Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/19/2012
04:50 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Apple Mac Attack Began With Infected WordPress Sites

Meanwhile, researchers await a possible Flashback comeback by the botnet operators

The massive Flashback botnet of Mac machines originated from hacked and malware-rigged WordPress blog sites, researchers revealed today.

There were between 30,000 to 100,000 WordPress sites infected in late February and early March, 85 percent of which are in the U.S., said Vicente Diaz, senior security analyst for Kaspersky Lab, in a press briefing today.

Kaspersky Lab researchers say the infected WordPress blog sites were rigged with code that silently redirected visitors to a malicious server. "When the connection was made to the malicious server, that server would determine which OS was running and serve exploits accordingly," says Roel Schouwenberg, senior researcher for Kaspersky. It was a pay-per-install scheme to spread malware, including the Flashback Trojan.

Most researchers say a gradual decline in machines infected by the Trojan is still under way: As of yesterday, there were about 140,000 infected Macs still out there, according to Symantec, and Kaspersky says it sees only about 30,629 Flashback-infected bots in its sinkhole.

Still on the horizon, too, is the possibility of a Flashback comeback, with the command-and-control servers sending their bots updates. "We are watching the command-and-control domains used to control this botnet for any updates ... We haven't seen any new updates being delivered," says Liam O Murchum, manager of operations for Symantec Security Response. "Flashback generates new domains every day, which shows us the attackers have probably written malicious code before. They are aware that their botnet could be taken down with a single domain, so they generate a new one every day."

Flashback may be the largest known botnet made up of Apple Macintosh computers, and the outbreak of infections, mainly in the U.S., appears to have ushered in the beginning of the end of the age of innocence for Mac users. While attacks on the Mac aren't new, this one was high-profile and widespread.

Word spread rapidly earlier this month that a massive botnet of Mac OS X machines was building, and it reached more than 700,000 machines before antivirus vendors including Kaspersky Lab, F-Secure, and Symantec issued their own detection and removal tools. Apple issued an update to patch for the exploited vulnerability over the weekend. The Flashback malware exploits a known vulnerability in Java that had been patched by Oracle.

Apple did not respond to a press inquiry for this article. Its updates for OS X Lion and Mac OS X v10.6 patch the Java implementation hole and remove Flashback, and Apple also provided an update for OS X Lion that removes Flashback from Macs that don't run Java.

Kaspersky's Diaz says the biggest drop in infections came after Apple's update. Apple has been under fire for the late response to the flaw.

Symantec, meanwhile, hasn't seen infected WordPress sites used in the Flashback attack per se, but has seen URL redirections to the Flashback Trojan domains for spreading the malware. "We won't know how it was infected in the first place -- whether it was WordPress [or something else], but it was redirecting to the exploit pages distributing Flashback," Murchu says.

Murchu says the attackers behind Flashback demonstrated the same skills as those who target Windows -- an indication that the shift to the Mac OS X is just another business decision by cybercriminals looking for more ways to make money as the Mac becomes more mainstream.

"The techniques they used were like those who are skilled, or how an experienced virus-writer would use. Clearly, they had previously written malware before and more than likely for Windows," Murchu says. "They know how this works, injecting malware, redirecting users, and making money off that. They have transferred [that knowledge] over to the Mac."

A Mac APT
But, wait, there's more: Both Kaspersky and Symantec have been studying targeted attack malware called SabPub written for the Mac OS X.

Costin Raiu, director of global researach and analysis for Kaspersky Lab, says Kaspersky found a single email targeting a pro-Tibetan supporter that contained two attachments that come rigged with the SabPub backdoor Trojan. Raiu says the attacks occurred in February, and that it's related to the LuckyCat APT campaign that targeted entities in Japan and India.

"The C&C server which was used by the SabPub malware is no longer active: It was shut down at the beginning of the week. Hence, infected users will have a 'dormant' malware on their machines, which awaits for C&C to come back to life," Raiu says.

"I presume that is because of the high number of attacks against Tibetan activists. Some of them probably switched to Macs as a way of escaping the attacks and mitigating the risks. The LuckyCat gang probably noticed this shift and decided to implement attacks than can also affect such targets," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
lipanitech
50%
50%
lipanitech,
User Rank: Apprentice
4/21/2012 | 4:14:06 AM
re: Apple Mac Attack Began With Infected WordPress Sites
This is the same thing that happened at pown to own.- Any time you integrate the browser into the OS you are open up security vulnerabilities.- Microsoft has had issues like this for years.- Apple sacrificed security for useability.
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/21/2012 | 11:39:28 PM
re: Apple Mac Attack Began With Infected WordPress Sites
As a side note, here is an interesting article on preventing common WordPress vulnerabilities:
http://www.esecurityplanet.com...-
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27581
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVE-2021-28042
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
CVE-2021-28041
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVE-2021-3377
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
CVE-2021-3420
PUBLISHED: 2021-03-05
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.