Zombie OS X bot army drops to 270,000 strong
Posted in Malware, 13th April 2012 14:01 GMT
Apple has released a tool that removes the infamous Flashback Trojan from infected Macs.
The utility, billed as a Java security update, also disables Java applets by default - but only on machines running OS X Lion, the latest version. The update turns off Java applet execution by default for all browsers, not just Safari.
Both the OS X Lion and Snow Leopard updates, released on Thursday, come with a patched version of Java that was made available in a separate set of updates earlier this week.
Apple has made good on its promise earlier this week to release a Flashback removal tool but the move came after several security firms independently released their own Flashback detection and removal tools (a list of free utilities is here).
The Flashback Trojan created a zombie army of remote-controllable 650,000 Apple Macs, or more, by exploiting a Java security vulnerability that Apple only patched last week, six weeks after a patch for Windows machines became available.
The Flashback Trojan has declined over recent days from a peak of around 670,000 machines to around 270,000 bots (Symantec's latest estimate) or lower. Despite the decline the zombie network remains an undead menace. ®
The utility, billed as a Java security update, also disables Java applets by default - but only on machines running OS X Lion, the latest version. The update turns off Java applet execution by default for all browsers, not just Safari.
Users can re-enable this if necessary, perhaps to use an online banking site that mandates Java, but the functionality is disabled again automatically in the absence of applet use within 35 days, as Apple's security bulletin for Lion explains:
This Java security update removes the most common variants of the Flashback malware.This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application.The picture is different for Mac users running Snow Leopard, where disabling Java in your browser won't happen automatically, as explained in a blog post by Paul Ducklin of Sophoshere. The update for Snow Leopard does include Flashback Trojan removal, as explained in Apple's bulletin here.
If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.
Java for OS X Lion 2012-003 delivers Java SE 6 version 1.6.0_31 and supersedes all previous versions of Java for OS X Lion.
This update is recommended for all Mac users with Java installed
Both the OS X Lion and Snow Leopard updates, released on Thursday, come with a patched version of Java that was made available in a separate set of updates earlier this week.
Apple has made good on its promise earlier this week to release a Flashback removal tool but the move came after several security firms independently released their own Flashback detection and removal tools (a list of free utilities is here).
The Flashback Trojan created a zombie army of remote-controllable 650,000 Apple Macs, or more, by exploiting a Java security vulnerability that Apple only patched last week, six weeks after a patch for Windows machines became available.
The Flashback Trojan has declined over recent days from a peak of around 670,000 machines to around 270,000 bots (Symantec's latest estimate) or lower. Despite the decline the zombie network remains an undead menace. ®
