Is Your Mac Safe From the Flashback Attack?

Experts say it's already infected over 600,000 computers, is yours one of them?

There is a new piece of malware that is targeting Apple Mac users. This new nasty bit of code is called the Flashback or Flashfake Trojan. Some reports have suggested that it has already infected over 600,000 Macs worldwide.

Earlier versions of the Flashback Trojan masqueraded as a fake Adobe Flash updater program which tricked users into installing it and infecting their computers.

This new variant is more virulent because it can infect a Mac by a user simply visiting a website that is serving the malicious payload. This type of attack, known as a "drive-by" attack, doesn't rely on fooling a user into clicking on an attachment or installing something. This method of infection is likely why the malware has managed to spread so far so fast.

What does the Flashback malware do?

According to F-secure, the malware known as a Trojan-Downloader, connects to a remote site and downloads a malicious payload. Once the trojan successfully downloads its payload it then infects the host computer and modifies targeted webpages displayed in the user's web browser. Some reports say the main purpose of the Flashback attack is to capture user login credentials and other personal information.

Other reports suggest that the infected machines may become part of a botnet that could potentially be tasked to carry out large-scale denial of service attacks or other tasks as desired by the botnet's master controller.

How can I prevent my Mac from becoming infected with the Flashback Trojan?

The best way to prevent your Mac from being infected by the Flashback Trojan is to perform a software update from the Apple menu in the title bar. Apple has already published the Java-related patch that you need to install to ensure that your computer is not vulnerable to the Flashback attack.

If you don't need to use JavaScript (which is how this malware enters your system) you should consider disabling it in your web browser's Java Preferences settings.

If you do use sites that require JavaScript to be enabled, then the best way to protect yourself is to install the latest Java update provided by Apple via the Apple Software Update.

To check for the updated software:

1. Click on the Apple icon in the top right corner of your screen in the title bar menu.

2. Click the "Software Update" selection from the drop down menu.

3. Wait for the list of applicable software updates to appear.

4. Ensure that all java-related updates are selected as well as any other major system and security updates.

5. Enter your password if required to instal the update.

6. Wait for the system to restart and repeat steps 1-3 to ensure that the update succeeded and that there are no additional updates waiting to be installed.

You should also ensure that your anti-malware / anti-virus software has it's latest patches installed as well, although at this time I'm not sure there are any capable of detecting this particular attack

How can I find out if my Mac is infected by the Flashback malware?

Kaspersky Labs recently released the Kaspersky Flashfake Removal Tool that will scan your Mac to see if the Flashback malware is present. Alternatively, they have set up a website that will allow you to paste your Mac's unique identifier to it so that it can determine if your Mac's ID matches one on a list of computers known to be infected with the Flashback malware. The website will also scan your Mac to see if its Java is the most current version If it is not, then it will advise you to run Apple's software update to get the most recent patch.

How do I remove the Flashback malware if my Mac is already infected?

You can scan for and remove the Flashback malware by using the Kaspersky Flashfake removal tool mentioned above. If you went to the Kaspersky website and found that your Mac's unique ID is on the list of compromised ones, Kaspersky's website will also direct your to the free removal tool.

As time goes by, other anti-malware vendors will likely release detection and removal tools as well. Don't download one unless you are sure that it comes from one of the major anti-malware providers or you may become the victim of a scareware scam.

Flashback is not the first piece of malware written for the Mac, nor will it be the last. The "no one writes malware for Mac" mindset is over with. Apple is a hot brand with an ever growing user base. Apple will likely become a victim of its own success as malware developers seek to extend their reach beyond the MS Windows crowd.