Kaspersky: Apple security is like Microsoft's in 2002

Apple customers are more at risk from malware now because of their misconception that their iDevices and Macs are secure and because of Apple's poor attitude to security, according to experts.

David Emm, senior security researcher at Kaspersky Lab confirmed that Apple had cultivated the image of the Mac as intrinsically safer than PCs and now that Macs were under attack from bot armies like the Flashback Trojan, the fruity firm would have to change its attitude.

"I think it will take some time before we see a significant change in attitude from Apple," he said. "It's not simply about code, but about adopting a different security posture and updating and reviewing processes that reflect this."

Because Mac users have long believed that their computers are safe from malware - and Apple fostered this belief in ads like the 2006 one that compared the healthy Mac to the sick PC - they are intrinsically more at risk compared to wary Microsoft users.

"Even when Apple added signature detection to Mac OS, in the form of it's 'XProtect' module, it was done quietly, without any sort of fanfare," says Emm.

"I think Mac customers are more at risk because of the historical mis-perception about Mac security. But I would hope that Flashfake will be a wake-up to anyone using a Mac, that they need to secure themselves from online threats."

Eugene Kaspersky, founder and CEO at the Lab, told Computer Business Review last week and confirmed to Pro Hacking Tricks that Apple was about ten years behind Microsoft in terms of security.

Kaspersky Lab thinks that this is just the start of the attacks that the fruity firm can expect now that Macs have become so much more popular.

"For many years I've been saying that from a security point of view there is no big difference between Mac and Windows," he said.

"Cyber criminals have now recognised that Mac is an interesting area. Now we have more, it's not just Flashback or Flashfake. Welcome to Microsoft's world, Mac. It's full of malware."

Unpatched Java Vulnerability Exploited – Macs Infected With Flashback Malware

A Java vulnerability that hasn't yet been patched by Apple is being exploited by cybercriminals to infect Mac computers with a new variant of the Flashback malware, according to security researchers from antivirus firm F-Secure.

Flashback is a computer Trojan horse for Mac OS that first appeared in September 2011. The first variant was distributed as a fake Flash Player installer, but the malware has been changed significantly since then, both in terms of functionality and distribution methods.

Back in February, several antivirus companies reported that a new Flashback version was being distributed through Java exploits, which meant that the infection process no longer required user interaction.

The Java vulnerabilities targeted by the February exploits dated back to 2009 and 2011, so users with up-to-date Java installations were protected.

However, that's no longer the case with the latest variant of the malware, Flashback.K, which is being distributed by exploiting an unpatched Java vulnerability, security researchers from F-Secure said in a blog post Monday.

Oracle released a fix for the targeted vulnerability, which is identified as CVE-2012-0507, back in February and it was included in an update for the Windows version of Java.

However, since Apple distributes a self-compiled version of Java for Macs, it ports Oracle's patches to it according to its own schedule, which can be months behind the one for Java on Windows.

Security experts have long warned that this delay in delivering Java patches on Mac OS could be used by malware writers to their advantage, and the new Flashback.K malware confirms that they were right.

After being dropped and executed on the system via the CVE-2012-0507 exploit, the new Trojan horse prompts a dialog window that asks the user for their administrative password.

Regardless of whether the user inputs the password or not, the malware still infects the system, F-Secure said in its description of the malware. The Trojan's purpose is to inject itself into the Safari process and modify the contents of certain Web pages.

There are rumors that a new exploit for a different unpatched Java vulnerability is currently being sold on the underground market and could be used to target Mac users in a similar way in the future, the F-Secure researchers said.

"If you haven't already disabled your Java client, please do so before this thing really become an outbreak," they said. The antivirus company provides instructions on how to do this.

Apple stopped including Java by default in Mac OS X starting with version 10.7 (Lion). However, if Lion users encounter a Web page that requires Java, they are prompted to download and install the runtime and might later forget that they have it on their computers.

Mac Malware Is Gradually Becoming A Serious Threat

Apple -- and many Mac users -- argue that Mac OS X has a special recipe for security that makes it less likely to be infected with malware. Many security researchers counter that the Mac's seeming immunity stems not from its security, but from its lack of market share.

The debate may finally be settled.

The emergence of a serious malware construction kit for the Mac OS X seems to mimic a 2008 prediction by a security researcher. The prediction comes from a paper written in IEEE Security & Privacy (in .pdf), which used game theory to predict that Macs would become a focus for attackers as soon as Apple hit 16 percent market share.

Last week, security researchers pointed to a construction kit for creating Trojans for the Mac OS X as a major issue for Mac users. Currently, three countries -- Switzerland, Luxembourg and the United States -- have Mac market share around that level.

"The kit is being sold under the name Weyland-Yutani Bot and it is the first of its kind to hit the Mac OS platform," Peter Kruse, partner and security specialist at security firm CSIS, writes in a blog post. "CSIS finds this crimekit to be quite disturbing news since Mac OS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years."

Weyland-Yutani Bot, named for the corporation in the 1979 movie Alien, is currently being sold by its developers. While it is not the first attack on the Mac OS X, crimeware has enabled criminals in the past to scale up attacks quickly.

"What is happening is that people are testing the waters," says Adam O'Donnell, chief architect of the cloud technology group at SourceFire and the author of the 2008 paper. "It just becomes economically viable to do it, so you start seeing these attacks becoming more common."

