Mac Malware at the Moment

It's been a while since we last wrote about Mac malware, so I thought it would be good to give our readers an update on what's been happening during the last few months. Last year we detailed a possible Mac trojan in the making. At that time we were still speculating whether it would be part of a bundle or just a standalone binary. Now it's clear: a new variant was discovered and it is a full-blown application, complete with an icon.

The author calls this variant version 1.0 ("FILEAGENTVer1.0" in little-endian) as seen from the binary's code:



The sample I analyzed uses thumbnail images/icons of Irina Shayk, apparently taken from the March 2012 issue of FHM (South Africa) magazine. The malicious application bundle is being spread inside an archive file together with other images taken from the magazine hoping that its file type will be overlooked by users.



Nothing else is new besides the implementation. The backdoor payload is still the same but uses a new C&C server. The server is currently active (at time of publication). It is important to take note that the new C&C server still points to the same IP address as the previous variant as mentioned by the folks at ESET. We have reported the server to CERT-FI. Hopefully they will be able notify the proper authorities.

We detect this new variant as Trojan-Dropper:OSX/Revir.C, MD5: 7DBA3A178662E7FF904D12F260F0FFF3.

Moving along — there's another more serious OS X malware threat lurking out there. The Flashback trojan, which first appeared around the same time as Revir, is still in the wild. It is using exploits to infect systems without user interaction. Though what it's exploiting are old Java vulnerabilities (CVE-2011-3544 and CVE-2008-5353), we might begin seeing a real OS X outbreak if the gang upgrades their operation a notch higher and start targeting unpatched vulnerabilities.

In a future post, I will detail how to locate a Flashback infection. In the meantime, the easiest way to avoid infection is to just disable Java from your browser(s). Based on our surveys, most users don't really need Java when browsing the Web. If for some reasons you do need Java, say for online banking, turn it on only when you need it. And then turn it off again after you're done.

In Safari, you can disable Java by unchecking "Enable Java" in Safari Preferences, Security tab.



Or you can disable Java from the Snow Leopard (Lion doesn't come with Java by default) by going to Applications, Utilities, Java Preferences. Uncheck everything in the General tab.



Regards,
Brod

Adobe releases Flash-like HTML5 design tool Adobe Edge

Adobe Systems today announced the first public preview release of Adobe Edge, a new HTML5 web motion and interaction design tool available for free on labs.adobe.com for Mac and Windows. Web designers can use the tool to bring animations, similar to those created in Flash Professional, to websites using standards likes HTML, JavaScript, and CSS.

Because HTML5 is a moving standard, Adobe says it is adopting an open development methodology for Adobe Edge. For now, this means the company is releasing the software on the Adobe Labs website sooner than it would during a normal development process in order to allow user feedback to help shape the final product. Adobe Edge is not yet even considered in beta. It is being designed as a fast and lightweight professional-grade tool that complements Adobe's existing Web tools, such as Adobe Dreamweaver CS5.5, Adobe Flash Professional CS5.5, and Adobe Flash Builder 4.5.

The preview enables you to add motion to existing HTML documents without hampering design integrity of CSS-based layouts, and it also allows you to create visually rich content from scratch, using familiar drawing tools that produce HTML elements styled with CSS3. You can import standard Web graphics assets such as SVG, PNG, JPG, and GIF files and style them using CSS3. The design stage utilizes WebKit to enable design, preview, and manipulation of content. The timeline feature lets you define and customize motion applied to HTML elements. Content created with Edge is designed to work on modern browsers including those on Android, BlackBerry Playbook, iOS , HP webOS, and other smartphone mobile devices as well as Firefox, Google Chrome, Safari, and Internet Explorer 9.

"Over the last year Adobe has delivered on several significant HTML5 milestones including contributions to jQuery, submitting code to WebKit, and enhanced HTML5 output in Creative Suite 5.5," Paul Gubbay, vice president of Design and Web Engineering at Adobe, said in a statement. "Now, with Adobe Edge, we're taking our HTML5 tooling to a whole new level and look forward to getting some really useful feedback from the community over the next few months, as we refine the product."