Mac Botnet : Doctor Web exposes 550 000 strong botnet

[Bonie81]

Doctor Web exposes 550 000 strong Mac Botnet.


Doctor Web—the Russian anti-virus vendor—conducted a research to determine the scale of spreading of Trojan BackDoor.Flashback that infects computers running Mac OS X. Now BackDoor.Flashback botnet encompasses more than 550 000 infected machines, most of which are located in the United States and Canada. This once again refutes claims by some experts that there are no cyber-threats to Mac OS X.

When it comes to viruses and privacy, not a single OS is immune.

Update:-

It seems like Apple has already plugged CVE-2012-0507 security flaw by introducing new version of Java for OS X 10.6 (Snow Leopard) and 10.7 (Lion).

[TreeTops]

I beat you. Reported here: https://forum.videohelp.com/threads/345262-BackDoor-Flashback-39-trojan-infects-Apple-computers

Apr 11, 2012

[aedipuss]

kinda old news. down to maybe 120,000 infected now. but there are different variants being released so the number may go back up. also one estimate put 20% of all macs are "carriers" for windows malware. it doesn't run on the mac it just gets re-distributed.

[johns0]

If it doesn't run on the mac how does it get distributed?

[MOVIEGEEK]

Here's a good read:

http://nakedsecurity.sophos.com/2012/04/24/mac-malware-study/

In related news you can check to see if your DNS has been changed by the trojan:

http://www.dcwg.org/

[Bonie81]

@TreeTops

I beat you. Reported here: https://forum.videohelp.com/threads/3...pple-computers
Apr 11, 2012

Yeh, you did, already on 11th April 2012.

@aedipuss

also one estimate put 20% of all macs are "carriers" for windows malware.

-true, agreed.
of you are on mac OS X, and take away execute permission. Chances, are others will get infected for sure - a perfect carrier.


@johns0

If it doesn't run on the mac how does it get distributed?

Good Question!
I guess the link I provided was Java-Flash-Zombie. So when you play certain video required flash codecs executes Java BackDoor codes, and infection only took place MAC OS X with Java installed. Normally such files do not have permission to execute. I just came know while packet sniffing (analysis) and observed unsolicited data transfer to suspicious hosts.

MAC OS X : Packet Peeper can serve purpose to sniff packet.
Windows : Network Monitor 3.4 and TCPView (sysinternal) can be used for sniffing.

@MOVIEGEEK

Here's a good read:
http://nakedsecurity.sophos.com/2012...malware-study/

In related news you can check to see if your DNS has been changed by the trojan:
http://www.dcwg.org/

thanks for the informative links.
For those who run Home Server : GRC : DNS Nameserver Spoofability Test
Scroll down till bottom of the web page to initiate DNS Spoofability Test.

Thanks to all of you.