The 2008 paper used game theory to calculate when attackers would start seeing a payoff in focusing on the Mac OS X over Windows. It simplified the problem by assuming that all PC users ran antivirus software and that no Mac users did. The assumptions helped reduce the problem down to two factors: the effectiveness of the defenses and the marketshare of the dominant platform.

With detection rates for antivirus in the 80 percent range, the Mac OS X becomes an attractive target around 16 percent marketshare. If PC defenses are better than 80 percent, then the Mac market share at which attackers become interested drops. For example, if antivirus programs detect attack 90 percent of the time, then attackers will focus on the Mac OS X at approximately 6 percent marketshare, says O'Donnell.

"It is much more of an argument that at the low rates of penetration of the Mac in the market is why there is no malware," he says. "You get a few points up, and like we are seeing now, you will start seeing malware."

Will the same model work to predict when significant malware will appear on smartphone handsets? Not necessarily. One of the assumptions is that the value of compromising a PC and Mac are identical. That assumption is less likely to hold up between a PC and a handset.

"The difference between a PC and a handset is that there is going to be different values in attacking each," O'Donnell says. "That difference will be a big factor in when people move to attacking a new platform."

Bot attacks Linux and Mac but can't lock down its booty

From the department of cosmic justice comes this gem, spotted by researchers from Symantec: a trojan that targets Windows, Mac, and Linux computers contains gaping security vulnerabilities that allow rival criminal gangs to commandeer the infected machines.

Known as Trojan.Jnanabot, or alternately as OSX/Koobface.A or trojan.osx.boonana.a, the bot made waves in October when researchers discovered its Java-based makeup allowed it to attack Mac and Linux machines, not just Windows PCs as is the case with most malware. Once installed, the trojan components are stored in an invisible folder and use strong encryption to keep communications private.

The bot can force its host to take instructions through internet relay chat, perform DDoS attacks, and post fraudulent messages to the victim's Facebook account, among other things.

Now, Symantec researchers have uncovered weaknesses in the bot's peer-to-peer functionality that allow rival criminals to remotely steal or plant files on the victim's hard drive. That means the unknown gang that took the trouble to spread the infection in the first place risks having their botnet stolen from under their noses.

“Even though it's encrypted and even though it was written in Java to make it cross-platform, it was still vulnerable to basically a directory transversal exploit,” Dean Turner, director of Symantec's Global Intelligence Network, said. “From a technical perspective, it goes to show that even if you have all those things where you're building in a secure platform, if you're not building application security into your malware, other bad guys will probably take advantage of it.”

Jnanabot's P2P feature is designed to make botnets harder to take down by providing multiple channels of communication. After sending an infected machine a single GET request, a website can discover all the information needed to upload any file to any location on the host's file system. Attackers can then install a simple backdoor on a user's machine by, for instance, writing a malicious program to a computer's startup directory.

Attackers can use the same vulnerability to steal files on infected machines.

Turner said the number of Jnanabot infections so far is “measured in the thousands,” rather than the hundreds of thousands for some of the better-known trojans. Still, infection statistics gathered by Symantec in December are surprising. They show that about 16 per cent of infections hit Macs. They didn't show any infections on Linux machines. Turner said that Jnanabot attacks on the open source platform weren't able to survive a reboot.

Source: Symantec

The bot was discovered spreading over Facebook posts that planted the following message on infected users' Facebook pages: “As you are on my friends list I thought I would let you know I have decided to end my life.” An included link leads recipients to a cross-platform JAR, or Java Archive file that can run on Windows, Mac, or Linux. Once the recipient is infected, his Facebook page carries the same dire warning.

It's not the first time that malware developers have built gaping vulnerabilities into their wares. In September, researcher Billy Rios disclosed a weakness in the Zeus crimeware kit that makes it easy to take over huge networks of infected PCs.

Symantec has more about the trojan here, here, and here.

Notorious Koobface worm ported to Mac OS X

Security researchers say they've been monitoring a Mac OS X version of the notorious Koobface worm, which uses advanced rootkit techniques to stealthily hijack infected machines.

Although the Mac version isn't yet ready for prime time, it is nonetheless a sophisticated piece of software that developers put a fair amount of effort into implementing. It was designed to use Oracle's Java framework to infect not just Macs, but Linux and Windows machines as well, according to Mac antivirus provider Intego. Once installed, the malware gives attackers complete control over the computer.

“While this is an especially malicious piece of malware, the current Mac OS X implementation is flawed, and the threat is therefore low,” Intego researchers wrote in a blog post published Wednesday. “However, Mac users should be aware that this threat exists, and that it is likely to be operative in the future, so this Koobface Trojan horse may become an issue for Macs.”

For that to happen, attackers will probably have to figure out how to bypass a window OS X prominently displays warning that a self-signed Java applet is requesting access to the computer. Assuming they do, or are able to trick users into clicking “Allow” anyway, they will also need to resolve issues preventing the downloaded files from installing.

Those are high hurdles. But Koobface's considerable success on Windows shows just how gullible many marks are when it comes to scams promising free videos.

Once installed, the downloaded files are stored in an invisible folder and give the infected Mac the ability to run a local webserver or IRC server and to act as an DNS changer.

Intego is calling the malware OSX/Koobface.A, while SecureMac, which also blogged about the attack, calls it trojan.osx.boonana.a.