Feeds

Mac malware Crisis as Apple lets slip its Mountain Lion

Includes bonus Windows Trojan, stealth ninja style

The essential guide to IT transformation

Miscreants have developed a sophisticated multi-platform attack dog designed to maul Windows and Mac OS X computers.

The malware comes bundled in an Java Archive file which pretends to be Adobe Flash Player, named AdobeFlashPlayer.jar. Inside the malicious archive is a .class file named WebEnhancer, and two files named win and mac. The WebEnhancer applet decides if a user opening the file is running either Microsoft Windows or Apple Mac OS X before pushing the corresponding software nastie.

If run on an OS X system the malware drops multiple components, reconfigures system settings and installs a backdoor and rootkit combination onto infected machines. The Mac OS X component of the malware – called Crisis or Morcut – arrives on the eve of Apple's release of Mac OS X Mountain Lion, but this is probably a coincidence. The new operating system build goes on sale today.

When run on a Windows systems, a version of the Swizzor malware is installed instead.

The Mac malware uses anti-analysis and stealth techniques that are uncommon among OS X malware but have been a mainstay of the windows malware landscape for several years, as a write-up on the threat by Mac security specialists Intego explains. The threat can install itself on Mac systems without requiring a password.

The threat has not appeared in the wild, but its complexity and use of clever infection techniques point to possible infections in future.

Samples of the malware were submitted to the VirusTotal website but it's unclear who created it or what their motives might be. virusTotal routinely shares samples of malware submitted to the site to anti-virus firms.

An overview of the overall threat, including how it works on Windows machines as well as Macs, can be found in a blog post by Sophos here. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.