{"id":155,"date":"2012-04-05T12:26:05","date_gmt":"2012-04-05T12:26:05","guid":{"rendered":"http:\/\/bene.webtopia.ch\/?p=155"},"modified":"2012-04-05T12:26:05","modified_gmt":"2012-04-05T12:26:05","slug":"flashback-botnet-soll-auf-600-000-macs-installiert-sein","status":"publish","type":"post","link":"https:\/\/bene.webtopia.ch\/?p=155","title":{"rendered":"Flashback-Botnet soll auf 600.000 Macs installiert sein"},"content":{"rendered":"<p>Der folgende Artikel ist von Maclife.de.<\/p>\n<blockquote><p>Verbreitungszahlen f\u00fcr Mac-Schadsoftware sind rar, f\u00fcr die Mac-Malware Flashback hat die russische Antivirus-Firma Dr. Web <a href=\"http:\/\/news.drweb.com\/show\/?i=2341\">jedoch Zahlen<\/a>: Das Botnet soll auf 600000 Macs installiert sein, darunter 274 in Cupertino.<\/p>\n<p>Als Botnet empf\u00e4ngt Flashback Befehle von au\u00dfen und f\u00fchrt sie dann aus. Bisher wurde es laut Dr. Web nicht zum Diebstahl von Passw\u00f6rtern verwendet. Flashback basiert auf einer Sicherheitsl\u00fccke in Java, die vor kurzem von Apple geschlossen wurde &#8211; allerdings nicht f\u00fcr viele \u00e4ltere Systeme, die somit weiterhin gef\u00e4hrdet sind. Die Verbreitung erfolgt \u00fcber JavaScript-Code, der in Webseiten eingebaut wird und ein Java-Applet nachl\u00e4dt, welches dann verschiedene Sicherheitsl\u00fccken in der Java VM ausnutzt.<\/p>\n<p>Flashback sucht auf der Festplatte nach installierter Anti-Viren-Software und holt sich dann beim Kontroll-Server weitere Anweisungen. Die meisten infizierten Macs stehen in den USA. Im Februar soll erstmals Malware aufgetaucht sein, welche die Sicherheitsl\u00fccken in Java ausnutzte.<\/p>\n<p>Das Java-Update f\u00fcr OS X stellt Apple f\u00fcr <a href=\"http:\/\/support.apple.com\/kb\/DL1516\">Snow Leopard<\/a> und <a href=\"http:\/\/support.apple.com\/kb\/DL1515\">Lion<\/a> zur Verf\u00fcgung.<\/p><\/blockquote>\n<p><!--more-->Um eventuell zu kontrollieren ob der eigene Mac betroffen ist, gibt es eine Routine, welche man durchgehen kann:<\/p>\n<div>\n<h2>Disinfection<\/h2>\n<div>\n<p><strong>Manual Removal<\/strong><\/p>\n<p><strong>Caution:<\/strong> Manual disinfection is a risky process; it is recommended only for advanced users. Otherwise, please seek professional technical assistance. F-Secure customers may also contact our <a href=\"http:\/\/www.f-secure.com\/en\/web\/home_global\/support\/contact\">Support<\/a>.<br \/>\n<strong>Manual Removal Instructions<\/strong><\/p>\n<div id=\"articles\">\n<ul type=\"none\">\n<li>1. Run the following command in Terminal:\n<p>defaults read \/Applications\/Safari.app\/Contents\/Info LSEnvironment<\/li>\n<li>2. Take note of the value, DYLD_INSERT_LIBRARIES<\/li>\n<li>3. Proceed to step <strong>8<\/strong> if you got the following error message:\n<p>&#8222;The domain\/default pair of (\/Applications\/Safari.app\/Contents\/Info, LSEnvironment) does not exist&#8220;<\/li>\n<li>4. Otherwise, run the following command in Terminal:\n<p>grep -a -o &#8218;__ldpath__[ -~]*&#8216; <strong>%path_obtained_in_step2%<\/strong><\/li>\n<li>5. Take note of the value after &#8222;__ldpath__&#8220;<\/li>\n<li>6. Run the following commands in Terminal (first make sure there is only one entry, from step 2):\n<p>sudo defaults delete \/Applications\/Safari.app\/Contents\/Info LSEnvironment<\/p>\n<p>sudo chmod 644 \/Applications\/Safari.app\/Contents\/Info.plist<\/li>\n<li>7. Delete the files obtained in steps 2 and 5<\/li>\n<li>8. Run the following command in Terminal:\n<p>defaults read ~\/.MacOSX\/environment DYLD_INSERT_LIBRARIES<\/li>\n<li>9. Take note of the result. Your system is already clean of this variant if you got an error message similar to the following:\n<p>&#8222;The domain\/default pair of (\/Users\/joe\/.MacOSX\/environment, DYLD_INSERT_LIBRARIES) does not exist&#8220;<\/li>\n<li>10. Otherwise, run the following command in Terminal:\n<p>grep -a -o &#8218;__ldpath__[ -~]*&#8216; <strong>%path_obtained_in_step9%<\/strong><\/li>\n<li>11. Take note of the value after &#8222;__ldpath__&#8220;<\/li>\n<li>12. Run the following commands in Terminal:\n<p>defaults delete ~\/.MacOSX\/environment DYLD_INSERT_LIBRARIES<\/p>\n<p>launchctl unsetenv DYLD_INSERT_LIBRARIES<\/li>\n<li>13. Finally, delete the files obtained in steps 9 and 11.