Feeds

Mac malware Crisis as Apple lets slip its Mountain Lion

Includes bonus Windows Trojan, stealth ninja style

Securing Web Applications Made Simple and Scalable

Miscreants have developed a sophisticated multi-platform attack dog designed to maul Windows and Mac OS X computers.

The malware comes bundled in an Java Archive file which pretends to be Adobe Flash Player, named AdobeFlashPlayer.jar. Inside the malicious archive is a .class file named WebEnhancer, and two files named win and mac. The WebEnhancer applet decides if a user opening the file is running either Microsoft Windows or Apple Mac OS X before pushing the corresponding software nastie.

If run on an OS X system the malware drops multiple components, reconfigures system settings and installs a backdoor and rootkit combination onto infected machines. The Mac OS X component of the malware – called Crisis or Morcut – arrives on the eve of Apple's release of Mac OS X Mountain Lion, but this is probably a coincidence. The new operating system build goes on sale today.

When run on a Windows systems, a version of the Swizzor malware is installed instead.

The Mac malware uses anti-analysis and stealth techniques that are uncommon among OS X malware but have been a mainstay of the windows malware landscape for several years, as a write-up on the threat by Mac security specialists Intego explains. The threat can install itself on Mac systems without requiring a password.

The threat has not appeared in the wild, but its complexity and use of clever infection techniques point to possible infections in future.

Samples of the malware were submitted to the VirusTotal website but it's unclear who created it or what their motives might be. virusTotal routinely shares samples of malware submitted to the site to anti-virus firms.

An overview of the overall threat, including how it works on Windows machines as well as Macs, can be found in a blog post by Sophos here. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.