share share via: 
 
 
 
 
 
 
 
 81 days 
 
 Sophos Security 
 
 A new Trojan known as "Sabpab" could hurt Mac users who run Java and Microsoft Word. Security researchers are warning users to make sure their computers have the latest software updates from both Apple and Microsoft, and to use anti-virus software. In some cases, manual removal of Sabpab may be needed. 
 
 
 
 Word about Sabpab comes on the heels of another nasty piece of malware, Flashback, that infected up to as many as 600,000 Macs, security experts said, by exploiting a vulnerability in Java software. Apple last week issued a software-base removal tool for that malware, which can be used by criminals to steal personal information, including passwords. 
 
 
 
 Both Sophos Security and Kaspersky Lab warned users about Sabpab. One version of the malware takes advantage of the same Java exploit used by Flashback. 
 
 The other version of the malware arrives in an email attachment called "10th March Statemnet" (with "statement" misspelled). 
 
 
 
 "The name of the file ("10th March Statemnet") is directly linked with the Dalai Lama and Tibetan community," said Costin Raiu of Kasperky Lab. "On March 10, 2011, the Dalai Lama released a special statement related to Anniversary of the Tibetan People’s National Uprising Day -- hence the name." 
 
 
 
 Says Graham Cluley, senior technology consultant at Sophos: 
 
 
 
 If you open the boobytrapped Word document on a vulnerable Mac, a version of the OSX/Sabpab Trojan horse gets installed on your computer opening a backdoor for remote hackers to steal information or install further code. 
 
 As a decoy, a Word document is dumped onto your drive and displayed -- effectively acting as a camouflage for the Trojan's true intentions. 
 
 
 
 Mac users, Cluley says, may be caught off guard by the attack, "as there is no prompt to enter your username or password when the malicious software installs itself onto your Mac. 
 
 
 
 Microsoft released a security update in 2009 for Microsoft Office for Mac users that will take care of another recent crop of malware. "Of course, it would also be sensible to update your installation of Microsoft Word -- as a patch has been available for the vulnerability being exploited here since 2009," says Cluley. 
 
 
 
 On Monday, Microsoft confirmed that the security update will cover Sabpab. 
 
 (Msnbc.com is a joint venture of Microsoft and NBC Universal.) 
 
 
 
 If you use Norton AntiVirus or Symantec Endpoint Protection for Macintosh, Symantec has more information here about how to remove Sabpab. 
 
 
 
 At this point, while "there no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," wrote Cluley, and take steps to protect themselves, whether it's with Sophos' software or another company's. 
 
 
 
 "Mac users -- please get an anti-virus, for goodness sake," added Cluley. "If you don't want to pay for one, there is free anti-virus for Mac home users available for download." 
 
 
 
 While these recent attacks can be handled, they won't be the end of them. Dennis FIsher of Kaspersky, in a blog posting last month, wrote, "Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers in China now have taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in the Windows world." 
 
 
 
 Check out Technolog, Gadgetbox, Digital Life and In-Game on Facebook, and on Twitter, follow Suzanne Choney. ||||| There are few things Apple users love more than being Apple users. The tight security features and largely virus-free ecosystem have long given the Mac enthusiast a feeling of superiority over virus-ridden PC brethren. One problem: It's no longer true and hasn't been true for some time. 
 
 Apple's reputation for security was earned long ago. A group of hackers proved how dated that notion is earlier this week when they took control of the Transmission BitTorrent app and used it to distribute malicious software to Mac users that encrypts files on a victim’s machine and demands a $400 ransom payment to release the affected files. 
 
 It is not clear which versions of OS X, Mac's operating system, are affected. But it is clear that much of the Mac's reputation for safety was simply a function of not being attacked. For most pro hackers, the smaller Mac ecosystem simply wasn't worth the time. But that's changing. Indeed, the 6,500 people who downloaded the software unwittingly showed that cybercriminals’ investment in cracking Apple software is starting to pay off. 
 
 “Windows was really insecure for a long time, and Mac didn’t have a lot of market share so they weren’t as much of a target,” said Patrick Wardle, a former U.S. National Security Agency staffer who's now director of research at the security firm Synack. “If I’m going to hack an organization's devices now, it’s going to be Apple. They’re a security soft target.” 
 
 Apple's security weaknesses begin with the software designed to protect it. 
 
 Apple's Gatekeeper, first introduced in 2012 as part of OS X Mountain Lion, has become the primary security measure on OS X computers. It's meant to ensure that users only download apps and other software that have already been approved by Apple, either via the App Store or from identified developers who include a preapproved developer certificate (which verifies a developer's identity) in their product. It's a measure that's meant to prevent users from downloading outside programs that would enable hackers to steal their passwords and financial information, secretly capture audio or video or worse. 
 