<\/li>\n<\/ul>\n<\/div>\n<p><strong>Note:<\/strong><\/p>\n<p>Some Flashback variants include additional components, which require additional steps to remove. Please refer to our <a href=\"http:\/\/www.f-secure.com\/v-descs\/trojan-downloader_osx_flashback_k.shtml\">Trojan-Downloader:OSX\/Flashback.K<\/a> description for additional information and removal instructions.<\/p>\n<h2>Additional Details<\/h2>\n<p>Trojan-Downloader:OSX\/Flashback.I is dropped by malicious Java applets that exploit the known <a href=\"http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2011-3544\">CVE-2011-3544<\/a> vulnerability.<\/p>\n<p>On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done.<\/p>\n<p>If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Installation<\/strong><\/p>\n<p>On execution, the malware checks if the following path exists in the system:<\/p>\n<div id=\"articles\">\n<ul>\n<li>\/Library\/Little Snitch<\/li>\n<li>\/Developer\/Applications\/Xcode.app\/Contents\/MacOS\/Xcode<\/li>\n<li>\/Applications\/VirusBarrier X6.app<\/li>\n<li>\/Applications\/iAntiVirus\/iAntiVirus.app<\/li>\n<li>\/Applications\/avast!.app<\/li>\n<li>\/Applications\/ClamXav.app<\/li>\n<li>\/Applications\/HTTPScoop.app<\/li>\n<li>\/Applications\/Packet Peeper.app<\/li>\n<\/ul>\n<\/div>\n<p>If any of these are found, the malware will skip the rest of its routine and proceed to delete itself.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Downloading the Payload<\/strong><\/p>\n<p>The malware connects to the following URL to download its payload:<\/p>\n<div id=\"articles\">\n<ul>\n<li>h t t p : \/ \/ 95.215.63.38\/counter\/%encoded_data%\n<p>Where decoded data follows this format:<\/p>\n<ul>\n<li>%hardware_UUID|%machine_architecture%|%kernel_version%|%encoded_data2%|<br \/>\n%architecture_of_malware_process%|%current_hardware_type_of_system%|%is_user_daemon%<\/p>\n<ul>\n<li>%encoded_data2% is the MD5 hash of the following:\n<ul>\n<li>%hardware_UUID%Jiangxi<\/li>\n<\/ul>\n<\/li>\n<li>%is_user_daemon% is &#8222;1&#8220; if the process is running as the first OS X user account or daemon &#8222;0&#8220; otherwise<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<p>&nbsp;<\/p>\n<p>The filename and actual content of the payload depends on reply of the remote host. The reply is compressed and encrypted but the actual content follows this format:<\/p>\n<div id=\"articles\">\n<ul>\n<li>%encoded_filename%|%encoded_binary1_content%|%encoded_payload_config%| %encoded_binary2_content%|%encoded_png_content%\n<p>Where:<\/p>\n<ul>\n<ul>\n<li><em><strong>Binary 1<\/strong><\/em>\n<p>Binary1 is more or less the malware&#8217;s main component. In the sample that we analyzed, it hijacks CFReadStreamRead and CFWriteStreamWrite by creating an interposition to these functions. The malware modifies contents returned or send by these APIs. It targets the contents of specific webpages, as determined by config information returned by the remote host.<\/li>\n<\/ul>\n<\/ul>\n<ul>\n<li><em><strong>Binary 2<\/strong><\/em>\n<p>Binary2 is basically a filter component that will load binary1 only into a targeted process. This is to avoid crashing incompatible applications and raising the user&#8217;s suspicions. In the sample that we analyzed, it targets the Safari web browser.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<p>&nbsp;<\/p>\n<p><strong>Infection<\/strong><\/p>\n<p>Only after downloading the payload does Flashback.I proceed with infecting the machine. To do so, the malware prompts for the administrator password, as in the following screenshot:<\/p>\n<p>&nbsp;<\/p>\n<div align=\"center\"><img decoding=\"async\" src=\"http:\/\/www.f-secure.com\/virus-info\/v-pics\/trojan-downloader_osx_flashback_i_passwordprompt.jpg\" alt=\"Trojan-Downloader:OSX\/Flashback.I prompt\" \/><\/div>\n<p>The icon indicated by the red box in the screenshot is the PNG content returned by the remote host. This is dropped to the location &#8218;\/tmp\/.i.png&#8216; on the system. Since this image is controlled by the remote host, it can be changed any time the author deems necessary.