Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Apple

Apple Developing Tool To Remove Flashback 212

Posted by Unknown Lamer from the macs-can't-get-viruses dept.
Trailrunner7 writes, quoting Threatpost: "Apple is planning to release a software fix that will find and remove the Flashback malware that has been haunting Mac users for several months now. ... Apple said on Tuesday that it was in the process of developing a tool that would detect and remove Flashback, but the company did not specify when the fix would be available. Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now."
This discussion has been archived. No new comments can be posted.

Apple Developing Tool To Remove Flashback More

Apple Developing Tool To Remove Flashback

Comments Filter:

  • if steve jobs was still here (Score:5, Funny)

    by alen ( 225700 ) on Wednesday April 11, 2012 @09:35AM (#39643207)

    he would hire elite apple assasins to kill these supposed security researchers to stop the bad news

    • Re: (Score:2, Funny)

      by Anonymous Coward
      If Jobs was still here he would tell you that you are "holding it wrong".

    • Steve Jobs: Ninja Assasin (Score:5, Funny)

      by Guppy ( 12314 ) on Wednesday April 11, 2012 @10:56AM (#39644205)

      he would hire elite apple assasins to kill these supposed security researchers to stop the bad news

      You fools, don't you realize Steve Jobs himself was the elite apple assassin?

      Concealed under his black shinobi-shzoku-turtleneck was a lethal array of ninja weapons; many an unlucky Samsung executive or uncooperative tech-journalist has met their end at his hands, dispatched by a Firewire-cable garrot or iShuriken (they're like regular Shuriken, but with patented rounded corners). Gates himself has only survived thanks to the vigilant guard of his hulking 'roid-enhanced genetically engineered gorilla henchman.

      He was a shinobi of un-matched caliber, until his fateful battle against Google-fu masters Page and Brin, when he was felled by the Pancreas Death-Strike technique.

      • Re: (Score:1)

        by Anonymous Coward

        You fools, don't you realize Steve Jobs himself was the elite apple assassin?

        I like what you did there.

        Most probably didn't even notice that your lips were not synchronized as you said the above.

      • Re: (Score:3)

        by mybecq ( 131456 )

        Gates himself has only survived thanks to the vigilant guard of his hulking 'roid-enhanced genetically engineered gorilla henchman.

        And here I was thinking it was because he was some kind of Borg creature. My mistake.

      • You fools, don't you realize Steve Jobs himself was the elite apple assassin?

        If he was, he wasn't very good. His throwing stars were confiscated by the Japanese. [fastcompany.com]

    • Re: (Score:2)

      by shugah ( 881805 )
      I'm going to get a bracelet that says "WWSD"

    • Re: (Score:3)

      by CAIMLAS ( 41445 )

      That may be modded funny, but their response has probably closer to that right now than it is any actual sincere security response.

      It's really quite embarrassing (for them). I'd expect this from a small company, not a multibillion (trillion?) dollar international corporation. It does not make me have faith in their ability to effectively and safely maintain their software stack.

    • I reckon he'd charge people for Flashback. Then patent it. Then attempt to patent all the malware in the world. And the future world.
  • I'm still having flashbacks to the time I saw the Goatse image. Will it work on that too?

  • Slow is good (Score:5, Informative)

    by Sarten-X ( 1102295 ) on Wednesday April 11, 2012 @09:37AM (#39643245) Homepage

    Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now.

    Because they're doing the same thing Microsoft does with its slow-as-molasses patches: testing for side effects, on every major application, on every piece of hardware they can get their hands on.

    • Re:Slow is good (Score:5, Informative)

      by FudRucker ( 866063 ) on Wednesday April 11, 2012 @09:40AM (#39643297)
      if it was Linux based malware a patch would have been out within 24 to 48 hours, six months is enough time to create a new version of the entire operating system,

      • Re:Slow is good (Score:5, Funny)

        by Sarten-X ( 1102295 ) on Wednesday April 11, 2012 @09:50AM (#39643439) Homepage

        If you're running Linux, you're probably competent to fix things if a patch breaks them.

        If you're running OS X, you're probably confused enough by the patch in the first place.

        If you're running Windows, you're probably just going to complain to some IT guy when the report looks slightly different.

        Disclaimer: I triple-boot, with more VMs. I can make fun of everybody.

        • Comment removed (Score:5, Funny)

          by account_deleted ( 4530225 ) on Wednesday April 11, 2012 @11:38AM (#39644693)
          Comment removed based on user account deletion

        • Re: (Score:2)

          by edremy ( 36408 )

          Disclaimer: I triple-boot, with more VMs. I can make fun of everybody.

