Softpedia >News >Apple >Mac
Softpedia Homepage   

New Mac OS X Malware Exploits Java Vuln

Tibet.A downloads a Java applet when users visit a booby-trapped web page

Mar 30, 2012 11:35 GMT  ·  By
Mac malware
   Mac malware

Mac security specialist Intego is sounding the alarm on a new piece of malware originally discovered (and documented) by AlienVault Labs. Dubbed Tibet.A, the malware takes advantage of a Java vulnerability in Mac OS X.

“A new malware, Tibet.A, has been discovered, taking advantage of a Java vulnerability that has also been used recently by the Flashback malware,” Intego reports. “Tibet.A exploits a vulnerability that is corrected in up-to-date Macs, but that may be accessible if users don’t apply system updates.”

The Austin, Texas-based security vendor informs Mac users that this particular piece of malware downloads a Java applet when visiting a booby-trapped web page. “If the Mac in question does not have Java up to date, the Tibet malware installs a backdoor, in a manner that has become increasingly common,” says Intego.

The malware aims to copy user data, such as user names, passwords and credit card information, and then send it off to its author on some remote server.

“The web pages serving this malware checks to see if the computer loading the page is a Mac or a Windows PC, and serves the appropriate form of the malware,” reads the advisory.

Intego further elaborates on how users can get infected. The company describes one way that users are lured into the infected websites and that is by emails that contain direct links to them.

“In this case, these e-mails have been seen to specifically target Tibetan non-governmental organizations, and this attack may be designed to try and obtain information from these organizations alone,” says Intego, adding that the people at AlienVault Labs have an extensive report about these attacks.

No user interaction is required, if a Mac gets infected, “and no indication that the Mac has been compromised, unless the user is running software that detects outgoing network connections,” Intego reports.

As usual, the security software vendor promotes its VirusBarrier X6 software as being capable of detecting this malware. The threat is labeled as “low” for the time being.