This article titled “Apple readies Flashback malware removal tool: but how big is the risk?” was written by Charles Arthur, for guardian.co.uk on Thursday 12th April 2012 12.10 UTC

Apple says it will develop a tool to remove the Flashback malware reckoned to have infected more than 600,000 Macintosh computers worldwide, most recently via a flaw in Oracle’s Java software, following the worst attacks against the platform in the past decade.

But in a brief document posted on Wednesday, the company did not offer any advice on how users could find out whether their machine was infected, nor – aside from updating their software – how they could protect themselves against infection.

(The security company F-Secure has instructions so that Mac users can discover whether they are infected. Mashable also offers links to a pair of scripts that will check Safari – though not other browsers – for infection.)

The first variants of Flashback appeared last September, masquerading as updates to Adobe’s Flash player software. More recent variants exploited other flaws – notably in Java.

Once installed, the malware monitors network traffic to steal passwords and login details for various sites and systems, attempts to install itself as a root program able to access all users’ files, and may also download other software from control servers silently. It could also organise infected machines into a botnet able to attack websites or, potentially, host fake websites and other unwanted content.

The latest version using the Java exploit meant users could be infected without taking any action via their browser if Java was enabled simply by navigating to an infected site.

A number of websites require Java to provide functionality. Although Java is not included in Mac OS X 10.7, aka Lion, which was released last year, anyone who had upgraded their system from an earlier version of the OS would have it, as would anyone who downloaded it to run programs such as Adobe’s Creative Suite.

Crucially, Apple maintains its own version of Java, and had left the flaw unpatched for weeks: Oracle released a fix on 17 February, which was distributed to Windows users.

Brian Krebs, a security expert, comments that Apple’s lackadaisical (and often plain puzzling) response to patching dangerous security holes perpetuates the harmful myth that Mac users don’t need to be concerned about malware attacks.

Krebs says: “If you don’t need Java, remove it from your system, whether you are a Mac or Windows user.”

The extent of the outbreak makes the Flashback infection, which was first detected at the end of March by the Russian security firm Dr Web, by far the largest ever to hit the Mac OSX platform. In relative terms, it is at least equivalent to the Conficker outbreak on Windows, which affected millions of PCs – though only affecting less than 1% of the total installed base.

In the second half of 2011, Apple Macintosh sales passed 5% of the total PC market for the first time in more than a decade; the latest figures from Gartner say that in the US, it achieved 10% of personal computer sales in the first quarter of the year. That may have led malware writers to target the platform with renewed vigour.

Neither Flasback’s authors nor their location has become clear. In May 2011, Russian hackers targeted Mac OS X, which was hit by a wave of infections driven by a Trojan program called MacDefender – often spread via infected images in Google’s image search. But the combination of a software update from Apple, and a raid by Russian police put paid to the short-lived attack.

Although a number of commentators forecast at the time of MacDefender that it was the beginning of a fresh wave of attacks against the Mac OS X platform, it didn’t materalise. At the same time, companies including Microsoft have made renewed efforts to close down botnets and capture those behind aggressive malware.

John Welch, who administers several hundred Macs for the organisation where he works, discovered that a number of the machines were infected by forms of Flashback, although in many cases the installation failed; that in turn locked out users who tried to log onto the machines, because certain files that Flashback told the system to load were not present. (The organisation uses Sophos antivirus on its machines.

“It seems that the programmers behind it simply found a better infection vector, and used it,” Welch told the Guardian. “I’m not *that* impressed with it, I’ve seen too many half-done attempts to infect a machine where the silly thing couldn’t even install correctly, so I’m not sure it’s really all that clever.”

He thinks that the principal threat will continue to be from infected documents rather than the core OS – though, he says: “… not because Mac OS X or UNIX are magically invulnerable. (There’s a lot of magical thinking on this subject.) It’s more because due to some well-intentioned, but poor decisions made by Microsoft decades ago, the path to infect Windows was an eight-lane highway vs the muddy goat trail that was Unix. However, if you move off the OS proper, it gets more common.”

