14 DAY TRIAL // The same anonymous group thought to be responsible for an attack on Facebook has breached “a small number” of Macs at Apple. The Cupertino giant quickly squashed the malware, which could also affect users in the wild, via a software update.
Apple tells All Things D that the company “has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers.”
“The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers,” Apple says.
The Cupertino mammoth confirms to the WSJ-owned blog that it has “identified a small number of systems within Apple that were infected and isolated them from our network.”
Apple clarified that, so far, “There is no evidence that any data left Apple,” adding that the computer company is “working closely with law enforcement to find the source of the malware.”
Reports say the group of hackers breaching Apple’s Macs is the same one attacking Facebook in a similar manner recently.
Apple provided more clarification regarding the vulnerability to The Loop’s Jim Dalrymple, stating, “Since OS X Lion, Macs have shipped without Java installed, and as an added security measure OS X automatically disables Java if it has been unused for 35 days.”
“To protect Mac users that have installed Java, today we are releasing an updated Java malware removal tool that will check Mac systems and remove this malware if found,” the company said.
Java for Mac OS X 10.6 Update 13 is now available for download on systems running Mac OS X v10.6.8 Snow Leopard. For users of OS X 10.7 (Lion) and later, Java for OS X 2013-001 is available.
According to a technical note on Apple’s Support site, the update “delivers improved security, reliability, and compatibility by updating Java SE 6 to 1.6.0_41.”
The update configures web browsers so that they will no longer run Java applets automatically. This applies to systems that have not already installed Java for Mac OS X 10.6 update 9 or later.
Apple still allows users to re-enable Java applets by clicking the region labeled “Inactive plug-in” on a webpage during their web browsing.
“If no applets have been run for an extended period of time, the Java web plug-in will deactivate,” Apple states.