Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/19/2012
04:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Apple Mac Attack Began With Infected WordPress Sites

Meanwhile, researchers await a possible Flashback comeback by the botnet operators

The massive Flashback botnet of Mac machines originated from hacked and malware-rigged WordPress blog sites, researchers revealed today.

There were between 30,000 to 100,000 WordPress sites infected in late February and early March, 85 percent of which are in the U.S., said Vicente Diaz, senior security analyst for Kaspersky Lab, in a press briefing today.

Kaspersky Lab researchers say the infected WordPress blog sites were rigged with code that silently redirected visitors to a malicious server. "When the connection was made to the malicious server, that server would determine which OS was running and serve exploits accordingly," says Roel Schouwenberg, senior researcher for Kaspersky. It was a pay-per-install scheme to spread malware, including the Flashback Trojan.

Most researchers say a gradual decline in machines infected by the Trojan is still under way: As of yesterday, there were about 140,000 infected Macs still out there, according to Symantec, and Kaspersky says it sees only about 30,629 Flashback-infected bots in its sinkhole.

Still on the horizon, too, is the possibility of a Flashback comeback, with the command-and-control servers sending their bots updates. "We are watching the command-and-control domains used to control this botnet for any updates ... We haven't seen any new updates being delivered," says Liam O Murchum, manager of operations for Symantec Security Response. "Flashback generates new domains every day, which shows us the attackers have probably written malicious code before. They are aware that their botnet could be taken down with a single domain, so they generate a new one every day."

Flashback may be the largest known botnet made up of Apple Macintosh computers, and the outbreak of infections, mainly in the U.S., appears to have ushered in the beginning of the end of the age of innocence for Mac users. While attacks on the Mac aren't new, this one was high-profile and widespread.

Word spread rapidly earlier this month that a massive botnet of Mac OS X machines was building, and it reached more than 700,000 machines before antivirus vendors including Kaspersky Lab, F-Secure, and Symantec issued their own detection and removal tools. Apple issued an update to patch for the exploited vulnerability over the weekend. The Flashback malware exploits a known vulnerability in Java that had been patched by Oracle.

Apple did not respond to a press inquiry for this article. Its updates for OS X Lion and Mac OS X v10.6 patch the Java implementation hole and remove Flashback, and Apple also provided an update for OS X Lion that removes Flashback from Macs that don't run Java.

Kaspersky's Diaz says the biggest drop in infections came after Apple's update. Apple has been under fire for the late response to the flaw.

Symantec, meanwhile, hasn't seen infected WordPress sites used in the Flashback attack per se, but has seen URL redirections to the Flashback Trojan domains for spreading the malware. "We won't know how it was infected in the first place -- whether it was WordPress [or something else], but it was redirecting to the exploit pages distributing Flashback," Murchu says.

Murchu says the attackers behind Flashback demonstrated the same skills as those who target Windows -- an indication that the shift to the Mac OS X is just another business decision by cybercriminals looking for more ways to make money as the Mac becomes more mainstream.

"The techniques they used were like those who are skilled, or how an experienced virus-writer would use. Clearly, they had previously written malware before and more than likely for Windows," Murchu says. "They know how this works, injecting malware, redirecting users, and making money off that. They have transferred [that knowledge] over to the Mac."

A Mac APT
But, wait, there's more: Both Kaspersky and Symantec have been studying targeted attack malware called SabPub written for the Mac OS X.

Costin Raiu, director of global researach and analysis for Kaspersky Lab, says Kaspersky found a single email targeting a pro-Tibetan supporter that contained two attachments that come rigged with the SabPub backdoor Trojan. Raiu says the attacks occurred in February, and that it's related to the LuckyCat APT campaign that targeted entities in Japan and India.

"The C&C server which was used by the SabPub malware is no longer active: It was shut down at the beginning of the week. Hence, infected users will have a 'dormant' malware on their machines, which awaits for C&C to come back to life," Raiu says.

"I presume that is because of the high number of attacks against Tibetan activists. Some of them probably switched to Macs as a way of escaping the attacks and mitigating the risks. The LuckyCat gang probably noticed this shift and decided to implement attacks than can also affect such targets," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/21/2012 | 11:39:28 PM
re: Apple Mac Attack Began With Infected WordPress Sites
As a side note, here is an interesting article on preventing common WordPress vulnerabilities:
http://www.esecurityplanet.com...-
Brian Prince, InformationWeek/Dark Reading Comment Moderator
lipanitech
50%
50%
lipanitech,
User Rank: Apprentice
4/21/2012 | 4:14:06 AM
re: Apple Mac Attack Began With Infected WordPress Sites
This is the same thing that happened at pown to own.- Any time you integrate the browser into the OS you are open up security vulnerabilities.- Microsoft has had issues like this for years.- Apple sacrificed security for useability.
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16966
PUBLISHED: 2019-10-21
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on...
CVE-2019-9491
PUBLISHED: 2019-10-21
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
CVE-2019-16964
PUBLISHED: 2019-10-21
app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any comma...
CVE-2019-16965
PUBLISHED: 2019-10-21
resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
CVE-2019-18203
PUBLISHED: 2019-10-21
On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi.