04/06/2012
Nearly 600,000 Macs Hit with Flashback Trojan Malware
Many a blog have I written about the necessity of Mac antivirus software, hoping to get at least a few people to drop their delusions about how the Mac and Apple's OS X are impervious to viruses.
Now, don't get me wrong, I'm not trying to start a PC vs Mac flame war/battle. Really. (They're useless.) Nor do I want this to be an, "I told you so."
What I am saying is this: If it has a CPU, chances are at or near 100% that a virus can be written to attack that computer. It's only a matter of time 'til it happens. And, yes, some computers, operating systems, and software are inherently more secure.
Even still, it's important to realize "more secure" doesn't mean "secure."
In a way, we should consider ourselves lucky, like the MacDefender fake antivirus malware, this one is also getting a lot of coverage in the press and elsewhere, so it's raising the specter of viruses being mainstream for the Mac like they are for the PC.
And with that knowledge comes greater understanding of what can be done to protect ourselves. In this case the understanding came because Russian antivirus firm Dr Web uncovered the 550,000 strong botnet that spread via Trojan Backdoor.Flashback.39.
F-Secure also has a good write-up / manual removal instructions on how to remove the Trojan-Downloader:OSX/Flashback.I.
And, if you're a Mac user and you haven't yet gotten it, Apple has an important Java security update. (A Java exploit being the channel through which trojan is infecting the Mac to begin with.)
My $.02, if you're looking for antivirus software for your Mac, our testing is incomplete, but so far we like BitDefender Antivirus for Mac, so if you're in the market, take a look.
UPDATE
Turns out this Mac Trojan isn't some little deal. The folks at F-Secure have found out Mac Trojan Flashback.B Checks for virtual machine!What's so significant about that?
Nearly all antivirus researchers rely heavily on virtualization software like Virtual PC, VMWare, Parallels, VirtualBox and others to help their research.
Using virtualization software allows the researchers to investigate viruses with the added safety net of doing so in a contained environment. And, in doing so they're able to more easily explore the innards of many viruses.
The malware writers for Windows have figured this out, and many of the most advanced viruses check to see if their virus is running inside a virtual environment and, if so, they shut down, thus making research slower, more tedious, and a lot more difficult.
This is one of those things that's been going on in the Windows virus arena for a long, long time. What's really unexpected though is that it's already showing up in a Mac virus, which on a couple of levels means virus writing is a lot more advanced for the Mac than many virus researchers--and certainly the general public--ever imagined.
The bottom line: if you're running a Mac and you don't have Mac antivirus software, it's time to consider it.
10/19/2011
More Details Emerging about R2D2 Backdoor Trojan
First reported by the Chaos Computer Club (CCC), which claims to be the largest European Hacker club, this malware, they claim, is used by German police forces, and
And, no matter your opinion of remote PC monitoring and true spy software, there's something very troubling about this trojan according to CCC,
Both Kaspersky and F-Secure have already done their own analysis. Here's what they each have to say:
The various reports all say it's for monitoring communication from a suspect's computer when they're using several types of software:
So now, the question is are the antivirus software companies detecting the trojan?
Yes. Kaspersky and F-Secure alike say their software's heuristics (i.e. realtime protection) were capable of detecting the trojan even before they became aware of it and added specific threat definitions to their software.
F-secure says,
So, the bottom line, if you're running good antivirus software with realtime protection enabled, this trojan is unlikely to be a threat.
And, if you're not, why not?
Is it legal? It appears not, despite being state sponsored....can not only siphon away intimate data but also offers a remote control or backdoor functionality for uploading and executing arbitrary other programs.
And, no matter your opinion of remote PC monitoring and true spy software, there's something very troubling about this trojan according to CCC,
Their analysis isn't just hot air. Further in their report, they go on to say,Significant design and implementation flaws make all of the functionality available to anyone on the internet.[Editor's Note: Emphasis mine.]
These are serious charges being leveled, so what does the antivirus software community's analysis reveal?The analysis also revealed serious security holes that the trojan is tearing into infected systems.
"The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the trojan are even completely unencrypted. Neither the commands to the trojan nor its replies are authenticated or have their integrity protected.
"Not only can unauthorized third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the trojan, and upload fake data.
