Kaspersky Confirms Widespread Mac Infections Via Flashback Trojan | News & Opinion

Kaspersky Confirms Widespread Mac Infections Via Flashback Trojan

Security firm Kaspersky Lab today weighed in on the Flashback Trojan controversy, confirming that the flaw likely infected more than half a million Macs.

In a blog post, Kaspersky Lab expert Igor Soumenkov said the firm analyzed the latest variant of the botnet - dubbed Flashfake - to try and nail down where the infected computers resided and how many were affected.

"We reverse engineered the first domain generation algorithm and used the current date, 06.04.2012, to generate and register a domain name, 'krymbrjasnof.com,'" Soumenkov wrote. "After domain registration, we were able to log requests from the bots. Since every request from the bot contains its unique hardware UUID, we were able to calculate the number of active bots."

Kaspersky's analysis saw more than 600,000 unique bots connect to its servers in less than 24 hours, using a total of 620,000 external IP addresses. More than 50 percent came from the United States.

That's in line with Wednesday data from anti-virus firm Doctor Web, which said that about 550,000 Macs were likely infected by the Java flaw, known as the Flashback Trojan.

Approximately 300,917 of the active bots were located in the U.S., followed by 94,625 in Canada, 47,109 in the U.K., and 41,600 in Australia, Kaspersky said. A smaller number of devices in France, Italy, Mexico, Spain, Germany, and Japan were also affected.

Soumenkov said Kaspersky could not confirm or deny that all the bots were running Mac OS X, but the firm was able to get a "rough estimation" using passive OS fingerprinting techniques.

"More than 98 percent of incoming network packets were most likely sent from Mac OS X hosts," he wrote. "Although this technique is based on heuristics and can't be completely trusted, it can be used for making order-of-magnitude estimates. So, it is very likely that most of the machines running the Flashfake bot are Macs."

Yesterday, Apple issued a second update to address this issue, though it did not appear to be too in depth.

Security experts are suggesting that Mac users, particularly those on older versions of OS X, update their software as soon as possible. For the technically inclined, F-Secure also has instructions on how to locate a Flashback infection.

How to check your Mac new virus alert

Mac Flashback Trojan: Find Out If You're Infected and What to Do About It

Apple computer users may think they have nothing to worry about when it comes to contracting viruses and malware online, but a Russian antivirus company is reporting that 600,000 Macs are currently infected with a nasty trojan horse virus called "Flashback."

Doctor Web issued a report on Wednesday that said 550,000 computers with Mac OSX have picked up the virus. An analyst at Doctor Web later sent a tweet noting that 600,000 Mac computers have actually been infected and some — about 274 — are actually based in the same city as Apple's headquarters, Cupertino, Calif. About 57% of the infected Macs are said to be in the U.S. and 20% are based in Canada.

Flashback was originally discovered in September 2011 and was designed to disguise itself as an Adobe Flash Player installer, using Flash player logos. After installing Flashback, the malware seeks out user names and passwords that are stored on your Mac.

"There are no visible symptoms for this Mac virus, except for making sporadic connections to unknown servers that can be only seen in the Firewall logs, if any firewall is in place," Boris Sharov, CEO of Doctor Web, told Mashable. "The symptoms also depend on the payload that may be downloaded upon the command from the control server."

Although Sharov said it's difficult to prevent contracting the virus, it's not impossible.

"The bad thing about these types of infections is that it is hard to prevent them without disconnecting one's computer from the Internet all together," Sharov said. "We advise Mac users to strictly follow Apple's security updates. Don't neglect them."

To protect your computer from contracting the virus now, download Apple's latest software update. Click the Apple logo located in the top-left section of the desktop and select Software Update. Install all of the available updates as soon as possible.

"Unfortunately, the number of infected computers is still increasing," Sharov said. "This means that users are careless about security patches, and they shouldn't be."

Sharov also advised Mac users to install anti-virus software, even though many think it's unnecessary to do so for Apple computers.

