Apple releases Java update to protect Macs against Flashback trojan:
As
Apple grows, so will the number of viruses that can affect it systems. Today, it issued a Java update to keep one of these viruses, the Flashback trojan, at bay.
Flashback is a type of malware that is transferred to your computer by masquerading as a safe browser plug-in. When a person goes to an infected website housing the malware, he will be prompted to download a plugin, such as flash, in order to view content. Giving permission allows the malware to execute and download to your computer. Evolved versions of the virus use a hole in Apple’s version of Java to download to your Mac immediately after you open the webpage.
Russian antivirus vendor
Doctor Web estimates up to 550,000 Macs have been infected thus far, over half of which are located in the United States.
“There has been a significant increase in Mac malware in the last several quarters, so what we’ve seen with the Flashback Trojan isn’t particularly surprising,” said Dave Marcus, director of advanced research and threat intelligence at McAfee Labs, in an e-mail to VentureBeat. “As the popularity of Macs increase, so will attacks on the Mac platform. Users should always take the proper precautions to protect themselves by ensuring that their security software in-up-to-date and all Apple patches are up-to-date.”
Apple latest update to Java patches that hole, and closes the malware’s ability to easily get in. But like most malware, the writers will be able to find a new vulnerability and exploit it.
Cnet makes the point that Apple does not use Java’s public versions, but rather has its own version. This hole had been patched by Java in February, where Apple’s version took until now to fix.
F-Secure explains how to check if you have the malware installed on your Mac. Do a search of your computer using Spotlight for “Terminal” and open the program. In it type the following:
- defaults read /Applications/Safari.app/Contents/Info LSEnvironment
- defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
If you get anything other than “does not exist” back, F-Secure can show you how to remove the virus and do other tests.
Doctor Web has identified some websites that have been infected with the malware, but warn that there are many more out there. These websites include:
- godofwar3.rr.nu
- ironmanvideo.rr.nu
- killaoftime.rr.nu
- gangstasparadise.rr.nu
- mystreamvideo.rr.nu
- bestustreamtv.rr.nu
- ustreambesttv.rr.nu
- ustreamtvonline.rr.nu
- ustream-tv.rr.nu
- ustream.rr.nu