          Bah- neophyte. I ran Doom the other day in a DOS emulator under Linux running in VirtualBox under Windows which was running on my Mac in Parallels.

          Yes, it ran- it was even playable. Next up I'm going to run VICE on the DOS machine and see if I can play Bard's Tale on a C64. I loved that game...

          • I've run Bard's Tale on the old Apple ][ emulator on my Mac Plus emulator on my 68K Mac emulator on my PPC Mac emulator on my VirtualBox install of 10.4.11 on 10.7.

            Interestingly, it actually runs at speed. Too bad there was no decent IIgs emulator for the Plus, or I'd run Dark Castle on it :)

            I've also had every major version of the Mac OS (except 10.0 and 10.1, for obvious reasons) running in parallel on the same hardware (from the original Macintosh System 0.3 through to 10.7). Of course THAT tends to sl

      • A patch might have been out within 48 hours, but how long until it made its way into every distributions patch repository?

      • Re:Slow is good (Score:5, Insightful)

        by CharlyFoxtrot ( 1607527 ) on Wednesday April 11, 2012 @10:45AM (#39644059)

        if it was Linux based malware a patch would have been out within 24 to 48 hours, six months is enough time to create a new version of the entire operating system,

        The vulnerability has been patched. This is about removing the malware from infected systems.

        • Re: (Score:3)

          by tqk ( 413719 )

          if it was Linux based malware a patch would have been out within 24 to 48 hours ...

          The vulnerability has been patched. This is about removing the malware from infected systems.

          Yeah, and how hard is that? Is this about malware that magically attaches itself to existing executables, or does it just drop itself into a system directory and run itself?

          Both are pretty bloody old problems and easily mitigated. How is it that OSX can be owned by a driveby exploit trojan that adds it to a botnet? I thought its underlying guts were Unix. How is it that Windows can't notice that something new has been installed and executed without the user's instigation?

          What have Apple and Microsoft OS

          • Yeah, and how hard is that? Is this about malware that magically attaches itself to existing executables, or does it just drop itself into a system directory and run itself?

            "As with previous variants of the malware, the latest variant of the Flashback malware, called OSX/Flashback.I, works by modifying code within Web browsers that causes it to launch when the browsers are opened and result in modified Web pages being displayed."
            Removal instructions [f-secure.com]

            Both are pretty bloody old problems and easily mitigated. How is it that OSX can be owned by a driveby exploit trojan that adds it to a botnet? I thought its underlying guts were Unix. How is it that Windows can't notice that something new has been installed and executed without the user's instigation?

            What have Apple and Microsoft OS developers been spending their time on for the last decade? Surfing pr0n? Posting "you guys suck" on web forums? Making Clicky spin more gracefully?

            Meanwhile, their users are unwittingly added to botnets and their machines run keyloggers that phone home to crackers. And they get to pay for these "privileges"?!? Gee, what a great deal.

            $DEITY help them if their shareholders ever wise up.

            Actually the problems ARE all solved in the latest versions of OSX. The attack vector is a Java applet displayed in the browser, Lion no longer includes Java by default [cnet.com], malware detection [eweek.com] was added in Snow Leopard and starting in L

        • This virus has already been patched this is just a removal tool for the 600,000 computers that got infected. 600,000 out of how many millions of machines Apple sells a year it is small in comparison to Windows viruses. Oracle released a patch for Windows while ago Apple is just getting around to it they were slow on getting this patch out but the negative press has really been at minimum.

          • the negative press has really been at minimum.

            Probably a "Let He Who Is Without Sin Cast The First Stone" kind of thing.

    • Re: (Score:3)

      by ledow ( 319597 )

      Meanwhile, all those applications are running in your large corporation while riddled with malware that's difficult to detect, isolate and remove.

      Put out a patch and EVERYONE can test, and those for whom it is critical can TELL you what it did to their machines and/or choose to apply it or not.

      Meanwhile, every home user is typing in their bank details into a computer that's reading their every move because some obscure application on the other side of the planet "might crash".

      And, to be honest, any applicat

    • Re:Slow is good (Score:5, Funny)

      by Coisiche ( 2000870 ) on Wednesday April 11, 2012 @09:48AM (#39643403)

      ...on every piece of hardware they can get their hands on...

      But it's Apple, isn't there just one bit of hardware to check?

    • Re: (Score:1)

      by Anonymous Coward

      Yes, because Apple will have to test on such a VAST range of hardware...

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Yes, because Apple will have to test on such a VAST range of hardware...

