To Thread - Forum Home

The Mudcat Café TM
https://mudcat.org/thread.cfm?threadid=144242
24 messages

Tech: Mac Flashback virus (maybe)

05 Apr 12 - 07:27 PM (#3334253)
Subject: Tech: Mac Flashback virus (maybe)
From: Desert Dancer

Huffington Post says that Ars Technica says that the Mac Flashback trojan virus is about again and has affected 600,000 laptops, and that Apple has issued a Java update as of April 3 that we all should load ASAP.

NPR says, "maybe, maybe not".

Huffington has an F-Secure link that tells you how to check if you're infected, NPR sends you to Gizmodo.

FWIW.

~ Becky in Tucson
(updating to hedge my bets, although I'm in Tucson on the slow DSL and usually I wait until I'm in Long Beach with the faster cable connection...)


06 Apr 12 - 05:59 AM (#3334412)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Jack Campin

I checked with F-Secure and mine was clear - from what the tests were doing, it seems have only targeted people who (a) use Safari and (b) are stupid enough to download anything suggested to them by strangers.


06 Apr 12 - 06:03 AM (#3334414)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: GUEST

I have an Imac and I get a constant reminder about Flash updates which so far I have ignored Maybe I am lucky or careful


06 Apr 12 - 06:06 AM (#3334416)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Brian May

I've been running Sophos for Mac for the last 6 months - the overhead is minimal - OK undetectable.

I'd rather be safe either way. Both mine and my wife's MacBook Pros are clean and that's always good news.


06 Apr 12 - 08:19 AM (#3334447)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Andrez

I reckon an ounce of prevention is worth a pound of cure.

Checkout Apple Software update on your machine and you should see a Java update file in the window as I did on my machine a few minutes ago. If its there download it and add it to whatever other software you happen to use.

Cheers,

Andrez


06 Apr 12 - 11:58 AM (#3334535)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Desert Dancer

Yeah, I've got Sophos through the university, and am pretty careful about my clicking, so I just did the Mac update and didn't bother with the scan for the virus.

~ Becky in Tucson


06 Apr 12 - 12:41 PM (#3334577)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

I've updated my software (75mb's worth), have not authorised any unbidden downloads (in fact haven't even received any, tho I do use Safari) and I keep iAntivirus and Intego protection, so I expect I'm OK (MacBook 10.6.8) - but:

I looked at the F-secure page and can't see how to actually run the check to see whether you're infected or not. It seemed to be all about removing the virus, not testing for it. What do I have to do? Anybody got a better link? Cheers!


06 Apr 12 - 12:51 PM (#3334588)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

Guest, I wouldn't ignore Flash updates! Those are generally there to patch security holes and other vulnerabilities. One so often needs Flash for something or other on the net that it's as well to have the latest version. Java gets targeted by hackers precisely because it's in such widespread use, but its own updates are not the bad guy.

I did also THINK I saw (I may have misread it) that typing in your admin password isn't the only way of contracting this malware, which suggests that it doesn't necessarily require your permission to invade you. It was something about giving the password just meaning that it would download "in a different way" or something. Can't remember - but it's on that F-Secure page if anybody wants to dig it out.


06 Apr 12 - 12:52 PM (#3334589)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Desert Dancer

Bonnie Shaljean: The messages you get in step 3 and 9 of the instructions will tell you if you're o.k. or not. If it ends with "does not exist", you're good.

~ Becky in Tucson


06 Apr 12 - 01:01 PM (#3334597)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

Cheers, Becky! Got the magic words at the end, the three sweetest in the language after "I love you" (though "extra chocolate topping" is pretty hard to beat too...)


06 Apr 12 - 01:07 PM (#3334601)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Jack Campin

Guest, I wouldn't ignore Flash updates! Those are generally there to patch security holes and other vulnerabilities.

On the other hand Flash updates that aren't from Adobe are usually intended to exploit or introduce security holes.

You always want to be extremely careful about where your updates are coming from. Never just click on a link or respond to a prompt about it - go through routes that you can guarantee will take you to a legitimate site.


06 Apr 12 - 01:24 PM (#3334608)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

Good point, Jack! The notices that pop up from time to time on my Windows PC are from "Jucheck" or something like that. (I've been accepting those for ages with no apparent harm, and I have Avast and two firewalls, but methinks I'll just go do a wee scan...) Point taken - I'll download from the official websites from now on.


06 Apr 12 - 08:27 PM (#3334762)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Desert Dancer

The New York Times is taking it seriously: Widespread Virus Proves Macs Are No Longer Safe From Hackers. They say

"The malicious program, known as a Trojan horse, is infesting users in the most surreptitious way possible: users need not manually click on any malicious links or manually download any malware to get infected. The program simply downloads itself. Once downloaded, the Trojans' creators gain a back door that gives them unauthorized access to the victim's computer."
...
"The malware infects computers in one of two ways. In some cases, users receive a pop-up prompt purporting to be from Adobe Flash asking them to install an update and type in their password — hence the Trojan's name, "Fakeflash" or "Flashback." But in most cases, attackers appear to have exploited a loophole in Java software that automatically downloads the malware onto victims' machines without any prompting."


~ Becky in Tucson


06 Apr 12 - 09:10 PM (#3334780)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: JohnInKansas

I doubt that it adds much, but the news from PC Advisor may be of interest.

This report says the US & Canada were hardest hit, but with the UK in third place with about 60,000 machines infected.

