Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #23756 > unrolled thread

Flashback immunity via ... Xcode?! (and others)

Back to article view | Back to comp.sys.mac.system

Contents

  Flashback immunity via ...  Xcode?! (and others) Rich Gray <devnull@nowhere.invalid> - 2012-04-12 23:48 -0400
    Re: Flashback immunity via ...  Xcode?! (and others) dempson@actrix.gen.nz (David Empson) - 2012-04-13 20:02 +1200

#23756 — Flashback immunity via ... Xcode?! (and others)

According to :
<http://www.informationweek.com/news/security/vulnerabilities/232900223>

Flashback looks for certain software on the victim's machine:
- Little Snitch firewall
- Packet Peeper network protocol analysis software
- Apple's Xcode development tools
- various antivirus products
- Skype
- MS Office

If it finds any of these, it deletes itself, without executing its malicious 
payload.  I guess it was trying to keep a low profile, avoiding 
detection/analysis by geeks.  (Who knows what's up with Skype & MS Office...)

Funny, I never thought of a compiler as an anti-malware tool! ;p

- Rich

[toc] | [next] | [standalone]

#23759

Rich Gray <devnull@nowhere.invalid> wrote:

> According to :
> <http://www.informationweek.com/news/security/vulnerabilities/232900223>
> 
> Flashback looks for certain software on the victim's machine:
> - Little Snitch firewall
> - Packet Peeper network protocol analysis software
> - Apple's Xcode development tools
> - various antivirus products
> - Skype
> - MS Office
> 
> If it finds any of these, it deletes itself, without executing its malicious
> payload.  I guess it was trying to keep a low profile, avoiding 
> detection/analysis by geeks.  (Who knows what's up with Skype & MS Office...)
> 
> Funny, I never thought of a compiler as an anti-malware tool! ;p

Amusement factor aside, this information is misleading. Based on the
detailed description at f-secure.com, it is only the current "payload"
component of Flashback which refuses to install itself if it finds one
of these products.

The initially downloaded "updater" component can still be present and
could activate in future to get a different payload which is not
checking for any of the above products.

In addition, the checks for specific applciations only apply in the case
that the payload prompts for an admin password and the user cancels the
dialog. If the user enters the admin password, the payload is installed
in a different way which doesn't check for these applications.

The reason it is checking for things like Skype and MS Office appears to
be that the method it uses to attach itself to running applications is
not compatible with recent Microsoft applications, so if the payload was
running, these applications would crash, resulting in closer
investigation by the user.

The anti-virus and Little Snitch checks are probably to avoid detection,
though in the case of Little Snitch, the updater downloading the payload
would have already triggered an alert.

The XCode check may be to avoid infecting developer machines, because
developers are more likely to notice this sort of thing and be able to
do something about it.

A local developer I know discovered he had the "updater" component of
Flashback on his computer, but appeared not to have the payload. He has
XCode installed, so I expect what happened is the second stage (payload)
deleted itself due to finding XCode, but the updater component was still
there waiting for future activation.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web