Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/24/2012
10:18 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

One In Five Macs Harbors Malware, Sophos Research Reveals

Both Windows and Mac threats were discovered

BOSTON, MA, Apr 24, 2012 (MARKETWIRE via COMTEX) -- New research released by Sophos has revealed a disturbingly high level of malware on Mac computers -- with both Windows and Mac threats being discovered.

Sophos experts analyzed a snapshot of 100,000 Mac computers running its free anti-virus software, and discovered that one in five machines was found to be carrying one or more instances of Windows malware.

Although Windows malware on Macs will not cause symptoms (unless users also run Windows on their computer), it can still be spread to other computers.

Additionally, Sophos's analysis shows that 2.7 percent (one in thirty six) of Macs were found to be carrying Mac OS X malware.

"Some Mac users may be relieved that they are seven times more likely to have Windows viruses, spyware and Trojans on their Macs than Mac OS X-specific malware, but Mac malware is surprisingly commonly encountered," said Graham Cluley, senior technology consultant at Sophos. "Mac users need a wake-up call about the growing malware problem."

The recent Flashback botnet, which inflicted more than 600,000 users, and fake anti-virus attacks, which scare users into handing over their credit card details, dominate the chart of Mac-based threats.

Top Mac OS X malware found on Mac computers (7-day snapshot of 100,000 Macs): 1. OSX/Flshplyr 75.1% 2. OSX/FakeAV 17.8% 3. OSX/RSPlug 5.5% 4. OSX/Jahlav 1.2% 5. Other 0.4%

"Mac malware can spread via USB stick, email attachments, website download, or even a silent drive-by installation where the user doesn't realize their Mac's security has been subverted," continued Cluley. "Cybercriminals view Macs as a soft target, because their owners don't typically run anti-virus software and are thought to have a higher level of disposable income than the typical Windows user. Mac users must protect their computers now or risk making the malware problem on Macs as big as the problem on PCs."

One in five Macs users who downloaded and scanned their system found Windows malware on Mac computers:

Top Windows malware found on Mac computers (7-day snapshot of 100,000 Macs): 1. Mal/Bredo 12.2% 2. Mal/Phish 7.4% 3. Mal/FakeAV 3.8% 4. Troj/ObfJS 3.6% 5. Mal/ASFDldr 3.3% 6. Troj/Invo 3.0% 7. Troj/Wimad 2.6% 8. Mal/Iframe 1.5% 9. Mal/JavaGen 1.4% 10. Other 61.2%

Some of the malware discovered by Sophos on the 100,000 Mac computers sampled dates back to 2007, and would have been easily detected if the users had run an anti-virus product sooner. Bredo, a family of malicious programs sent out via spam, accounts for 12.2 percent of malware detected on Mac computers. The first Bredo variant was detected in 2009, and since then, countless variants have been released. Only last week, it was used in a malicious email campaign that purported to have attached a compromising picture of the recipient.

"The simple fact is that you can scan your Mac for infection from your armchair. The test is painless and free; you just download an anti-virus product and allow it to check your computer and protect it against infections in the future," explained Cluley.

Home users can join the millions of others who protect their computers by downloading a free version of Sophos Anti-Virus for Mac from: http://www.sophos.com/freemacav .

Further information about these malware findings on Macs can be found on Sophos's Naked Security site at: http://nakedsecurity.sophos.com .

About Sophos More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, mobile and network security solutions backed by SophosLabs -- a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.

Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com .

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
The Data-Centric Path to Zero Trust
Altaz Valani, Director of Insights Research, Security Compass,  1/13/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).