Although symptoms are minimal, there are a few things you can do to see if you are infected. Sharov suggests the following steps (note: we posted the html below as an image so you could read the full code):

• Go to the Mac's Library folder and select LaunchAgents. There should be several files in that catalog.
• Search all files in the folder for the following contents:
  
  

• Look for the file name specified in the ProgramArguments key. This is where the file BackDoor.Flashback.39 would be located. If the file is empty, it means that none of your programs are meant to start automatically. It also means that you are not infected.
• To see if this is the trojan, scan it with anti-virus software for Mac OS or upload it to VirusTotal website.
• To cure the machine, delete both files.
• Removing the files should restore your computer.

Instead of following those steps, Sharov said you could also run a scan by downloading the free Dr. Web Light from the Apple App Store.

The news comes after Apple continues to position OS X as a more secure alternative to other computer makers.

"A Mac isn't susceptible to the thousands of viruses plaguing Windows-based computers," Apples notes on its homepage. "That's thanks to built-in defenses in Mac OS X that keep you safe, without any work on your part."

Mac Trojan info

Find Out if Your Mac Has the Flashback Trojan — the Fast and Easy Way

According to a report Thursday, more than 600,000 Macs could be infected with the nasty Flashback trojan.

We've already detailed how to check your Mac to see if you're infected— but that requires some command line code, and we know that not all users are comfortable doing that.

Now we've gone one step further and wrapped those commands into two AppleScripts.

Why two? Well, there are actually two areas of your hard drive that need to be checked for nasty files.

These files simply run the terminal commands and let users know if they have anything to worry about. They aren't the most beautiful creations, but they do the job.

You can download the scripts here (hosted by CloudApp). After unzipping, simply double-click on "trojan-check" and "trojan-check-2."

If you get an image that looks like the image below, you're in the clear.

If either of the scripts reports something other than "does not exist," go to F-Secure's website and follow their removal instructions.

Even if you aren't infected, make sure you install the latest Apple security update for Java to fix the vulnerability that allowed this nasty exploit to exist in the first place.

Did you find yourself infected? Let us know in the comments.

Edit hosts file on Mac OSX Lion

How to edit the hosts file in Mac OS X Lion: http://appzdev.com/mac-iphone-blog/2011/07/how-to-edit-the-hosts-file-in-mac-os-x-leopardlion/

Messages Beta for Mac. Download here!

Download Messages Beta and get a taste of what’s coming in OS X Mountain Lion. When you install Messages, it replaces iChat. But iChat services will continue to work. And Messages brings iMessage to the Mac — just like on iPad, iPhone, and iPod touch running iOS 5. Here are the features you can expect with Messages:

• Send unlimited iMessages to any Mac, iPad, iPhone, or iPod touch.*
• Start an iMessage conversation on your Mac and continue it on your iPad, iPhone, or iPod touch.
• Send photos, videos, attachments, contacts, locations, and more.
• Launch a FaceTime video call and bring the conversation face-to-face.
• Messages supports iMessage, AIM, Yahoo!, Google Talk, and Jabber accounts.

Download Messages Beta for Mac

How to Get the Best Features of Mac OS X Mountain Lion Right Now

How to Get the Best Features of Mac OS X Mountain Lion Right Now

This morning, Apple announced the next version of Mac OS X, dubbed Mountain Lion, is scheduled to be available at the end of summer. It's filled with cool new features, but who wants to wait until this summer to get them? Here's how you can get the best features of Mountain Lion right now.

Messages

Messages is a little like iChat, but it lets you send messages to iOS devices via iMessage, and if you have Mac OS X 10.7.3 on your computer, you can actually start using the Messages beta today. Just download it, install it, and start keeping your messages in sync across all your Apple devices.

Notification Center

You've probably seen Notification Center on iOS 5 as it was probably the most-desired feature lacking from Apple's mobile operating system. It provides a more subtle notification system on your mobile device and a pulldown list to see your current notification history. A similar feature will be available as part of Mac OS X Mountain Lion. Although Apple's Notification Center for the desktop is going to be a far more robust, most of us currently use Growl for notification banners. Growl will cost you a few dollars if you want the latest version, but you can download an older copy for free. The advantage of paying is that the latest version (only available for Mac OS X Lion 10.7 or later) includes a feature called Rollup, which is essentially the same as Notification Center. (See the screenshot to the right for an example.) It saves your notifications in a little window so you can see what you missed while you were away.
Growl is limited by what can send it messages, however, so you won't receive notifications for things like SMS and calls. If you're a Google Voice user you can get those notifications by installing an app like GrowlVoice ($5) or BigPhone ($5 / Free). These apps not only let you get call and text notifications on your computer, but let you respond to both as well.