"It is even conceivable that the law enforcement agencies's IT infrastructure could be attacked through this channel.
Both Kaspersky and F-Secure have already done their own analysis. Here's what they each have to say:
F-Secure
In their "News from the Lab" blog on the R2D2 Backdoor Trojan, their report adds,And now, several German states have admitted to using Backdoor:W32/R2D2.A (a.k.a. "0zapftis"), though they say the backdoor falls within what's allowed.
Kaspersky
The Kaspersky blog details their own analysis which uncovered some other interesting details, including:So what's the point of this trojan? Good question....there are six components in total – each with a different purpose – all of which have been analyzed by us.
"Amongst the new things we found in there are two rather interesting ones: firstly, this version is not only capable of running on 32 bit systems; it also includes support for 64 bit versions of Windows.
"Secondly, the list of target processes to monitor is longer than the one mentioned in the CCC report.
"The number of applications infected by the various components is 15 in total.
The various reports all say it's for monitoring communication from a suspect's computer when they're using several types of software:
- VOIP software (like Skype)
- web browsers
- chat software
| Software Monitored by R2D2 Backdoor Trojan | |
|---|---|
| Program | Purpose |
| explorer.exe | Internet Explorer web browser |
| firefox.exe | Mozilla Firefox web browser |
| icqlite.exe | Chat software |
| lowratevoip.exe | VOIP software |
| msnmsgr.exe | Chat software |
| opera.exe | Opera web browser |
| paltalk.exe | Video chat software |
| simplite-icq-aim.exe | Chat software |
| simpro.exe | Chat software |
| sipgatexlite.exe | VOIP software |
| skype.exe | VOIP software |
| skypepm.exe | VOIP software |
| voipbuster.exe | VOIP software |
| x-lite.exe | VOIP software |
| yahoomessenger.exe | Chat software |
So now, the question is are the antivirus software companies detecting the trojan?
Yes. Kaspersky and F-Secure alike say their software's heuristics (i.e. realtime protection) were capable of detecting the trojan even before they became aware of it and added specific threat definitions to their software.
F-secure says,
The 'heuristic' category indicates that our automation flagged the file based on rules that our analysts have created.And Kaspersky says,
All components are detected by Kaspersky as variants of the R2D2 trojan/rootkit. The dropper was previously heuristically detected and blocked by us as an invasive program.
So, the bottom line, if you're running good antivirus software with realtime protection enabled, this trojan is unlikely to be a threat.
And, if you're not, why not?
08/29/2011
Morto: Remote Desktop Connection Worm In the Wild, Spreading Actively
The fine folks at Finnish antivirus software maker F-Secure have spotted a new worm in the wild.
For us antivirus folks, worms are among the most feared because of their ability to infect, spread, and replicate on their own.
This one is being dubbed "Morto," and what's so unique about it is it's the first one to use the Microsoft Remote Desktop Connection.
The only surprising thing to me is that it's taken so long for a worm of this type to surface. Remote Desktop gives you direct access to your desktop remotely, so if someone manages to break into your system via the Remote Desktop Service, it gives them direct access to your computer--as if they were working right on your desktop, albeit remotely.
This particular worm isn't exploiting any bugs in Windows or in Remote Desktop; rather, it's exploiting weak passwords, long the bane of good system administrators.
Further, it's attempting to gain access to the default "Administrator" login, giving it maximum permissions on the system. Thus, once it's in, the computer is fully compromised.
Our own networks are seeing this threat attempting to connect to our servers at a rate of about 10 attempts per second, so clearly, this is a threat to take seriously if you have machines that rely on TCP port 3389, the Remote Desktop port.
As for the passwords being attempted, F-Secure's post on the Morto Remote Desktop worm lists these as the passwords being used to attempt the break-ins:
Here's our recommendations to keep this worm at bay:
For us antivirus folks, worms are among the most feared because of their ability to infect, spread, and replicate on their own.
This one is being dubbed "Morto," and what's so unique about it is it's the first one to use the Microsoft Remote Desktop Connection.
The only surprising thing to me is that it's taken so long for a worm of this type to surface. Remote Desktop gives you direct access to your desktop remotely, so if someone manages to break into your system via the Remote Desktop Service, it gives them direct access to your computer--as if they were working right on your desktop, albeit remotely.
