Author Topic: ***600,000 Macs Infected***  (Read 7058 times)

0 Members and 1 Guest are viewing this topic.

Offline internetworld7

  • Jr. Member
  • **
  • Posts: 66
  • avast! Antivirus + Mac OS X = Solid Security
    • Coffee Tips, Articles And Recipes
***600,000 Macs Infected***
« on: April 05, 2012, 07:37:21 AM »
Please tell me you guys are on this: http://tinyurl.com/crvwnja  :-[

Wow, I'm seriously shocked to see that so many Macs were infected at one time. I hope avast has been updated to detect this...
"Jesus answered, Verily, verily, I say unto thee, Except a man be born of water and of the Spirit, he cannot enter into the kingdom of God." - John 3:5

Offline Gargamel360

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2347
  • Memento Mori
Re: ******
« Reply #1 on: April 05, 2012, 09:08:20 AM »
Please tell me you guys are on this: http://tinyurl.com/crvwnja  :-[  Wow, I'm seriously shocked to see that so many Macs were infected at one time. I hope avast has been updated to detect this...
Hey just a OT heads up, but try not to use shortened urls on this forum, it is generally frowned upon.

But yeah, the Flashback looks nasty, as botnets usually are.  I'm sure Avast! will add it ASAP....but it was probably more a result (as usual) of people not updating the 3rd party software (java), especially on Macs where people get to feeling immune from the general safety compared to Win.

Here also is a manual method to determine if you are infected>>http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml
Signature?  But I gots no pen....

Offline .: Mac :.

  • Avast √úberevangelist
  • Ultra Poster
  • *****
  • Posts: 5049
Re: ******
« Reply #2 on: April 05, 2012, 01:52:25 PM »
Please tell me you guys are on this: http://tinyurl.com/crvwnja  :-[  Wow, I'm seriously shocked to see that so many Macs were infected at one time. I hope avast has been updated to detect this...
Hey just a OT heads up, but try not to use shortened urls on this forum, it is generally frowned upon.

But yeah, the Flashback looks nasty, as botnets usually are.  I'm sure Avast! will add it ASAP....but it was probably more a result (as usual) of people not updating the 3rd party software (java), especially on Macs where people get to feeling immune from the general safety compared to Win.

Here also is a manual method to determine if you are infected>>http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

The problem is that in Mac OS X you CAN NOT update Java on your own.  :( Apple compiles a java update whenever they feel like it and they are always 2-3 updates behind the official Oracle release. In this case, Oracle had fixed the flaw several weeks ago but apple just released the Java update this week! :'(
"People who are really serious about software should make their own hardware." - Alan Kay

Offline Gargamel360

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2347
  • Memento Mori
Re: ******
« Reply #3 on: April 05, 2012, 05:17:22 PM »
The problem is that in Mac OS X you CAN NOT update Java on your own.  :( Apple compiles a java update whenever they feel like it and they are always 2-3 updates behind the official Oracle release. In this case, Oracle had fixed the flaw several weeks ago but apple just released the Java update this week! :'(
Oh, thats real cute.  ::)   They need to come down off their high horse a little.   Not all the way off it, because they make good stuff and they should be proud,  but if they keep that up, hubris is gonna bite them worse than this again sometime own the road.
Signature?  But I gots no pen....

Offline .: Mac :.

  • Avast √úberevangelist
  • Ultra Poster
  • *****
  • Posts: 5049
Re: ***600,000 Macs Infected***
« Reply #4 on: April 06, 2012, 03:08:21 AM »
Java 6 is hopefully the last release that will be reliant on Apple. Oracle is working on Java 7 for OS X and should finally release directly instead of relying on apple
"People who are really serious about software should make their own hardware." - Alan Kay

Offline macmomma08

  • Full Member
  • ***
  • Posts: 132
  • I know nothing except that I know nothing.
Re: ***600,000 Macs Infected***
« Reply #5 on: April 06, 2012, 03:20:25 AM »
Does Macscan and Avast find this? I have them both and they don't seem to see any problems.

