Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:50 PM
Connect Directly

Apple Mac Attack Began With Infected WordPress Sites

Meanwhile, researchers await a possible Flashback comeback by the botnet operators

The massive Flashback botnet of Mac machines originated from hacked and malware-rigged WordPress blog sites, researchers revealed today.

There were between 30,000 to 100,000 WordPress sites infected in late February and early March, 85 percent of which are in the U.S., said Vicente Diaz, senior security analyst for Kaspersky Lab, in a press briefing today.

Kaspersky Lab researchers say the infected WordPress blog sites were rigged with code that silently redirected visitors to a malicious server. "When the connection was made to the malicious server, that server would determine which OS was running and serve exploits accordingly," says Roel Schouwenberg, senior researcher for Kaspersky. It was a pay-per-install scheme to spread malware, including the Flashback Trojan.

Most researchers say a gradual decline in machines infected by the Trojan is still under way: As of yesterday, there were about 140,000 infected Macs still out there, according to Symantec, and Kaspersky says it sees only about 30,629 Flashback-infected bots in its sinkhole.

Still on the horizon, too, is the possibility of a Flashback comeback, with the command-and-control servers sending their bots updates. "We are watching the command-and-control domains used to control this botnet for any updates ... We haven't seen any new updates being delivered," says Liam O Murchum, manager of operations for Symantec Security Response. "Flashback generates new domains every day, which shows us the attackers have probably written malicious code before. They are aware that their botnet could be taken down with a single domain, so they generate a new one every day."

Flashback may be the largest known botnet made up of Apple Macintosh computers, and the outbreak of infections, mainly in the U.S., appears to have ushered in the beginning of the end of the age of innocence for Mac users. While attacks on the Mac aren't new, this one was high-profile and widespread.

Word spread rapidly earlier this month that a massive botnet of Mac OS X machines was building, and it reached more than 700,000 machines before antivirus vendors including Kaspersky Lab, F-Secure, and Symantec issued their own detection and removal tools. Apple issued an update to patch for the exploited vulnerability over the weekend. The Flashback malware exploits a known vulnerability in Java that had been patched by Oracle.

Apple did not respond to a press inquiry for this article. Its updates for OS X Lion and Mac OS X v10.6 patch the Java implementation hole and remove Flashback, and Apple also provided an update for OS X Lion that removes Flashback from Macs that don't run Java.

Kaspersky's Diaz says the biggest drop in infections came after Apple's update. Apple has been under fire for the late response to the flaw.

Symantec, meanwhile, hasn't seen infected WordPress sites used in the Flashback attack per se, but has seen URL redirections to the Flashback Trojan domains for spreading the malware. "We won't know how it was infected in the first place -- whether it was WordPress [or something else], but it was redirecting to the exploit pages distributing Flashback," Murchu says.

Murchu says the attackers behind Flashback demonstrated the same skills as those who target Windows -- an indication that the shift to the Mac OS X is just another business decision by cybercriminals looking for more ways to make money as the Mac becomes more mainstream.

"The techniques they used were like those who are skilled, or how an experienced virus-writer would use. Clearly, they had previously written malware before and more than likely for Windows," Murchu says. "They know how this works, injecting malware, redirecting users, and making money off that. They have transferred [that knowledge] over to the Mac."

But, wait, there's more: Both Kaspersky and Symantec have been studying targeted attack malware called SabPub written for the Mac OS X.

Costin Raiu, director of global researach and analysis for Kaspersky Lab, says Kaspersky found a single email targeting a pro-Tibetan supporter that contained two attachments that come rigged with the SabPub backdoor Trojan. Raiu says the attacks occurred in February, and that it's related to the LuckyCat APT campaign that targeted entities in Japan and India.

"The C&C server which was used by the SabPub malware is no longer active: It was shut down at the beginning of the week. Hence, infected users will have a 'dormant' malware on their machines, which awaits for C&C to come back to life," Raiu says.

"I presume that is because of the high number of attacks against Tibetan activists. Some of them probably switched to Macs as a way of escaping the attacks and mitigating the risks. The LuckyCat gang probably noticed this shift and decided to implement attacks than can also affect such targets," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
4/21/2012 | 11:39:28 PM
re: Apple Mac Attack Began With Infected WordPress Sites
As a side note, here is an interesting article on preventing common WordPress vulnerabilities:
Brian Prince, InformationWeek/Dark Reading Comment Moderator
User Rank: Apprentice
4/21/2012 | 4:14:06 AM
re: Apple Mac Attack Began With Infected WordPress Sites
This is the same thing that happened at pown to own.- Any time you integrate the browser into the OS you are open up security vulnerabilities.- Microsoft has had issues like this for years.- Apple sacrificed security for useability.
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.