New Mac OS X botnet discovered

#1

Post by Deinos » Fri, Oct 03, 2014, 3:06 PM UTC

New Mac OS X botnet discovered
news.drweb.com

Re: New Mac OS X botnet discovered

#2

Post by jason_slack » Fri, Oct 03, 2014, 7:32 PM UTC

I've never even heard of drweb....I dont see any other security companies reporting on this.

Re: New Mac OS X botnet discovered

#3

Post by milesf » Fri, Oct 03, 2014, 7:34 PM UTC

Hmm. I've never heard of drweb.com before, and there's no instructions on how to detect the worm, but they want to sell me anti-virus software.

This might be legit, but I'll wait and see if this appears anywhere else before I trust it as being valid.

Re: New Mac OS X botnet discovered

#4

Post by scottdeto » Fri, Oct 03, 2014, 7:36 PM UTC

Many independent reports of this, but I haven't seen any instruction for detecting or fixing

http://www.tuaw.com/2014/10/03/thousands-of-macs-infected-wi...

Re: New Mac OS X botnet discovered

#5

Post by pjl » Fri, Oct 03, 2014, 7:43 PM UTC

scottdeto wrote: post #4

Many independent reports of this, but I haven't seen any instruction for detecting or fixing http://www.tuaw.com/2014/10/03/thousands-of-macs-infected-wi...

At least for detection (from the article): "During installation it is extracted into /Library/Application Support/JavaW, after which the dropper generates a p-list file so that the backdoor is launched automatically."

Re: New Mac OS X botnet discovered

#6

Post by eyeJam » Fri, Oct 03, 2014, 7:48 PM UTC

Has there ever been a company that covertly creates a virus and releases it into the wild, and then "catches" it and sells an anti-virus remedy?

Re: New Mac OS X botnet discovered

#7

Post by spectres_ » Fri, Oct 03, 2014, 8:21 PM UTC

To see if you haven't got it:

In terminal run:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

You should get this error:

The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist

Then run:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

You should get this error:

The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

If you do you are clean of this variant!

If this doesn't happen go to http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb... to fix it

Re: New Mac OS X botnet discovered

#8

Post by bane » Fri, Oct 03, 2014, 9:36 PM UTC

It's hard to believe, the claim is that is uses Reddit's search functionality to find connection addresses. I've never been able to find anything using Reddit's search.

Re: New Mac OS X botnet discovered

#9

Post by cpncrunch » Fri, Oct 03, 2014, 11:12 PM UTC

milesf wrote: post #3

Hmm. I've never heard of drweb.com before, and there's no instructions on how to detect the worm, but they want to sell me anti-virus software. This might be legit, but I'll wait and see if this appears anywhere else before I trust it as being valid.

Yes, I was a little suspicious myself, although looking at their wikipedia page it does seem to be a genuine company.

https://en.wikipedia.org/wiki/Dr._Web

Also, more info here seems to support the fact that they are the real deal:

https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback

(as usual with wikipedia, you should check the original sources to verify).

Re: New Mac OS X botnet discovered

#10

Post by cpncrunch » Fri, Oct 03, 2014, 11:13 PM UTC

spectres_ wrote: post #7

To see if you haven't got it: In terminal run: defaults read /Applications/Safari.app/Contents/Info LSEnvironment You should get this error: The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist Then run: defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES You should get this error: The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES…

That is for the Flashback trojan, but this is a new trojan, according to the post.