New Version Of Flashback Mac Trojan Found Using Java Exploits

snoopy · Feb 24, 2012

New Version of Flashback Mac Trojan Found Using Java Exploits

A new version of the Flashback Trojan that targets Macs has appeared, and this one uses a drive-by download technique to attempt exploits of two Java vulnerabilities. The Flashback.G malware also tries to trick users into accepting a fake digital certificate, which will install the malware if the Java exploits fail.

The infection methods used by the new version of the malware are along the lines of what one might expect from a Windows-based attack. The drive-by download technique is a tried-and-true method for exploiting vulnerabilities in browsers, whether they be bugs in the browser itself or in a component or plug-in. This has been incredibly fertile ground for attackers in recent years and it only makes sense for them to take their talents to OS X as well.

Researchers at Intego recently came across this newest version of the Flashback Trojan for OS X doing just that, and more. The malware's first move is to attempt the exploits on a pair of Java vulnerabilities. If one of those exploits works, the malware installs itself on the machine and injects some code into a variety of applications. That is where the fun begins.

Flashback.G injects code into web browsers and other applications that access a network, and in many cases causes them to crash. It installs itself in an invisible file in the /Users/Shared folder, and this file can bear many names, but with a .so extension," Intego said in a blog post.
Click to expand...

Story - http://threatpost.com/en_us/blogs ew-version-flashback-mac-trojan-found-using-java-exploits-022412

Log in or Sign up

New Version Of Flashback Mac Trojan Found Using Java Exploits

snoopy Registered Members

Share This Page

Log in or Sign up

New Version Of Flashback Mac Trojan Found Using Java Exploits

snoopy Registered Members

Share This Page

Useful Searches