I don't see anything indicating that the Flashback malware has anything to do with the Flash media program, although since Adobe bought Flash from Macromedia Adobe's security reputation has tanked (and not in fresh waters). Flashback appears to be mostly a "drive-by" infection, although I haven't really dug into it. It is carried by code written in Java, but the vulnerability isn't in the Java, it's in the machine, or vulnerable programs on it, that permits the malware to run - regardless of what language it speaks in.

John


07 Apr 12 - 06:38 AM (#3334865)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

In ADDITION to the Apple software updates (this latest Java-protection one is hefty, weighing in as I said at about 75 meg) I also have two free antivirus programmes, both of which I like very much. They are totally non-intrusive and update fast with no fuss. The first one below does this automatically, and the second needs to be clicked, but it's instant. They are:

iAntiVirus from PC Tools
http://www.iantivirus.com

VirusBarrier Express from Intego

This is downloadble through the "App Store" pre-installed on your Mac, so open it and just type "VirusBarrier Express" into the searchbox and it will lead you there. There also is a VirusBarrier Plus which you have to pay for (not expensive) but I only have the free one. I saw a negative comment about it in the reviews but please note that this was from a few years ago and referred to a previous version. Certainly I have been very happy with mine. You do have to remember to click its little update bar, but I keep a shortcut icon on my desktop and this is literally a matter of seconds.

Both of these apps are free and no trouble at all, so I strongly recommend them. The VB also has a little portal in which you can drag an individual item to scan if you don't like the look of something.

Welcome to the world of popular success, Mac. Now YOU TOO are important enough to get picked on. *sigh*


07 Apr 12 - 06:39 AM (#3334867)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonnie Shaljean

CLONES: Can you please take the "maybe" out of the thread title?! [another sigh]


07 Apr 12 - 04:57 PM (#3335092)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: JohnInKansas

Apple has just released the Second Malware Patch This Week, with this one intended to contend with the Flashback trojan.

The Flashback malware was originally a fake "Flash" update, but has more recently been found mostly as a fake "Mac update" so some caution might be advisable if you have to go looking for the new patch.

Details at the link should be sufficient for people to identify the right stuff.

John


10 Apr 12 - 04:39 PM (#3336436)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: JohnInKansas

Previous instructions for finding out whether your Mac is infected with Flashback have required complex command line steps, and checking for multiple variants in order to do a complete check, at least for those who don't have an AV that they trust completely installed.

There is now a simple program to check whether your Mac is infected with Flashback.

An Article at PC Advisor tells you a little about the program and where to get it.

Initial reports on Flashback came almost exclusively from a single source. The most recent report is that a second source has confirmed that approximately 2% of all Mac computers are infected, for a total of "more than 600,000" individual machines. One report is at another PCAdvisor article.

John


11 May 12 - 07:22 AM (#3349483)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Andrez

Here is a link to a review of some of the very latest Apple OS updates for the Lion and Snow Leopard versions of these operating systems. They incorporate the latest bug fixes and responses to the Flashback issue. The article stays that the updates address Apples security issues re Adobe Flashplayer by disabling versions of Adobe Flash Player that do not include the latest security updates and providing the option to get the current version from Adobe's Web site.

http://reviews.cnet.com/8301-13727_7-57431241-263/apple-releases-safari-5.1.7-sn

This page should provide links to the stand alone versions of the updaters or you can use Software Update download.

Flashback now seems now to be more a problem for Mac users who are running older versions of flash and not getting the more recent updates. As the old saying goes an ounce of prevention is worth a pound of cure!

Cheers,

Andrez


11 May 12 - 07:34 AM (#3349486)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Andrez

Whoops even though this isnt quite the right thread for this, but while I'm at it: for users of Office for Mac 2011 here is a link to the latest Office updaters well.

If you need to update any bugs in Apples software, it is essential to do so for anything that goes under the name of Microsoft.

The updaters at the link below include Office for Mac Service Pack 1 as well as Office 2011 14.2.2 Update. Apart from the usual security patches and bug fixes, they also make a few small improvements to the crappy Microsoft implementation of the Mac version of Outlook...for anyone that cares :-(

http://www.microsoft.com/mac/downloads

Cheers,

Andrez


11 May 12 - 07:50 AM (#3349492)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Bonzo3legs

The best cure is to install Windows 7!


11 May 12 - 08:52 AM (#3349505)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Andrez

Only when I want to deal with a dogs breakfast of an OS :-)

Cheers,

Andrez


11 May 12 - 08:00 PM (#3349750)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Andrez

As a follow on from the Mac OSX updating info posted above, this post from CNET notes the following:

"Some people may still wish to use older versions of Flash player for compatibility reasons. Even though new versions of the software will contain fixes to vulnerabilities, sometimes bugs may appear that result in broken functionality or poor performance, and having this auto-disable feature will force the use of faulty updates".   

If this happens to you, the good news is that "Apple's browser does not prevent the use of older versions of Flash, and merely disables them when newer versions are available". If this applies to you, the details of how to restore use of an older version of Flash are provided at this link.

http://reviews.cnet.com/8301-13727_7-57432867-263/how-to-re-enable-older-flash-i

Cheers,

Andrez


11 May 12 - 11:41 PM (#3349814)
Subject: RE: Tech: Mac Flashback virus (maybe)
From: Tootler

The best cure is to install Windows 7!

Wrong!!

Linux is the way to go.