Attacks/Breaches
4/18/2012
12:18 PM
50%
50%

Flashback Malware Eradication Campaign Slower Than Expected

Efforts to remove infection from Apple computers is not as effective as security experts had hoped.

The campaign to eliminate the Flashback malware from Apple OS X devices has seen the number of infected machines decline from more than 600,000 at the peak of the infection. By Monday, Symantec reported that just 140,000 active infections were detected, and on Tuesday fewer than 99,000.

"The statistics from our sinkhole are showing declining numbers on a daily basis. However, we had originally believed that we would have seen a greater decline in infections at this point in time, but this has proven not to be the case," read a blog post from Symantec Security Response.

While infections have already declined by over 80%, why haven't they gone down further and faster? "As there have been tools released by Symantec and other vendors in the past few days concerning this threat, the infection numbers should have seen a dramatic decrease by now," according to Symantec. Indeed, detection and eradication tools have been available for a week, and Apple released an automatic operating system upgrade Friday for OS X 10.6 and 10.7.

[ Read about Mozilla's approach to bolstering Firefox's security. See Firefox To Require Permission For Plug-Ins. ]

Flashback isn't something to take lightly. Notably, Flashback targets a Java vulnerability that was apparently reverse-engineered by attackers after Oracle patched the same flaw in Windows about two months ago. The attackers then used the flaw to facilitate malware drive-by attacks against Macs. Successfully infected computers, or "zombie Macs," get added to a botnet, which could push additional malicious code modules onto the computer. As Symantec noted, "The Flashback payload is considerably larger than the initial stage downloading component."

While security researchers are still unraveling how the malware works, one interesting feature they've found is that the malware can receive command and control (C&C) server contact details--essentially, learn new ways to dial home--via Twitter. According to Symantec, "one of the new features of the Trojan is that it can now retrieve updated C&C locations through Twitter posts by searching for specific hashtags generated by the OSX.Flashback.K hashtag algorithm."

The campaign to eliminate Flashback has moved quickly. After security watchers first spotted the malware, Apple last week broke with tradition--typically it says nothing about any security vulnerability in its products until it's released a fix--by announcing that it was in the process of coding a fix for Flashback. Other companies, including security firm Kaspersky, had already released tools for detecting Flashback (aka Flashfake)--with links to their free antivirus products for infected users to eradicate the malware.

But Apple upped the ante with a novel security strategy: disabling Java. In addition to updating the Java distribution for Apple OS X 10.6 and 10.7 to eliminate the bug exploited by Flashback, for 10.7 Apple also included a feature that disables Java if it hasn't been used for 35 days.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.