Apple blocks malware-as-PDF threat but new attack emerges
Summary: Even as Apple adds detection to block a Mac OS X malware threat, researchers find new Mac malware posing as a legitimate Flash Player installation package.
Apple has quietly added detection for the recent malware attack that used PDF files as lures to trick Mac OS X users into downloading a malicious Trojan dropper.
The detection was added into the rudimentary XProtect.plist malware blocker built into Mac OS X.
The malware, flagged as a trojan dropper, installs downloader component that downloads a backdoor program onto the system, while camouflaging its activity by opening a PDF file to distract the user.
However, in what has become a classic cat-and-mouse game, researchers have spotted a new Mac malware threat posing as a legitimate Flash Player installation package.
[ Researchers find Mac OS X malware posing as PDF file ]
Intego explains the characteristics of the new threat:
Users visiting certain malicious websites may see a link or an icon to download and install Flash Player. Since Mac OS X Lion does not include Flash Player, some users may be fooled and think this is a real installation link. When they click the link, an installation package downloads, and, if the user is using Safari as their web browser, the Mac OS X Installer will launch. (Safari considers installer packages, with .pkg or .mpkg extensions, to be “safe” files and will launch them after download, if default settings are used.)
If the user proceeds with the installation procedure, the installer for this Trojan horse will deactivate some network security software, Intego said.
After installation, [it] will delete the installation package itself. The malware installs a dyld (dynamic loader) library and auto-launch code, allowing it to inject code into applications the user launches. This code, installed in a file at ~/Library/Preferences/Preferences.dylib, connects to a remote server, and sends information about the infected Mac to this server: this includes the computer’s MAC address, a unique identifier. This will allow the malware to detect if a Mac is infected.
The company said it has spotted this new malware in the wild but notes that it is not widely distributed.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
This is very dangerous
Now I have a question for you. I use Windows 7 on my Mac through Bootcamp. Can I get infected by this or is Windows immune to all this OS X malware? I sure hope Windows is immune to this malware.
RE: Apple blocks malware-as-PDF threat but new attack emerges
RE: Apple blocks malware-as-PDF threat but new attack emerges
Since the file extension is.pkg, which is not a Windows executable, your Windows instance shouldn't even be able to open that file.
Absolutely you can
RE: Apple blocks malware-as-PDF threat but new attack emerges
RE: Apple blocks malware-as-PDF threat but new attack emerges
[i]"When they click the link, an installation package downloads, and, if the user is using Safari as their web browser, the Mac OS X Installer will launch. (Safari considers installer packages, with .pkg or .mpkg extensions, to be ???safe??? files and will launch them after download, if default settings are used.) "[/i]
That sounds [i]real[/i] safe. Like it was built "with security in mind"
RE: Apple blocks malware-as-PDF threat but new attack emerges
Or you could just tell them to uncheck the option to
RE: Apple blocks malware-as-PDF threat but new attack emerges
"If default settings are used"
True but...
"the most novice of users can fix this."
Only if they know about it.
And the most novice of users don't know about it.
Nor do most OS X users.
This default setting is part of the reason why you can't use OS X without AV.
RE: Apple blocks malware-as-PDF threat but new attack emerges
RE: Apple blocks malware-as-PDF threat but new attack emerges
So, should I check the box that says "Open unsafe files after downloading", then?
Applies in Windows, though, too.
"Novice" Windows users can easily change the settings in whichever browser they use (including the default IE) so that it doesn't automatically run any downloaded programs, either.
Yet how much will you bet that Apple fanbois will claim that this behavior in Windows is indicative of a vulnerability...yet will claim that the same behavior in OS X is "superior"?
RE: Apple blocks malware-as-PDF threat but new attack emerges
RE: Apple blocks malware-as-PDF threat but new attack emerges
First, learn proper punctuation. That is one of the longest run-on sentences I've ever seen.
Now, I would say [i]any[/i] auto-run, auto-load, auto-anything running on any platform is a bad idea.
But to answer your question... it obviously does make a difference whether Safari runs the installer or if the user invokes... just by the replies to Intego's blog. Several users state: "I ran the 'Flash Update' without even thinking about it."
[i]If they had to download and run it themselves, it would have caused each one of them to think about it.[/i]
And, as with the .PDF trojan, it was shown that depending on the user's own config, the user may not have necessarily been prompted for the admin credentials.
This malware blocker, what is it?
Does this mean that it is impossible to use OS X without AV?
This is a troll post, right?
You failed to answer the question.
Heh. So, now that Ryan, who works for an AV company