Members
Stats
  • Total Posts: 43373
  • Total Topics: 16477
  • Online today: 2103
  • Online ever: 51419
  • (01. January 2010., 10:27:49)
Users Online
Users: 5
Guests: 1709
Total: 1714









Author Topic: "Flashback.C" Trojan atack on "XProtect" Mac's Anti-Virus  (Read 4442 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7529
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Malware coders have created a Mac-specific Trojan that is designed to attack anti-malware defences built into Apple's Mac OS X operating system.

The Flashback.C trojan disables the automatic update component of XProtect, OS X's anti-malware application, net security firm F-Secure reports: http://www.f-secure.com/weblog/archives/00002256.html
By wiping out files, the malware prevents future updates, making it more likely that the devilish code will be able to stick around for longer.

The approach mimics a tactic long seen in the world of Windows malware, where attempts to disable security software have been commonplace for years as well as illustrating the growing sophistication of crooks targeting Macs with malware.

"Attempting to disable system defences is a very common tactic for malware — and built-in defences are naturally going to be the first target on any computing platform," F-Secure notes.

The Flashback.C Trojan poses as a Flash Player installer: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_c.shtml
In reality, the malware sets up a backdoor connection to a remote host. Although currently inactive, the remote host linked to the malware might be used to push any manner of crud onto infected machines.

Previous versions of the Flashback Trojan shunned virtual machines, a technique designed specifically to frustrate anti-virus analysis.

(ElReg)


Download FREE Sophos Anti-Virus for your Mac: http://scforum.info/index.php/topic,5808.0.html



Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Kursevi kodiranja za ucenike u Sarajevu

Terms of Use | Privacy Policy | Advertising
TinyPortal 2.3.1 © 2005-2023