This particular worm isn't exploiting any bugs in Windows or in Remote Desktop; rather, it's exploiting weak passwords, long the bane of good system administrators.
Further, it's attempting to gain access to the default "Administrator" login, giving it maximum permissions on the system. Thus, once it's in, the computer is fully compromised.
Our own networks are seeing this threat attempting to connect to our servers at a rate of about 10 attempts per second, so clearly, this is a threat to take seriously if you have machines that rely on TCP port 3389, the Remote Desktop port.
As for the passwords being attempted, F-Secure's post on the Morto Remote Desktop worm lists these as the passwords being used to attempt the break-ins:
- admin
- password
- server
- test
- user
- pass
- letmein
- 1234qwer
- 1q2w3e
- 1qaz2wsx
- aaa
- abc123
- abcd1234
- admin123
- 111
- 123
- 369
- 1111
- 12345
- 111111
- 123123
- 123321
- 123456
- 654321
- 666666
- 888888
- 1234567
- 12345678
- 123456789
- 1234567890
Here's our recommendations to keep this worm at bay:
- Change your password. Here's a how-to on choosing a good password.
- Rename your "Administrator" account. Since the worm is using "Administrator," alternatives will help keep it at bay.
- Block access to TCP port 3389, if possible, or limit access only to IP addresses you trust.
- Make sure your antivirus software/Internet security software is up-to-date.
- Backdoor:W32/Morto.A
- Backdoor:W32/Morto.B
06/10/2011
Android Smartphone Malware Detected by F-Secure
Let me start by saying, "You heard it here first. The bad guys are going to start targeting Smartphones/cell phones in a big way soon--probably within the next 6-12 months."
That said, this one doesn't fall into that category because you do get a warning from the Droid phone telling you what it's going to do.
Thanks to F-Secure for posting the original pic of this malware in action.
So, if you see a warning message like this, and you still click "Install," you can't really fault your phone. It's just doing what you told it to do.
And would smartphone antivirus software have stopped it?
(In the case of F-Secure's "Mobile Security," they claim it does in their piece on the Droid Malware.)
Now let's ask the real question here: if you get this malware on your phone, who's to blame here?
A) The user for installing it or
B) The cell phone manufacturer for allowing any program to do these types of actions.
That said, this one doesn't fall into that category because you do get a warning from the Droid phone telling you what it's going to do.
Thanks to F-Secure for posting the original pic of this malware in action.
So, if you see a warning message like this, and you still click "Install," you can't really fault your phone. It's just doing what you told it to do.
And would smartphone antivirus software have stopped it?
(In the case of F-Secure's "Mobile Security," they claim it does in their piece on the Droid Malware.)
Now let's ask the real question here: if you get this malware on your phone, who's to blame here?
A) The user for installing it or
B) The cell phone manufacturer for allowing any program to do these types of actions.
05/20/2010
What's with the "Earthquake" Exploit, KHOBE?
Earlier this month, security researchers at Matousec released details of research they've done that, they claim, bypasses 100% of antivirus software.
As you might imagine, there's quite a bit of concern about this, particularly among business users, particularly because mainstream media has started discussing the so-called, KHOBE attack.
Let's dig into this a bit and see what's behind the hype.
What is KHOBE
It's an acronym for:
Kernel
HOOK
Bypassing
Engine
HOOK
Bypassing
Engine
Put another way, it's a way for attackers to trick antivirus software. ZDNet's writer, Adrian Kingsley-Hughes, does a great job describing how this works here,
The attack is a clever 'bait-and-switch' style move.
"Harmless code is passed to the security software for scanning, but as soon as it's given the green light, it's swapped for the malicious code.
"The attack works even more reliably on multi-core systems because one thread doesn't keep an eye on other threads that are running simultaneously, making the switch easier.
Kingsley-Hughes goes on to say, Oh, and don't think that just because you are running as a standard user that you're safe, you're not. This attack doesn't need admin rights.
OK, now this is starting to sound like a pretty big deal.
