Feeds

Apple finally deploys Mac Flashback Trojan terminator

Zombie OS X bot army drops to 270,000 strong

Protecting against web application threats using SSL

Apple has released a tool that removes the infamous Flashback Trojan from infected Macs.

The utility, billed as a Java security update, also disables Java applets by default - but only on machines running OS X Lion, the latest version. The update turns off Java applet execution by default for all browsers, not just Safari.

Users can re-enable this if necessary, perhaps to use an online banking site that mandates Java, but the functionality is disabled again automatically in the absence of applet use within 35 days, as Apple's security bulletin for Lion explains:

This Java security update removes the most common variants of the Flashback malware.

This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application.

If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.

Java for OS X Lion 2012-003 delivers Java SE 6 version 1.6.0_31 and supersedes all previous versions of Java for OS X Lion.

This update is recommended for all Mac users with Java installed

The picture is different for Mac users running Snow Leopard, where disabling Java in your browser won't happen automatically, as explained in a blog post by Paul Ducklin of Sophos here. The update for Snow Leopard does include Flashback Trojan removal, as explained in Apple's bulletin here.

Both the OS X Lion and Snow Leopard updates, released on Thursday, come with a patched version of Java that was made available in a separate set of updates earlier this week.

Apple has made good on its promise earlier this week to release a Flashback removal tool but the move came after several security firms independently released their own Flashback detection and removal tools (a list of free utilities is here).

The Flashback Trojan created a zombie army of remote-controllable 650,000 Apple Macs, or more, by exploiting a Java security vulnerability that Apple only patched last week, six weeks after a patch for Windows machines became available.

The Flashback Trojan has declined over recent days from a peak of around 670,000 machines to around 270,000 bots (Symantec's latest estimate) or lower. Despite the decline the zombie network remains an undead menace. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.