Spyware, viruses, & security forum: Trojan infects more than half a million Macs

From the Kaspersky Lab Weblog:

Earlier this week, Dr.Web reported the discovery of a Mac OS X botnet Flashback (Flashfake). According to their information, the estimated size of this botnet is more than 500, 000 infected Mac machines.

We followed up with an analysis of the latest variant of this bot, Trojan-Downloader.OSX.Flashfake.ab.

It is being distributed via infected websites as a Java applet that pretends to be an update for the Adobe Flash Player. The Java applet then executes the first stage downloader that subsequently downloads and installs the main component of the Trojan. The main component is a Trojan-Downloader that continuously connects to one of its command-and-control (C&C) servers and waits for new components to download and execute.

The bot locates its C&C servers by domain names, and these names are generated using two algorithms. The first algorithm depends on the current date, and the second algorithm uses several variables that are stored in the Trojan's body and encrypted with the computer's hardware UUID using RC4 cipher.

We reverse engineered the first domain generation algorithm and used the current date, 06.04.2012, to generate and register a domain name, "krymbrjasnof.com". After domain registration, we were able to log requests from the bots. Since every request from the bot contains its unique hardware UUID, we were able to calculate the number of active bots. Our logs indicate that a total of 600 000+ unique bots connected to our server in less than 24 hours. They used a total of 620 000+ external IP addresses. More than 50% of the bots connected from the United States.

Continued : https://www.securelist.com/en/blog/208193441/Flashfake_Mac_OS_X_botnet_confirmed

using the step by step method with terminal. But I got some good scares that convinced me to avoid this until I know exactly what I am doing, what those cryptic unix commands mean, and the exact nature of the files I am deleting (like "dylib" and all that). I'd rather get a fix-it from Apple that will do it all automatically and without breaking the operating system. I have OSX 10.5.8 (Leopard) by the way.

When following the procedure I evidently found things that it said I need to delete. I didn't get the total "does not exist" clean bill of health.

I used the finder to do the prescribed file deletions, since I don't know how to delete files in unix. I used a special preference pane that enables me to view hidden files.

After following some of the procedure, I came to the part that says something about making sure only one file appears, otherwise "contact customer care". At that point I couldn't go any further, because I saw three files, not one. And I don't know how to get to customer care on the F-secure website.

At that point I noticed that my computer couldn't launch any programs. Everything I tried to launch would "quit unexpectedly", even TextEdit. Because of this I undeleted the files the procedure told me to delete, and rebooted.

After reboot, my browser seemed to take forever in "finding local host" for on-disk webfiles. I reset the browser, and my browser was bogged down for minutes after that. Activity Monitor seemed to detect heavy network activity during that time. I wonder if this is something that the Flashback trojan horse was doing. Or does resetting the browser always cause heavy network communications.

If I find more I will update.

Apple has released another fix for Java that also is designed to remove several of the variants of the Flashback Trojan that have been plaguing Mac users for months now. The update, released on Thursday, is the latest in a series of attempts by the company to address the Flashback situation.

The most recent update from Apple is in essence a removal tool that rides along with a Java update, and the company said that the fix also changes the way that OS X handles Java applets.

"This Java security update removes the most common variants of the Flashback malware. This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets," Apple said in its advisory.

The Flashback malware has been exploiting a pair of vulnerabilities in Java for several months now, and in that time hundreds of thousands of Mac users have been infected by the malware. At its height the Flashback botnet comprised more than 600,000 machines and researchers have said that there ae a huge number of Mac users out there who are running older, vulnerable versions of Java, making them potential targets for Flashback.

Apple has come under sharp criticism from security researchers and others, who have questioned the company's seemingly slow response to the Flashback outbreak and lack of communication on the issue until the past week. The company typically doesn't comment on security vulnerabilities in its products, and it's not until things reach a head, as they have with Flashback, that Apple will issue a statement or advisory.

Apple is recommending that all Mac users install the new Java update as soon as possible.

http://threatpost.com/en_us/blogs/apple-releases-fix-flashback-malware-041312

Also See:
Apple Releases Java Update with Flashback Removal Tool
Apple updates Java for a third time, this time with Flashback malware removal