Most high-profile attacks in the past few years have come from infected files which use weaknesses in associated software: Adobe’s PDF and Flash Player have become increasingly common targets on both the Windows and Mac platforms, while Microsoft’s Office suite – of Word, Excel and Powerpoint – are also frequently targeted by hackers seeking to subvert systems.

“If it runs code, it can be compromised and run malware,” Welch notes. “It’s just a matter of how much brainpower and skill someone wants to put behind it. Given the kind of money malware is now generating, there is a lot of both involved.”

But he does think Apple has been too slow to react. “This is a problem for Apple, and one I hope goes away with [Steve] Jobs not running the company. He had some issues with communication. I think Apple needs to speed up its reaction to verified threats, and they need to stop treating everything like it’s [as secret as] the next iPhone. Yes, some things do need a great deal of security, but patching a *Java security hole* is not one of them. I know it’s easy to get into that ‘MUST NEVER SAY ANYTHING UNTIL IT’S DONE’ mentality, but this has burned Apple in the past. They’ve improved somewhat, but have a ways to go.”

With Apple having made both Flash and Java optional installations on existing desktop systems, the “attack surface” for malware authors has lessened. Welch points out: “Java is a useful tool that fixes certain problems better than other tools. It’s no more necessary than any other language or runtime.

“A huge percentage of malware attacks happen via email and websites, yet no one asks ‘should we really be using email and browsing the web?’ [The open source database] MySQL and [web scripting language] PHP are commonly attacked, and successfully; no one questions those tools, even though they are a common infection vector.

If Java is the best, or even an equally good tool for the job, I think one is silly to ignore it because ‘it’s an infection vector’. So is PDF. I don’t see people advocating the end of PDF. Bagging on Java in this case is silly. I do like that Apple doesn’t install it by default, which I think is a good idea. The need for it is not *common* over the entire population of computer users, so making it an optional install is not a bad idea at all.”

Yet even with the latest infection, amounting to 1% of the estimated installed base of Macs, there aren’t so far signs of a deluge of attacks against Macs. Between MacDefender in May of 2011, and Flashback between September and the present day, the amount of Mac-targeting malware remains remarkably low; while Graham Cluley of Sophos points out in “a short history of Mac malware“, the amount targeting the platform has trebled in the past three years – but that still only amounts to a couple of new attacks per year. And one piece of software identified as “malware”, from PremierOpinion, is arguably no such thing, but a user-sanctioned tracking system for web use.

Sophos does offer free antivirus software for Mac users – though it’s not available through the App Store (because Apple limits what can be sold through it; apparently antivirus software isn’t allowed.) Graham Lee, formerly of Sophos, also points out that antivirus apps can’t do real-time scanning, because they aren’t allowed to install kernel extensions – which means that new infections can’t be caught as they happen, but only retrospectively.

The question now is whether the attacks will get worse – or if malware authors have other targets they can more profitably focus on. Whereas even five years ago the options for malware authors were simple – write something to attack Windows machines, or Macs; the potential rewards were over 19 times greater for the former – now there are almost as many smartphones (where Android apps have become an attractive source of revenue for some, using “Trojan diallers” which silently dial expensive numbers or transmit sender-pays text messages) and, increasingly, websites which have credit card details, or phishing sites that can capture login details for PayPal or for webmail accounts – where the latter can then be used to send out fake frantic messages claiming you’ve been mugged, and asking for untraceable wire payments.

In short, Apple may actually have been fortunate enough to survive the riskiest time – when the desktop and laptop computer were the principal form for computing – as malware has moved to a cross-platform format in which phones, websites, databases and simple social engineering have become equally good methods for criminals to get access to personal and financial details. It doesn’t though mean that the danger has passed. But while 600,000 machines infected is certainly a lot, it pales in comparison to the millions of credit cards compromised by the attack on Sony’s PlayStation Network, or the more recent hack of a US payments processor.

In short: have antivirus, but the bigger threats are probably outside your computer.

guardian.co.uk © Guardian News & Media Limited 2010

Published via the Guardian News Feed plugin for WordPress.