Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Mac users hit with Windows-style 'Koobface' Trojan

Multi-platform attack targets Windows and Apple

Article comments

A week after a security company warned Mac users of the slowly growing risk of malware attack, a new Mac OS X Trojan-worm based on Koobface has been discovered circulating via Facebook and Twitter.

The malware appears in security bulletins puts out by two Mac anti-malware companies, SecureMac, which has dubbed it trojan.osx.boonana.a, and Intego, which describes it as OSX/Koobface.A, which would make it a variant of the common Koobface worm that afflicted Facebook in 2008.

The interesting feature of the worm-cum-Trojan is its design and delivery, which resembles the sort of malevolence that is utterly standard in Windows world.

Using an "Is this you in this video?" link on Facebook, Twitter and other social media as the lure, infection starts with a Java applet downloading remote malware that sets itself to run automatically at startup. This then hijacks the user’s email software in order to spam further links, and modifies the system’s password settings.

From the point of infection, the Mac can be remotely monitored and any files on it are at risk of being stolen.

One unusual aspect of the malware is that its Java architecture allows it to hit Mac, Windows and Linux users. In-browser exploits using Java are common in Windows, and not unheard of in Macs either, but doing both at the same time is a rare approach. This hints that integrated malware could become more common in future.

"This is a sobering reminder that hackers are turning their efforts toward Mac OS X as Apple's market share grows, and users should be vigilant in protecting their computers and taking precautions when surfing the web," said SecureMac researcher, Nicholas Ptacek.

As with any Java exploit, the simplest defence it to turn off Java in the browser. That will cause problems when browsing some websites, however.

"While Intego has evidence of several infections in the wild, we are not currently able to go beyond this step, as either the malicious malware has bugs preventing it from running correctly, or the servers it contacts are not active or are not serving the correct files,” said an analysis put out by Intego researchers.

“Technically, it propagates as a worm, is installed via a Trojan Horse, and installs a rootkit, backdoor, command and control, and other elements,” the statement added.



Share:

More from Techworld

More relevant IT news

Comments

Graham said: I realise it is a small mistake but the paragraph As with any Java exploit the simplest defence it to turn off Java in the browser That will cause problems when browsing come websites however made me laugh and brightened my day

Teagu said: How do you know which sites use Java in advance of going there

Henny Youngman said: As with any Java exploit the simplest defence it to turn off Java in the browser That will cause problems when browsing come websites howeverWell the first rule is to stay away from um those websites in the first place isnt it

mike collins said: Not clear how it affects Mac and PCs

Englishmaybe said: This is unlikely to be down to extreme rarity SecureMac has mentioned user reports of open spreadExcuse me but what language are we using here



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *