Just as the Mac Flashback malware has begun to decline, security researchers at Kaspersky Lab, Sophos and Intego are talking about a new Trojan horse that targets Apple Macs using the same security flaw in Java that Flashback exploited.
The new malwaredubbed SabPub by Kaspersky and Sabpab by Sophos and Integois what the researchers are calling a basic backdoor Trojan horse, which can steal information from infected systems.
[J]ust like Flashback, the new Trojan doesn’t require any user interaction to infect your Apple Mac, Graham Cluley, senior technology consultant at Sophos, said in an April 13 post on the companys NakedSecurity blog. The Sabpab Trojan horse exploits the same drive-by Java vulnerability used to create the Flashback botnet. The criminals behind the attack can grab screenshots from infected Macs, upload and download files, and execute commands remotely.
The Sabpab Trojan creates files and then sends encrypted logs back to the command-and-control (C&C) server, enabling the hackers to monitor the activity on the system, Cluley wrote.
Costin Raiu, a security expert for Kaspersky, said in an April 15 post on the companys SecureList blog that researchers there had been watching a fake infected system that they had set up to monitor the malware, which he said linked back to a C&C server that had the same IP address that had been used in other malware samples found targeting Macs last year.
On April 15, traffic generated by the C&C server changed, indicating that the hackers took over control of the connection and began analyzing the goat system that Kaspersky had set up, Raiu said.
They listed the contents of the root and home folders and even stole some of the goat documents we put in there, he wrote. We are pretty confident the operation of the bot was done manuallywhich means [there is] a real attacker, who manually checks the infected machines and extracts data from them.
What all this means, Raiu wrote, is that SabPub is an advanced-persistent-threat (APT) attack that is in an active stage.
He wrote that there appear to be at least two variants of the bot, with the earlier version being created in February and the second in March, and the attackers are using Java exploits to infect ¦ Mac OS X machines. Raiu said he expects new variants to be released in the next few days and weeks.
Intego officials on the companys blog April 16 said that for the time being, the Sabpab Trojan isnt posing the same risk as Flashback.
Initially, the command and control server that this malware tried to connect to was offline, but Integos malware researchers have found it to be accessible today, the Intego officials wrote. Intego has seen a few samples, but this malware does not yet seem to be widely distributed, and the risk is low.
The new malware is coming on the heels of the Flashback exploit, which at one point infected more than 600,000 Macs, or more than 1 percent of all Macs in use worldwide. Officials with security software vendor Symantec said last week that the number of infections has since dropped to 270,000.
The Flashback infections shook the theory that Macs and other Apple systems were immune to Trojans and other security exploits, and opened up Apple officials to sharp criticism over their slow response to the problem and lack of communication with the security community.
Oracle, which owns Java, had patched the Java flaw in Windows PCs and other systems weeks earlier, but Apple didnt sent out the patch to its users until April 3, just as security companies like Kaspersky and Dr. Web were saying that the number of infected Macs had grown past 600,000.
Then, Apple was late in rolling out a tool to detect and remove the Flashback malware, launching it days after othersincluding Kaspersky, Sophos, Intego and F-Securehad rolled out their own free offerings.
The new Mac exploit is also the latest indication that as Apple systems increase in popularity and use in businesses, they will see more attacks by hackers. Sophos Cluley said Mac users need to understand this trend.
The Sabpab Trojan is not believed to be anything like as widespread as Flashback, but still underlines the importance of protecting Macs against malware with an up-to-date antivirus program and security updates, he wrote. It’s time for Mac users to wake up and smell the coffee. Mac malware is becoming a genuine issue, and cannot be ignored any longer.