« Last Edit: April 07, 2012, 03:10:32 AM by macmomma08 »

Offline internetworld7

  • Jr. Member
  • **
  • Posts: 66
  • avast! Antivirus + Mac OS X = Solid Security
    • Coffee Tips, Articles And Recipes
Re: ***600,000 Macs Infected***
« Reply #6 on: April 06, 2012, 05:41:42 AM »
Wow, I was hoping by now to get a response from avast! that they have in fact released a definition for this malware. Perhaps I should post this in the Windows section.
"Jesus answered, Verily, verily, I say unto thee, Except a man be born of water and of the Spirit, he cannot enter into the kingdom of God." - John 3:5

Offline mity

  • Avast team
  • Full Member
  • *
  • Posts: 149
Re: ***600,000 Macs Infected***
« Reply #7 on: April 06, 2012, 09:10:07 AM »
Well, more appropriate forum for this kind of question is probably http://forum.avast.com/index.php?board=4.0 as we share virus definitions with Windows product. I believe we do detect the flashback trojan.

Regards,
Mity

Offline True Indian

  • Malware Hunter
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 712
  • A Good Old Indian!
Re: ***600,000 Macs Infected***
« Reply #8 on: April 06, 2012, 01:24:30 PM »
sadly we arent  :'(

https://www.virustotal.com/file/2206675e19df3ec05ac3ddbe7293686975d83bfc36ebce7d99b77e259b5ee883/analysis/


how i wish i could get a sample of this to send to avast....i found VT result from google

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67276
Re: ***600,000 Macs Infected***
« Reply #9 on: April 06, 2012, 02:09:21 PM »
I believe we do detect the flashback trojan.
Bad news... We should be there in the first wave. Unfortunately, seems we missed it. Sadly.
The best things in life are free.

Offline russwilde

  • Newbie
  • *
  • Posts: 2
Re: ***600,000 Macs Infected***
« Reply #10 on: April 06, 2012, 03:18:25 PM »
Looking at http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

This bit interested me:
Quote
On execution, the malware checks if the following path exists in the system:

/Library/Little Snitch
/Developer/Applications/Xcode.app/Contents/MacOS/Xcode
/Applications/VirusBarrier X6.app
/Applications/iAntiVirus/iAntiVirus.app
/Applications/avast!.app
/Applications/ClamXav.app
/Applications/HTTPScoop.app
/Applications/Packet Peeper.app
If any of these are found, the malware will skip the rest of its routine and proceed to delete itself.

So, if I have read that correctly; the very act of having Avast! installed (or Xcode or another of the above applications) prevents the virus from infecting your machine, regardless of whether Avast! can actually detect or protect against it.
Seems like a pretty simple solution - unless you've already been infected of course.

Offline True Indian

  • Malware Hunter
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 712
  • A Good Old Indian!
Re: ***600,000 Macs Infected***
« Reply #11 on: April 06, 2012, 05:05:19 PM »
I believe we do detect the flashback trojan.
Bad news... We should be there in the first wave. Unfortunately, seems we missed it. Sadly.

Tech almost all the sites where the malware was being hosted have been shut down...i am struggling to find a sample to send it to avast. :'(

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67276
Re: ***600,000 Macs Infected***
« Reply #12 on: April 06, 2012, 05:17:57 PM »
Tech almost all the sites where the malware was being hosted have been shut down...i am struggling to find a sample to send it to avast. :'(
They could receive from virustotal also...

russwilde, thanks for the info. Are they saying that the malware creators just give up if avast is installed? Why?
The best things in life are free.

Offline bilbo--baggins

  • Jr. Member
  • **
  • Posts: 30
Re: ***600,000 Macs Infected***
« Reply #13 on: April 06, 2012, 11:21:37 PM »
So is it still not included in Avast?  I'm sure I read that VirusBarrier included it in early March.

Avast for Mac beta seems really stable now.  I uninstalled it last Autumn because it was causing problems and development seemed to be really slow, but I tried it again recently and it seems much better.  Am I right in thinking that the more people that install it the more chance of Avast finding new viruses early on?  Are they automatically submitted when they're detected?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67276
Re: ***600,000 Macs Infected***
« Reply #14 on: April 06, 2012, 11:34:12 PM »
Are they automatically submitted when they're detected?
Do you mean by Virus Total? Yes.
The best things in life are free.