AirPlay Mirroring

AirPlay Mirroring takes whatever is on your Mac's screen and wirelessly mirrors it on your television (via an Apple TV) or any other device that can receive an AirPlay transmission. You can do this right now with an app called AirParrot ($10). It provides the exact same functionality. If you want to take things a step further than Mountain Lion can offer, then you'll also want to check out AirServer. This app will let you receive AirPlay signals on your Mac so you can send video from other devices, like your iPhone or iPad, and watch them on the computer.

GateKeeper

GateKeeper is Apple's attempt at preventing malware on your Mac, and it does this by letting you decide which kinds of apps are allowed to run and which apps are not. You can run any app you download (the way things currently work in Lion), only allow Mac App Store apps or apps signed with an official Apple developer ID to run, or just allow apps downloaded directly from the Mac App Store to run. Obviously you can currently run all apps or just Mac App Store apps right now, without any fancy features, but the developer ID check is definitely something new. While we believe that you'll be just fine if you're diligent, there is malware protection and antivirus software for your Mac should you want to play it extra safe right now.

iCloud

iCloud—Apple's service that syncs all your information to the cloud and across devices—is already a part of Mac OS X, but the integration is deeper in Mountain Lion. One of the features Apple is touting in the iCloud upgrade is document sync, allowing you to access your documents across multiple computers and mobile devices. You can have that right now with InSync and a Google Docs account. InSync lets you access all your Google Docs files directly from your desktop and keeps them in sync with the online version as well as any other computers. Of course, there's also Dropbox. It's not exactly the same thing, but it will keep your documents in sync and we do love it a lot.

Share Sheets

Share Sheets is a feature that essentially places a drop-down menu in your browser (and a few other apps) so you can easily share media with others through various services. You can achieve this same effect in any web browser by creating a folder of bookmarklets—little pieces of JavaScript that perform simple functions. For example, bookmarklets exist to save an article to Instapaper or Read It Later, share on Facebook or Twitter, send an image to Flickr, send a web page as an email, and much more. There are so many bookmarklets nowadays that you really just have to search for what you want to accomplish with the word "bookmarklet" after it and you'll have it. As a result, you can build out your own Share Sheet-esque bookmarklet folder with more functionality than Mountain Lion will be able to provide.

Notes

Notes is Apple's addition of a syncing notes application to Mac OS X, but there's absolutely no reason to wait for Mountain Lion to get this functionality when Notational Velocity, using the Simplenote service, already provides this exact functionality. In fact, Simplenote is so well done that you'll probably continue to use it after you get your hands on Apple's official syncing notes application. Simplenote has apps for iOS, Android, and Windows so you have the additional advantage of using any platform you want. If you want to use rich text and images, try Evernote instead.

Reminders

Reminders is just a simple to-do app, and there are plenty of those to go around on Mac OS X already. Our favorite is Wunderlist, which is a slightly more robust task management app that works on multiple platforms so you're not syncing your to-dos with just your Mac. You can have them on your iPhone, iPad, Android, Windows computer as well. It also works in your web browser, providing access just about anywhere.

iTunes 10.5.2 Update for Mac. What new features does it have?

Here's what's new in iTunes 10.5.2

iTunes 10.5.2 includes several improvements for iTunes Match and fixes an audio distortion problem when playing or importing certain CDs.

iTunes 10.5.1 included:

• iTunes Match. Store your entire music library in iCloud, including music you've imported from CDs, and enjoy your collection anywhere, anytime, on your iPhone, iPad, iPod touch, computer, or Apple TV. 

• iTunes in the Cloud. iTunes now stores your music and TV purchases in iCloud and makes them available on your devices anywhere, any time, at no additional cost.

• Automatic Downloads. Purchase music from any device or computer and automatically download a copy to your Mac, PC and iOS devices. 

