, claims security firm Intego. Apple last year issued an advice statement admitting that "since no system can be 100 percent immune from every threat, antivirus software may offer additional protection." In announcing more features of Mac OS X Snow Leopard, Intego notes that Apple has taken a more stringent approach, for instance implementing code changes like sandboxing, library randomization and execute disables; each limits the potential damage of an outside threat.
The first known botnet to exploit Mac OS X has been activated, security researchers claim. The network is believed to have been put in place by iServices, a Trojan infection accompanying some pirated versions of iWork '09 and Photoshop CS4. Although downloaded at least 20,000 times by the end of January, the Trojan's payload has remained dormant for some time, in the same manner as many Windows botnets.
Mac owners are unlikely to be affected by the Conficker worm, claims security firm Intego. The worm -- also known as Downadup and Kido -- has already infected a number of Windows computers, and is expected to become active on Wednesday. Though the exact behavior it will exhibit is unknown, researchers are said to believe that it will connect to remote servers to download code, and then become malicious.
A second Mac trojan is being spread through pirated software, Intego warns. Following the discovery of a trojan linked with copies of iWork '09, the security firm says it has now found a variant, attached to pirated versions of Photoshop CS4. OSX.Trojan.iServices.B also grants a remote user root access; the new trojan is associated with the crack application however, and is spawned under a different name whenever the crack is run.
A new Trojan attack has been linked with illegal copies of iWork '09, says Intego. The security firm notes that in some copies of iWork found on BitTorrent sites -- and other pirating venues -- a Trojan dubbed OSX.Trojan.iServices.A is attached, masquerading in the form of a package file called iWorkServices. When the iWork installer is launched, iWorkServices is launched as well; while this may be halted by a request for an administrator password, Intego warns that Mac OS X 10.5.1 and earlier will install the Trojan without further prompting.
Many Mac anti-virus programs waste their time scanning for Windows contaminants. While this may be fine if you need to share files with Windows users, you may not want a program that gobbles up excess memory and processing time just to protect against malware that can never even hurt your own hardware. If you’d rather have an anti-virus app that focuses solely on keeping Macs virus-free, one option is PC Tool’s iAntiVirus.
A third variant of the RSPlug Trojan has appeared online, says security firm Intego. Following in the wake of the RSPlug.D version, Intego notes that another mutant copy called RSPlug.E has appeared. The new Trojan is said to be very similar in scope to D, being mainly found on dubious pornography sites, and equipped with a downloader that installs files from a remote server.
A second piece of Trojan-like malware is currently threatening Macs, say security vendors. OSX.Lamzev.A, also known as OSX.TrojanKit.Malez, allows hackers to install a backdoor on a victim's computer and thereby assume control of it. The software is said not to be a true Trojan, however, as an attacker must already have access to the target Mac to make use of the code.
A new version of an existing Trojan poses a significant threat to Mac users, claims the Intego security firm. Based on RS.Plug.A, the RSPlug.D Trojan is said to find its way onto computers through malicious websites, namely several less scrupulous porn sites. On visiting a particular page a person will be greeted with a "Video ActiveX Object Error," stating that their browser cannot play a particular video; it then asks people to download the ActiveX object in question.
Mac users should be on guard against a fake Mac security tool being distributed online, says the Intego security firm. The program, called MacGuard, claims to scan a computer for "adware, spyware and trojans," and then eliminate them; in reality the app is actually a version of existing Windows malware, which has already infected as many as 30 million people worldwide. The latter assumes control of a person's computer, and displays messages warning about a false infection in an attempt to get users to pay money.
RealNetworks is urging Mac users to upgrade to version 11.0 of its RealPlayer application, due to a potential security exploit. The malware research site Secunia rates the problem as "highly critical," with potential risk of malicious system access and exposure of sensitive information. The vulnerability affects Realplayer v10 and v10.1 for Mac OS X. The company did not issue a patch, but is instead urging users to upgrade to RealPlayer 11.0. The company says there is a problem with Realplayer's ActiveX import method buffer overflow.
Anyone who has used a Windows PC knows that you absolutely must have an anti-virus program or else your computer will likely crash the moment you connect to the Internet. Fortunately, the Mac has remained largely untouched by the variety of malware (viruses, worms, Trojan Horses, and spyware) that plagues PCs. However, with the growing popularity of the Mac, it’s inevitable that more people will start writing malware for the Mac. Although you don’t need an anti-virus program for the Mac just yet, you might feel safer knowing that a free one exists called PC Tools iAntiVirus.
Security software developer PC Tools has just released a beta of iAntiVirus, its first security software for the Mac. The company says iAntiVirus uses less memory and system resources than similar security applications because it ignores Windows viruses and only removes malware intended for the Mac. “Let’s face it, malware is (now) a business,” said Michael Greene, PC Tools Vice President of Product Strategy. He says rapid growth in Mac market share has made the platform a profitable target for organized identity theft.
Though servers offering the software are currently buckling and inaccessible to many users, Firefox 3.0 on Tuesday has made its debut with the Mozilla organization looking to set a record for browser downloads. The major new release of the open source Web browser is available today in approximately 50 languages, and is purportedly three times faster than its predecessor, offering "15,000 improvements" including a smart location bar and malware protection. The new Firefox 3 smart location bar, dubbed "Awesome Bar" by Mozilla, adapts to user entries over time. The Firefox 3 Library archives browsing history, bookmarks, and tags, where they can be searched and organized.