<\/p>\n<p>Whether or not the user inputs their administrator password at the prompt determines the type of infection the malware subsequently performs:<\/p>\n<p>&nbsp;<\/p>\n<p><strong><em>Infection Type 1<\/em><\/strong><\/p>\n<p>If the user inputs their administrator password, the malware will create the following files:<\/p>\n<div id=\"articles\">\n<ul>\n<li><strong>\/Applications\/Safari.app\/Contents\/Resources\/.%decoded_filename%.png<\/strong> &#8211; contains %decoded_binary1_contents% and %decoded_payload_config%<\/li>\n<li><strong>\/Applications\/Safari.app\/Contents\/Resources\/.%decoded_filename%.xsl<\/strong> &#8211; contains %decoded_binary2_contents%<\/li>\n<\/ul>\n<\/div>\n<p>The malware then creates a launch point, inserting the following line into &#8222;\/Applications\/Safari.app\/Contents\/Info.plist&#8220;:<\/p>\n<div id=\"articles\">\n<ul>\n<li>&lt;key&gt;LSEnvironment&lt;\/key&gt;&lt;dict&gt;&lt;key&gt;DYLD_INSERT_LIBRARIES&lt;\/key&gt;<br \/>\n&lt;string&gt;\/Applications\/Safari.app\/Contents\/Resources\/.%decoded_filename%.xsl&lt;\/string&gt;&lt;\/dict&gt;<\/li>\n<\/ul>\n<\/div>\n<p>This in effect will inject binary2 into Safari when the browser is launched.<\/p>\n<p>If the malware was able to infect the system this way, it reports success to the following URL:<\/p>\n<div id=\"articles\">\n<ul>\n<li>h t t p :\/\/95.215.63.38\/stat_d\/<\/li>\n<\/ul>\n<\/div>\n<p>If it failed to infect the system, the malware reports to the following URL:<\/p>\n<div id=\"articles\">\n<ul>\n<li>h t t p :\/\/95.215.63.38\/stat_n\/<\/li>\n<\/ul>\n<\/div>\n<p>&nbsp;<\/p>\n<p><strong><em>Infection Type 2<\/em><\/strong><\/p>\n<p>In cases where the user did not input their administrator password, the malware checks if the following path exists in the system:<\/p>\n<div id=\"articles\">\n<ul>\n<li>\/Applications\/Microsoft Word.app<\/li>\n<li>\/Applications\/Microsoft Office 2008<\/li>\n<li>\/Applications\/Microsoft Office 2011<\/li>\n<li>\/Applications\/Skype.app<\/li>\n<\/ul>\n<\/div>\n<p>If any of these are found, the malware again skips the rest of its routine and proceeds to delete itself, presumably to avoid infecting a system that has an incompatible application installed.<\/p>\n<p>If none of the incompatible applications are found, the malware will create the following files:<\/p>\n<div id=\"articles\">\n<ul>\n<li><strong>~\/Library\/Application Support\/.%decoded_filename%.tmp<\/strong> &#8211; contains %decoded_binary1_contents% and %decoded_payload_config%<\/li>\n<li><strong>\/Users\/Shared\/.libgmalloc.dylib<\/strong> &#8211; contains %decoded_binary2_contents%<\/li>\n<\/ul>\n<\/div>\n<p>The malware then creates a launch point by creating &#8222;~\/.MacOSX\/environment.plist&#8220;, containing the following lines:<\/p>\n<div id=\"articles\">\n<ul>\n<li>&lt;key&gt;DYLD_INSERT_LIBRARIES&lt;\/key&gt;<br \/>\n&lt;string&gt;\/Users\/Shared\/.libgmalloc.dylib&lt;\/string&gt;<\/li>\n<\/ul>\n<\/div>\n<p>This in effect will inject binary2 into every application launched by the infected user.<\/p>\n<p>For this infection type, the malware reports the successful infection to the following URL:<\/p>\n<div id=\"articles\">\n<ul>\n<li>h t t p : \/ \/ 95.215.63.38\/stat_u\/<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Der folgende Artikel ist von Maclife.de. Verbreitungszahlen f\u00fcr Mac-Schadsoftware sind rar, f\u00fcr die Mac-Malware Flashback hat die russische Antivirus-Firma Dr. Web jedoch Zahlen: Das Botnet soll auf 600000 Macs installiert sein, darunter 274 in Cupertino. Als Botnet empf\u00e4ngt Flashback Befehle von au\u00dfen und f\u00fchrt sie dann aus. Bisher wurde es laut Dr. Web nicht zum [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[11],"tags":[],"class_list":["post-155","post","type-post","status-publish","format-standard","hentry","category-edv-ecke"],"_links":{"self":[{"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/posts\/155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=155"}],"version-history":[{"count":2,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/posts\/155\/revisions"}],"predecessor-version":[{"id":157,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=\/wp\/v2\/posts\/155\/revisions\/157"}],"wp:attachment":[{"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bene.webtopia.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}