 But Gatekeeper also includes a number of vulnerabilities that researchers have proved can be exploited for nefarious means. Last year Wardle exposed a mechanism in Gatekeeper that would allow hackers to bypass the protection by infecting software that has already been approved by Apple. Essentially, once an app was approved by Gatekeeper, it was always trusted, even if it started distributing malware later on. 
 
 Apple responded to Wardle's revelations in January by issuing a security update that only blocked the files Wardle provided to the company. The update didn't address the deeper problem: trusted files can still be used to distribute a variety of shady software. That's largely what appears to have happened in the ransomware attack, where attackers faked Transmission's already-approved developer certificate to distribute their own ransomware code. 
 
 “I wasn't really surprised, we were expecting this,” Wardle said, adding that Apple computers running El Capitan, the newest version of the Mac OS, without antivirus software rank at a five on a security scale of one to 10. Windows 10 is closer to a seven. “From a technical point of view there was no reason we hadn't seen this before. It was just neat that it was signed, which is an easy way around Mac Gatekeeper.” 
 
 Apple quickly revoked the digital certificate upon learning Transmission files were infected. 
 
 Photo: Reuters 
 
 Apple’s OS X held 7 percent of the worldwide operating system market as of November 2015, according to figures released by Net Applications. But just because an OS is less used doesn’t mean it’s safe. And now, with Apple computer sales expected to grow after a slight sales dip in the first fiscal quarter of 2016, it’s clear the attacks are going to continue, according to Grayson Milbourne, security intelligence director at the security company Webroot. 
 
 “We’ve seen attacks on Apple growing over the past few years, particularly in adware and apps that change your browser’s settings, but it’s all been much less severe than something like ransomware,” Milbourne said. “It’s really just following what people are doing online and how they’re accessing the Internet.” 
 
 Two years ago, the monthly average of infected Mac computers varied between 10,000 and 70,000 machines, according to the security firm Symantec. Research published last year by the cybersecurity company Bit 9 declared that, in 2015 alone, “The number of OS X malware samples has been five times greater than in 2010, 2011, 2012, 2013 and 2014 combined.” That number is expected to rise drastically in 2016, according to Symantec and other security vendors. 
 
 Apple has yet to employ a number of the security strategies Microsoft has had no choice but to explore as the proprietor of 91.39 percent of the operating systems in use in the world. With the launch of Windows 10 last summer, the company offered a $100,000 bug bounty to anyone who found a security vulnerability and reported it through the proper channels. 
 
 Microsoft also has a history of reaching out to hackers who previously made life difficult for the corporation. In 2006, Microsoft hired members of the Polish hacking group Last Stage of Delirium, which had exploited a hole in the Windows Remote Procedure Call interface and laid the groundwork for the Blaster worm— a program that used Microsoft sites to launch cyberattacks. 
 
 Such tactics could have detected issues in Gatekeeper and the certificate verification process before the security measures were released publicly. 
 
 “If you want to get better at what you do, especially when it comes to security, you need to make sure you plug as many holes as possible,” said Liviu Arsene, senior threat analyst at Bitdefender, a Romanian cybersecurity company that unveiled research on the ransomware affecting Mac computers. “The cost of actually having a breach is much higher than the cost to your company under a bug bounty.” 
 
 Neither of those efforts would have prevented the ransomware from hitting Windows users. Windows computers, widely used by individuals as well as employers, remain a tempting target for ransomware attackers who stand to make millions by separating users from their data. 
 
 Along with Gatekeeper, Apple computers also employ the technique known as Sandboxing, which limits the amount of information apps can access on a user's computer. Users are warned that a file downloaded from an unknown third party could contain malware. Apple's Safari browser also employs a robust anti-phishing algorithm that warns users before they visit websites containing potentially harmful materials. 
 
 "A lot of Apple's security mitigations rest on Gatekeeper," said Patrick Wardle. "They're just not as proactive as Microsoft, with the bug bounty and consulting with external hackers ... but they're making a ton of money, so why would they spend a ton of money on security when they don't really have to?" 
 
 Apple declined to comment for this story. 
 
 Apple fans can at least relax in knowing the iPhone is, generally, safer than Android mobile devices. Along with passcode encryption and end-to-end encrypted iMessages, iPhones include security features that would need to be disabled in order to download a potentially malicious app. Meanwhile, ransomware attackers have disguised their malware as pornography apps and video players that have bilked countless downloaders out of hundreds of dollars apiece. 
 
