Re: Does the Flashback trojan affect Chrome? Lion?

Date	2012-04-09 16:26 -0400
From	Alan Browne <alan.browne@FreelunchVideotron.ca>
Newsgroups	comp.sys.mac.system
Subject	Re: Does the Flashback trojan affect Chrome? Lion?
References	<2vCdnZ7ns8AN2R3SnZ2dnUVZ_umdnZ2d@giganews.com> <jlsjmc$9hu$1@dont-email.me>
Message-ID	<38CdnYBy05uO2x7SnZ2dnUVZ_gSdnZ2d@giganews.com> (permalink)

Show all headers | View raw

On 2012-04-08 13:59 , Rob Friefeld wrote:
> In article<2vCdnZ7ns8AN2R3SnZ2dnUVZ_umdnZ2d@giganews.com>,
>   Alan Browne<alan.browne@FreelunchVideotron.ca>  wrote:
>
>> Does the Flashback trojan affect Chrome as well?
>> Does the Flashback trojan affect browsers under Lion?
>>
>> I executed this in terminal
>>     defaults read /Applications/Chrome.app/Contents/Info LSEnvironment
>>
>> and got a file does not exist error.  But I'm not sure that's a valid
>> test.  (I just used the same test as for Safari and substituted Chrome).
>
> Yes, it affects Chrome. The problem is Java, not the browser. The latest
> update from Apple is supposed to fix the vulnerability. As for testing
> for affliction, so far so good.
>
> Look at TidBITS:  http://tidbits.com/article/12918
>
>> That said, detection comes down to issuing the following defaults read
>> commands in Terminal (F-Secure suggests only the first and last; the others
>> extend the technique from Safari to Google Chrome, Firefox, and iCab). In
>> each case, if you see ³does not exist² at the end of the response from each
>> command, you are not infected. (The defaults read command is entirely safe ‹
>> it¹s just attempting to determine whether some data exists in the Info.plist
>> file within each application package.)
>
>> defaults read /Applications/Safari.app/Contents/Info LSEnvironment
>> defaults read /Applications/Google\ Chrome.app/Contents/Info LSEnvironment
>> defaults read /Applications/Firefox.app/Contents/Info LSEnvironment
>> defaults read /Applications/iCab\ 4/iCab.app/Contents/Info LSEnvironment
>> defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

Amusing.  The way I edited the command would not have detected it. 
Shame on my for not checking the folder structure for Chrome first. 
OTOH, I don't see how they get the path above from the actual structure.

But, the way that article is written, it is just extending the test to 
Chrome without confirming that any Chrome browser machines were or can 
be infected.  I primarily use Chrome, occasionally Firefox and rarely 
Safari and Opera.

Thanks!




-- 
"I was gratified to be able to answer promptly, and I did.
  I said I didn't know."
                           -Samuel Clemens.

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-07 09:43 -0400
  Re: Does the Flashback trojan affect Chrome?  Lion? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 08:30 -0700
    Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-07 11:46 -0400
      Re: Does the Flashback trojan affect Chrome?  Lion? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 09:04 -0700
        Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-07 13:59 -0400
          Re: Does the Flashback trojan affect Chrome?  Lion? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-07 18:43 -0400
            Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-07 23:01 -0400
              Re: Does the Flashback trojan affect Chrome?  Lion? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-07 23:26 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-08 14:14 -0400
              Re: Does the Flashback trojan affect Chrome?  Lion? Paul Sture <paul@sture.ch> - 2012-04-08 14:12 +0200
              Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-09 16:36 -0400
    Re: Does the Flashback trojan affect Chrome?  Lion? Kurt Ullman <kurtullman@yahoo.com> - 2012-04-07 12:05 -0400
      Re: Does the Flashback trojan affect Chrome?  Lion? Jolly Roger <jollyroger@pobox.com> - 2012-04-07 09:07 -0700
        Re: Does the Flashback trojan affect Chrome?  Lion? Leonard Blaisdell <leoblaisdell@sbcglobal.net> - 2012-04-07 22:32 -0700
          Re: Does the Flashback trojan affect Chrome?  Lion? dempson@actrix.gen.nz (David Empson) - 2012-04-08 23:01 +1200
  Re: Does the Flashback trojan affect Chrome?  Lion? Michelle Steiner <michelle@michelle.org> - 2012-04-07 08:59 -0700
    Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-07 13:56 -0400
      Re: Does the Flashback trojan affect Chrome?  Lion? Michelle Steiner <michelle@michelle.org> - 2012-04-07 11:18 -0700
        Re: Does the Flashback trojan affect Chrome?  Lion? dempson@actrix.gen.nz (David Empson) - 2012-04-08 10:17 +1200
          Re: Does the Flashback trojan affect Chrome?  Lion? Barry Margolin <barmar@alum.mit.edu> - 2012-04-07 19:53 -0400
            Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-07 23:04 -0400
              Re: Does the Flashback trojan affect Chrome?  Lion? Barry Margolin <barmar@alum.mit.edu> - 2012-04-07 23:40 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? dempson@actrix.gen.nz (David Empson) - 2012-04-08 16:32 +1200
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-08 14:18 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Barry Margolin <barmar@alum.mit.edu> - 2012-04-08 17:40 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-08 19:56 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Barry Margolin <barmar@alum.mit.edu> - 2012-04-08 22:36 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-09 00:32 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Paul Sture <paul@sture.ch> - 2012-04-09 09:21 +0200
                Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-09 11:37 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Barry Margolin <barmar@alum.mit.edu> - 2012-04-09 14:48 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-09 15:33 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-09 21:41 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-10 17:36 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-10 23:15 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-09 21:42 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-09 21:37 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-10 17:35 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Wes Groleau <Groleau+news@FreeShell.org> - 2012-04-10 23:19 -0400
                Re: Does the Flashback trojan affect Chrome?  Lion? Paul Sture <paul@sture.ch> - 2012-04-11 10:40 +0200
                Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-10 17:36 -0400
        Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-08 09:07 -0400
  Re: Does the Flashback trojan affect Chrome?  Lion? *Hemidactylus* <ecphoric@hotmail.com> - 2012-04-07 19:05 -0400
    Re: Does the Flashback trojan affect Chrome?  Lion? Tim Streater <timstreater@greenbee.net> - 2012-04-08 00:24 +0100
    Re: Does the Flashback trojan affect Chrome?  Lion? dempson@actrix.gen.nz (David Empson) - 2012-04-08 16:32 +1200
  Re: Does the Flashback trojan affect Chrome?  Lion? Rob Friefeld <someone@verizon.net> - 2012-04-08 10:59 -0700
    Re: Does the Flashback trojan affect Chrome?  Lion? Alan Browne <alan.browne@FreelunchVideotron.ca> - 2012-04-09 16:26 -0400

csiph-web