Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:53 PM
Connect Directly

Java Trojan Bungles Mac Attack

Mac malware might be worrisome if it were coded better.

Apple's decision to deprecate Java may have an upside: If Java does disappear from the Mac, a lot of potential security problems go away.

One such problem surfaced on Wednesday, albeit a relatively minor one. Mac security company Intego reported that it had discovered a Mac OS X version of the Koobface malware, which is designed to spread on social networks like Facebook, MySpace, and Twitter.

The malware is actually able to attack multiple platforms, but it targets Mac OS X though a malicious Java applet.

Earlier this month, Microsoft reported "an unprecedented wave of Java exploitation," a consequence of the fact that Java installations are often not up-to-date.

Intego says that users may encounter the Mac Koobface malware through links on social networks or other Web sites. The links lead to video Web sites that attempt to load the malicious Java applet. This will trigger the standard Mac OS X Java security alert dialog box.

"Users can deny or allow the applet access to their computers," Intego explains in its security advisory. "If they click Deny, the applet will not run, and no infection will occur. If they click Allow, however, the applet will run, and will attempt to download files from one or more remote servers."

Files that are downloaded will be stored in a hidden directory. They include components necessary to attack Mac OS X, Linux, and Windows. In theory, the Mac OS X version of Koobface is as dangerous as the Windows version. It's designed to create a local Web server and IRC server as a means of participating in a botnet, to change the user's DNS settings, and to incorporate other functions provided through subsequent downloads.

But Intego says that the Mac malware is not as dangerous as it might be because it's poorly coded.

"While this is an especially malicious piece of malware, the current Mac OS X implementation is flawed, and the threat is therefore low," Intego says. "However, Mac users should be aware that this threat exists, and that it is likely to be operative in the future, so this Koobface Trojan horse may become an issue for Macs."

Security software companies have been saying as much for years.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-17
Comtech H8 Heights Remote Gateway 2.5.1 devices allow XSS and HTML injection via the Site Name (aka SiteName) field.
PUBLISHED: 2019-10-17
rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
PUBLISHED: 2019-10-16
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.