 “So far there hasn’t been any ransomware for iPhones because you’d have to sideload an app onto the iPhone,” said Liviu Arsene. “Few people really jailbreak their phones.” ||||| With a bug as dangerous as the “shellshock” security vulnerability discovered yesterday, it takes less than 24 hours to go from proof-of-concept to pandemic. 
 
 As of Thursday, multiple attacks were already taking advantage of that vulnerability, a long-standing but undiscovered bug in the Linux and Mac tool Bash that makes it possible for hackers to trick Web servers into running any commands that follow a carefully crafted series of characters in an HTTP request. The shellshock attacks are being used to infect thousands of machines with malware designed to make them part of a botnet of computers that obey hackers’ commands. And in at least one case the hijacked machines are already launching distributed denial of service attacks that flood victims with junk traffic, according to security researchers. 
 
 The attack is simple enough that it allows even unskilled hackers to easily piece together existing code to take control of target machines, says Chris Wysopal, chief technology officer for the web security firm Veracode. “People are pulling out their old bot kit command and control software, and they can plug it right in with this new vulnerability,” he says. “There’s not a lot of development time here. People were compromising machines within an hour of yesterday’s announcement.” 
 
 Wysopal points to attackers who are using a shellshock exploit to install a simple Perl program found on the open source code site GitHub. With that program in place, a command and control server can send orders to the infected target using the instant messaging protocol IRC, telling it to scan other networked computers or flood them with attack traffic. “You install it on the server that you’re able to get remote command execution on and now you can control that machine,” says Wysopal. 
 
 The hackers behind another widespread exploit using the Bash bug didn’t even bother to write their own attack program. Instead, they rewrote a proof-of-concept script created by security researcher Robert David Graham Wednesday that was designed to measure the extent of the problem. Instead of merely causing infected machines to send back a “ping” as in Graham’s script, however, the hackers’ rewrite instead installed malware that gave them a backdoor into victim machines. The exploit code politely includes a comment that reads “Thanks-Rob.” 
 
 The “Thanks-Rob” attack is more than a demonstration. The compromised machines are lobbing distributed denial of service attacks at three targets so far, according to researchers at Kaspersky Labs, though they haven’t yet identified those targets. The researchers at the Russian antivirus firm say they used a “honeypot” machine to examine the malware, locate its command and control server and intercept the DDoS commands it’s sending, but haven’t determined how many computers have already been infected. 
 
 Based on his own scanning before his tool’s code was repurposed by hackers, Graham estimates that thousands of machines have been caught up in the botnet. But millions may be vulnerable, he says. And the malware being installed on the target machines allows itself to be updated from a command and control server, so that it could be changed to scan for and infect other vulnerable machines, spreading far faster. Many in the security community fear that sort of “worm” is the inevitable result of the shellshock bug. “This is not simply a DDoS trojan,” says Kaspersky researcher Roel Schouwenberg. “It’s a backdoor, and you can definitely turn it into a worm.” 
 
 The only thing preventing hackers from creating that worm, says Schouwenberg, may be their desire to keep their attacks below the radar—too large of a botnet might attract unwanted attention from the security community and law enforcement. “Attackers don’t always want to make these things into worms, because the spread becomes uncontrollable,” says Schouwenberg. “It generally makes more sense to ration this thing out rather than use it to melt the internet.” 
 
 The Bash bug, first discovered by security researcher Stéphane Chazelas and revealed Wednesday in an alert from the US Computer Emergency Readiness Team (CERT), still doesn’t have a fully working patch. On Thursday Linux software maker Red Hat warned that a patch initially released along with CERT’s alert can be circumvented. 
 
 But Kaspersky’s Schouwenberg recommended that server administrators still implement the existing patch; While it’s not a complete cure for the shellshock problem, he says it does block the exploits he’s seen so far. 
 
 In the meantime, the security community is still bracing for the shellshock exploit to evolve into a fully self-replicating worm that would increase the volume of its infections exponentially. Veracode’s Chris Wysopal says it’s only a matter of time. “There’s no reason someone couldn’t modify this to scan for more bash bug servers and install itself,” Wysopal says. “That’s definitely going to happen.”
– With popularity comes some nasty bugs for the unwary: A Trojan known as "Sabpab" is the latest piece of malware infesting Macs, according to security firm Sophos. The malware is spreading through a weakness in Java and through an infected Word document purporting to be a statement from the Dalai Lama, reports MSNBC. Like others of its kind, Sabpab enables hackers to steal personal information and send remote commands to computers. The spread of Sabpab comes soon after warning about the "Flashback" malware believed to have infected up to 600,000 Macs. Experts say these kinds of attacks tend to come in waves, so there may be many more Mac viruses on the way. "Although there's no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," writes Greg Cluley at Sophos. "Mac users—please get an anti-virus, for goodness sake."