        Actually yes, they do. They currently offer support on 3 different OSs (10.5-10.7) and close to a hundred different platforms with different configurations going back 4 years.

        You can even rent their test lab as a developer if you wanted to as well.

        • Actually yes, they do. They currently offer support on 3 different OSs (10.5-10.7)

          Actually, they're not offering security updates for 10.5 any more. They're offering security updates for 10.6 and bug-fix and security updates for 10.7; "bug-fix and security updates for the current major release, security updates for the previous major release" has been the policy for many years.

    • Re:Slow is good (Score:5, Informative)

      by Anonymous Coward on Wednesday April 11, 2012 @09:50AM (#39643433)

      Actually the quote is quite opinionated and wrong. Apple provided java patches that basically close the hole and make the malware issue mute. Flashback HAS existed for months, but its also using a new vulnerability each time it comes up (its used a Flash hole, a PDF hole and a Java hole, three things not even developed BY Apple.) Likewise they have been patching the OS to flag Flashback in previous versions of the trojan.

      The whole quote both shows the writers complete lack of knowledge of whats been done about Flashback that any competent system administrator knows already (hell we even have scripts developed to flag machines that MAY be infected and have had them for months this is ON TOP OF the info Apple has been providing us) as well as his bias in trying to spin this as if this thing is a huge issue (honestly is not, its not even the first real vulnerability on the Mac OS, there were numerous worms for Quicktime back in the 90's that abused Quicktimes autoplay feature, AND THOSE didnt require you to authenticate as admin since pre-osX you ran as root.)

    • Re: (Score:1)

      by csumpi ( 2258986 )

      However they missed Autodesk Maya with the Lion upgrade. Maya still doesn't run on it, which is one of the most popular 3d packages (if not the most popular 3d package).

      So I'm not necessarily buying your argument. It has as much ground as saying that providing a fix would acknowledge that the problem existed in the first place.

      • I had atleast 6 months to test my apps on lion before release and I'm just a normal developer. Auto desk probably gets access before mOst people due to their popularity. It's not Apples fault, it's yours for bending over and continuing to use products from a company openly hostile and abusive to its customers like autodesk

        What you need to realize is that auto desk is no different than adobe, if you use a Mac and you haven't migrated off those tools that still think It's the late 80s it's your problem.

    • Re:Slow is good (Score:5, Interesting)

      by Theophany ( 2519296 ) on Wednesday April 11, 2012 @09:53AM (#39643469)
      Whilst I'd like to believe you, I fear that it is more to do with Apple spending so long in flat out denial that an issue ever existed.

      Don't get me wrong, I'm no hater and I'm no shill. I used to exclusively use Macs, now I don't use them at all (although I do use an iPhone/iPad) purely because their support practices in terms of viruses or serious issues are disgraceful. Whilst they do have an excellent support system whilst you're covered by AppleCare, they also have a culture of denying widespread hardware and software failures that most other companies would acknowledge quickly and get fixed quickly too.

      Case in point, I bought a batch of Macbook Airs a few years back for the company I was then working for. After two years, every_single_one_ died within a few days of each other from the same catastrophic hardware failure. Apple refused to acknowledge that there was any link, no matter how tenuous, of a manufacturer failure. They said it was pure coincidence.

      Like I said, I'm no hater. I know that corporations have to be ruthless to make money, but once I realised just how often they bury their heads in the sand (and how infuriating it can be) that was the day I ceased to buy big ticket items from them.
      • As an addendum to this: There's a problem with our software, we will fix it ASAP.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        they also have a culture of denying widespread hardware and software failures that most other companies would acknowledge quickly and get fixed quickly too.

        Really? Because I have never in 15 years of being a tech or system administrator who worked exclusively with Macs EVER had a issue with Apple admitting a hardware issue. Maybe a tech once in a while who didnt want to go through paperwork, but not my executive contacts who have replaced systems even when it WAS our fault, and we didnt have AppleCare on i

        • I'm talking in more general terms. I.e. a thousand or so Macs started exhibiting this weird behaviour - everybody is taking to the Internet to complain. Apple are denying this is a widespread issue.

        • Re: (Score:1)

          by Anonymous Coward

          If you're a tech or SA working exclusively with Macs, I can say with high certainty that your productions were of low merit and no complexity. For real - 5 "home users" and a Belkin switch does not constitute enterprise experience - and your anecdote at best demonstrates how tiny your experience set is.

      • Odd. I had a MacBook affected by a bad nvidia card and Apple replaced the motherboard free of charge on hardware long out of warranty (4 years old). This is not a refusal to acknowledge an issue to my mind.

