Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 7 MINUTES AGO.
You are here: Home / Data Security / Another Mac Java Trojan Is Found
Attention, Macs! More Trojan Malware Is Gunning for You
Attention, Macs! More Trojan Malware Is Gunning for You
By Barry Levine / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
APRIL
16
2012

If you still harbor the delusion that Macs are relatively impervious to malware, yet another Mac-targeted attack should disabuse you of that notion. A security firm has located another Trojan that is designed for OS X, and, like another recent Trojan, it uses vulnerabilities in Java.

The newly discovered Trojan, called Backdoor.OSX.SabPub.a, allows the attacker to connect the infected machine to a Web site that can commandeer the Mac's operations, enabling remote execution of commands.

Under Development?

Kaspersky Lab's Costin Raiu, who reported the new Trojan on Saturday, noted on the company's SecureList blog that its "Java exploits appear to be pretty standard," but added that they have "been obfuscated using ZelixKlassMater" in order to avoid detection from anti-malware products.

Raiu said that it is currently unclear how many machines have been infected by this Trojan, but he noted that the backdoor functionality and other factors indicate that "it is most likely used in targeted attacks." He noted several reports that suggest the attack was "launched through e-mails containing a URL pointing to two Web sites hosting the exploit, located in U.S. and Germany."

Raiu also said that this Trojan's backdoor "has been compiled with debug Relevant Products/Services," which makes analysis easy and could indicate it is still under development.

Raiu has recommended 10 tips for boosting Mac security. These include creating a non-administrator account for everyday activities, using a sandboxed-Web browser such as Chrome, uninstalling the standalone Flash Player, uninstalling Java or at least disabling it in browsers, and using Office 2011 instead of 2008.

Flashback Malware Removal Tool

He also recommends using Mac's built-in Keychain password manager, enabling full disk encryption or FileVault, upgrading to Adobe Reader 10 or later, and installing a good security solution. For the latter, as might be expected, Raiu recommends Kaspersky Anti-Virus for Mac.

On a related front, Apple on Friday released the Flashback malware removal tool, in addition to the Java update it issued last week.

Earlier this month, Russian security firm Dr. Web said that more than 500,000 Macs had been infected by a Flashback Trojan, meaning that about 1 percent of the total installed base of Apple computers had been hit.

Some observers think the Flashback Trojan was created by the developers of last year's MacDefender attack. The Flashback Trojan is a drive-by download, which uses a Java vulnerability in Java-enabled browsers to install itself without user intervention.

The Flashback Trojan and MacDefender could represent a turning point in Mac's reputation for security. While there had previously been demonstrations of Mac-targeted proof-of-concept viruses, as well as Office macro viruses and several other minor threats, Macs were generally ignored as a target in favor of Windows, a much bigger target.

Charles King, an analyst with Pund-IT, noted that Microsoft has an "ongoing relationship" with Java owner Oracle, and so can pinpoint a Java-related problem and supply a fix relatively quickly.

But Apple, King said, "apparently doesn't have that kind of relationship with Oracle," and Apple's response "took longer" than was needed. In the future, with the prospects of more Mac-targeted attacks looming, King said the computer maker needs to respond "more transparently" and more quickly if it doesn't want to lose customers, particularly in enterprises.

Tell Us What You Think
Comment:

Name:

LP Bowden:
Posted: 2012-04-24 @ 6:33am PT
I find the 10 tips beyond my comprehension and ability to execute!
Need much simpler advice.

Like Us on FacebookFollow Us on Twitter
MORE IN DATA SECURITY

NETWORK SECURITY SPOTLIGHT
After years of being told by security experts that we should set up two-factor account authentication, new digital security guidelines from the U.S. government will no longer be recommending the practice.
CRM DAILY
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2016 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.