Mitigating Factors with KHOBE
Here's where things *do* start to become more positive though:
| Mitigating Factor | What It Means | |
|---|---|---|
| 1. | Requires a lot of code. | Makes it less-than-ideal for most attacks to work. Since this code has to somehow be transferred to your machine, its current size makes it more difficult to use as a mechanism to bypass security software. |
| 2. | The software has to already be on your computer. |
Wha? Yes, that's right. From what the antivirus software vendors can tell thus far, the software doesn't actually bypass their software (at least the ones we've heard from) unless it's already there to begin with. This could be because you're installing their software after you've been infected with this code or because you disabled your antivirus program. |
| 3. | There aren't any known exploits--or exploit kits--that rely on this technique. (At least not yet.) |
The chances of encountering this in the real world are still very, very minimal. |
| 4. | It only affects antivirus software that uses the System Service Descriptor Table (SSDT), which is being used less-and-less frequently than it once was. | Antivirus companies are moving (or have already moved) away from the use of the SSDT since Windows Vista. Windows XP seems to be the last Microsoft Windows OS where the security vendors commonly relied on the SSDT for their antivirus software. This means if you're running Windows Vista or 7, chances are your antivirus or Internet security software is already immune to this exploit. Antivirus maker Sophos says, Sophos's on-access anti-virus scanner doesn't uses SSDT hooks, so it's fair for us to say that this isn't a vulnerabilty for us at all. VIPRE Antivirus' maker, Sunbelt Software, says, ...it would affect antivirus programs that use SSDT. We don't use SSDT in VIPRE for Windows Server 2008, Vista and Windows 7. We do use it for older operating systems, like Windows XP. |
| 5. | It's difficult to make work. | The code works, yes, but given the many things that are required for it to work, even if you were to encounter it "in the wild," there's still no guarantee your computer will be infected. |
Antivirus Vendor Responses
Sophos and Sunbelt aren't the only antivirus companies refuting the claims, security company F-Secure says,
We believe our multi-layer approach will provide sufficient protection level even if malicious code were to attempt use of Matousec's technique.
"And if we would see such an attack, we would simply add signature detection for it, stopping it in its tracks. We haven't seen any attacks using this technique in the wild.
Our Take on KHOBE
This is true not just for F-Secure, but for all Internet security software vendors.
If there were real-world exploits using this attack that they'd encountered, adding signatures for those attacks should be able to defeat the attack pretty easily.
Regardless of the outcome of the debate about this particular exploit, there are still a couple of take-away points as far as we're concerned,
- Run the best antivirus software you can afford.
- Keep it updated--frequently.
- Even if you're updated and protected against known threats, it's critical to regularly backup your system so that if something does get by your defenses, at least you can restore your system to a point before the infection.
08/17/2009
Antivirus Software: What's Real? What's Fake?
One of the growing concerns for many security and antivirus professionals is the dramatic growth of fake antivirus software.
The idea behind fake A/V software is to trick unsuspecting consumers into downloading and installing their fake software in an effort to get trojans, viruses, spyware, and other malware installed onto PCs in the process.
There's nothing real about the fake software, except the threat it poses.
The process works like this:
- Trick consumer with a real looking, real sounding ad on an (often unsuspecting) legitimate website
- Get consumer to install the phony (but very real looking) antivirus application
- Stuff any number of trojans, keyloggers, spyware, and other evil applications into the fake antivirus program
- Use the newly infected computer to do their bidding, including (among other things):
- identity theft
- credit card fraud
- bank theft
- infecting other computers
- spamming
Solution to the Fake Antivirus Software Problem
Word is filtering out today about a way to tell fake antivirus software from legitimate ones.
A new site from security and SSL vendor Comodo of a project they're backing called, "Common Computing Security Standards Forum," aims to help consumers figure out what's real and what's not.
In their list of all known legitimate antivirus software vendors, they hope to help put an end to the dummy antivirus programs out there and to help consumers stay clear of the crap.
In addition to thanking them for their efforts, here is a complete list of current antivirus vendors known to Comodo to be the real deal:
| Legitimate Antivirus Software Vendors |
|---|
|
|
You'll note, every one of the programs (reviews linked above) are included in our antivirus reviews since day one of our site are included on the list.
If you know of other legitimate A/V software not on the list, please contact us so that we can share your insight with the folks at Comodo.