        They lead the industry in satisfaction. Reality would tend to differ with your example.

        • Reality would tend to differ with your example.

          As I said, I used to use Macs exclusively and had never had an issue with their tech support. My first Mac was a TiBook back in 2001 (which I still have and is still working perfectly). I'm not saying that their service sucks on the individual level (which, I hasten to add is not what I was talking about in my example), but the level of service I received in the example given was appalling.

          Am I trying to boycott them? No. Am I saying their service sucks universally? No. In my experience with them as a big

    • Security researchers and customers have been questioning why Apple hasn't yet provided a fix for the malware even though Flashback has been around in one form or another for more than six months now.

      Duh... They haven't fixed it yet because Macs don't get viruses, worms, and malware, that's a Windows problem... Hadn't you heard?

    • Re:Slow is good (Score:4, Funny)

      by Idbar ( 1034346 ) on Wednesday April 11, 2012 @10:13AM (#39643685)
      Did you just compared Apple to... Microsoft!!??

      Run for your lives!

    • Re: (Score:2)

      by CAIMLAS ( 41445 )

      Really? Then why does Windows Security Essentials get an update for some things within a day or so of new malware making the rounds?

      You're comparing a vulnerability patch (long cycle reactive) with a detection and removal tool (short cycle reactive). It's not even an intelligent argument.

    • Re: (Score:2)

      by dintech ( 998802 )

      Well, at least now people might stop pretending that Apple products are magically more secure than the competition.

  • Flashback? (Score:3, Funny)

    by Vinegar Joe ( 998110 ) on Wednesday April 11, 2012 @09:38AM (#39643257)

    It's not a bug.....it's a feature.

  • Unfortunately, security isn't that big of a deal to Apple...yet. With the increase in market penetration the bulls-eye on Macs is getting larger and a lot more tempting; hopefully they realize this before something very serious happens and take steps to bolster their in-house security research (or hell, outsource it).

  • Manually Detect & Remove (Score:5, Informative)

    by guttentag ( 313541 ) on Wednesday April 11, 2012 @10:12AM (#39643677) Journal
    Running Software Update today to update Java will prevent you from getting flashback going forward, but that's not going to do anything if you already have it.

    Here's how to figure out if you have it (from Gizmodo [gizmodo.com]):

    1.Run the following command in Terminal:
    defaults read /Applications/Safari.app/Contents/Info LSEnvironment
    2. Take note of the value, DYLD_INSERT_LIBRARIES
    3. Proceed to step 8 if you got the following error message:
    "The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"

    If you don't get that error message, well, time to head to F-Secure for your fix. If you're clean so far, you can move on to step eight:

    8. Run the following command in Terminal:
    defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES
    9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:
    "The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"

    In other words: "does not exist" means you've got a healthy rig. Anything else, just keep following F-Secure's instructions [f-secure.com] to vanquish the intruder.

    • Re: (Score:2)

      by Inda ( 580031 )
      Terminal? This ain't an airport buddy.

      Isn't there of picture of Steve's head I can click instead?

  • Why apple waited so long... (Score:3)

    by wjcofkc ( 964165 ) on Wednesday April 11, 2012 @11:02AM (#39644281)
    Because they are working on the next version of OS X: Honey badger. It don't give a shit.

    http://www.youtube.com/watch?v=4r7wHMg5Yjg&feature=player_detailpage [youtube.com]

  • Has Flashback done any damage? (Score:3)

    by alispguru ( 72689 ) <bob,bane&me,com> on Wednesday April 11, 2012 @11:33AM (#39644619) Journal

    Casual web searches don't turn up anything other than exploiting a vulnerability to get onto your machine (bad enough!).

    Did anyone successfully command it to do anything?

  • no need to waste slashdot's time with this old non-news. take it to the friend bar: http://www.youtube.com/watch?v=q9ZnwvyAk8k [youtube.com]
  • buy the "new" ibook, it will be virus free.

  • I'm surprised that Dr. Web hasn't come out with a tool for this. (They are pretty damned good at that sort of thing)

    Actually, not a specific tool, but...

    http://news.drweb.com/show/?i=2354&lng=en&c=14 [drweb.com]

    "Rather than employ special tools provided by other vendors to delete BackDoor.Flashback.39, Doctor Web offers you to make use of the time-tested Dr.Web Light for Mac OS X rated among the top free applications in the Mac App Store. It will easily find and neutralize the Trojan horse and other malicious p

  • .... Apple developers were distracted reminiscing about the good old days when Apple products didn't get viruses.

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close