For many years, Apple fans have crowed about the relative security of their platform, with Windows' prevalence painting a huge target on it for hackers and ne'er-do-wells of all stripes. That was back when Macs has a market share lower than the current unemployment rate, and its adherents were a grizzled, hardened crew packed with zealots.
Now, Apple is the world's most valuable company, making money hand over fist to the point where they don't know what to do with all the cash. With great success, comes great attention … and legions of haters, in the form of hackers. Now, they've struck Mac OS X in a major way …
The Flashback Trojan is proving to be a very agile bit of code. It's mutated several times since it was initially discovered last year, and its newest iteration will let itself onto your system with or without your permission.
The newest iteration, dubbed OSX/Flashback.K, exploits a known weakness in Java SE6. The Trojan is capable of installing itself onto a host system without the need for an admin password. According to the security firm F-Secure, "On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done."
Once infected, the Trojan will attempt to download a payload (code for the main piece of malware) from a remote host and attempt to install it one of two ways, depending on whether or not the user does input his admin password. Once infected the malware hijacks the Safari browser every time it launches and redirects the user to a targeted website.
Don’t like ads? Become a supporter and enjoy The Good Men Project ad free
Oy. Through its Software Update interface, the Cupertino-based company has released a fix on April 5th, but if this tricky bit of software — which has allegedly infected 600,000 Macs, turning them into a botnet of alarming computing power — will mutate again and strike back. You can protect yourself by watching the URLs you click, making sure that you protect your passwords and generally behave as a much more paranoid wackadoo.
Be careful out there.
[Source: Gizmodo, The Huffington Post]