• Download Previous Purchases. Download your past music, TV, app, and book purchases again, at no additional cost. Previous purchases may be unavailable if they are no longer on the iTunes Store.

• Sync with your iPhone, iPad, or iPod touch with iOS 5.

• Wi-Fi Syncing. Automatically sync your iPhone, iPad, or iPod touch with iTunes any time they're both on the same Wi-Fi network.

How to shorten a long URL on a Mac

Want to create a short and quick URL from a long one?  


Here's a great and free tool called ShortURL that I really love:  http://itunes.apple.com/us/app/short-url/id416374001?mt=12


Here’s what I do: Let’s say I want to share a link on Twitter, or send it in an email but it's a very long URL like this:  http://iphoneappzdev.blogspot.com/p/iphone-development.html


With this tool, you can just copy the long URL and click 'Shorten' and it quickly turns into this:  http://bit.ly/mUZXe5  

How to edit the hosts file in Mac OS X – Leopard and Lion

How to edit the hosts file in Mac OS X – Leopard and Lion

 Introduction

The hosts file is a text file that maps hostnames to IP addresses.
Upon typing a url address on the browser, the system is checking if there is a relevant entry on the hosts file and gets the corresponding IP address, else it resolves the IP via the active connection’s DNS servers.

The hosts file can be edited to block certain hostnames (like ad-serving/malicious hosts), or used for web development purposes, i.e. to redirect domains to local addresses.

Editing the hosts file

Editing the hosts file in Mac OS X – Leopard, is a pretty easy task, especially if you are familiar with the terminal.

Step 1 – Open the Terminal.app

Either by start typing Terminal on the Spotlight, or by going into Applications -> Utilities -> Terminal.

Step 2 – Open the hosts file

Open the hosts by typing on the Terminal that you have just opened:

Copy this and paste:

sudo nano /private/etc/hosts

Type your user password when prompted.

Step 3 – Edit the hosts file

The hosts file contains some comments (lines starting with the # symbol), as well as some default hostname mappings (e.g. 127.0.0.1 – localhost).
Simply append your new mappings underneath the default ones. Or edit one of the default values if you know what you are doing!
You can navigate the file using the arrow keys.

Step 4 – Save the hosts file

When done editing the hosts file, press control-o to save the file.
Press enter on the filename prompt, and control-x to exit the editor.

Step 5 – Flush the DNS cache

On Leopard you can issue a simple Terminal command to flush the DNS cache, and have your host file changes to take immediate effect:

dscacheutil -flushcache

You can now test your new mapping on the browser!

How to edit the hosts file in Mac OS X Leopard/Lion

How to edit the hosts file in Mac OS X – Leopard and Lion


Introduction
The hosts file is a text file that maps hostnames to IP addresses.
Upon typing a url address on the browser, the system is checking if there is a relevant entry on the hosts file and gets the corresponding IP address, else it resolves the IP via the active connection’s DNS servers.
The hosts file can be edited to block certain hostnames (like ad-serving/malicious hosts), or used for web development purposes, i.e. to redirect domains to local addresses.


Editing the hosts file
Editing the hosts file in Mac OS X – Leopard, is a pretty easy task, especially if you are familiar with the terminal.


Step 1 – Open the Terminal.app
Either by start typing Terminal on the Spotlight, or by going into Applications -> Utilities -> Terminal.


Step 2 – Open the hosts file
Open the hosts by typing on the Terminal that you have just opened:
Copy this and paste:
sudo nano /private/etc/hosts
Type your user password when prompted.


Step 3 – Edit the hosts file
The hosts file contains some comments (lines starting with the # symbol), as well as some default hostname mappings (e.g. 127.0.0.1 – localhost).
Simply append your new mappings underneath the default ones. Or edit one of the default values if you know what you are doing!
You can navigate the file using the arrow keys.


Step 4 – Save the hosts file
When done editing the hosts file, press control-o to save the file.
Press enter on the filename prompt, and control-x to exit the editor.


Step 5 – Flush the DNS cache
On Leopard you can issue a simple Terminal command to flush the DNS cache, and have your host file changes to take immediate effect:
dscacheutil -flushcache


You can now test your new mapping on the browser!  Original Info from AppzDev iPhone Development