14 DAY TRIAL // A security alert from Intego reveals that Mac users are being targeted by newly found malware that poses as a Flash Player installer package.
The news comes just days after the discovery of a new Mac Trojan, and around the same time Softpedia posted a short interview with Sophos’ senior technology consultant, Graham Cluley, discussing matters of Mac security (available here).
Apparently the Austin, Texas-based Intego is the first to report on a new piece of Mac malware that disguises itself as an Adobe Flash Player installer.
“Intego has discovered a new Trojan horse, Flashback, which masquerades as a Flash Player installer. This Trojan horse has been found in the wild, and has some disturbing actions,” says the security firm.
The malware was actually ‘discovered’ by a user who handed Intego a sample, after downloading it from a malicious web site, as the company itself outlines.
The malicious software sends vital information back to its author, but only if the Mac user takes several actions that can ultimately lead to code injection. Intego explains:
Users visiting certain malicious websites may see a link or an icon to download and install Flash Player. Since Mac OS X Lion does not include Flash Player, some users may be fooled and think this is a real installation link. When they click the link, an installation package downloads, and, if the user is using Safari as their web browser, the Mac OS X Installer will launch. (Safari considers installer packages, with .pkg or .mpkg extensions, to be “safe” files and will launch them after download, if default settings are used.)
If the user proceeds with the installation procedure, the installer for this Trojan horse will deactivate some network security software […] and, after installation, will delete the installation package itself. The malware installs a dyld (dynamic loader) library and auto-launch code, allowing it to inject code into applications the user launches. This code, installed in a file at ~/Library/Preferences/Preferences.dylib, connects to a remote server, and sends information about the infected Mac to this server: this includes the computer’s MAC address, a unique identifier. This will allow the malware to detect if a Mac is infected.
Intego claims they’ve analyzed the software and determined that users should make sure their Flash Player downloads occur solely on Adobe.com.
They also advise Safari users to take the necessary precautions and disable the browser’s ability to automatically mount or open installer packages that the application deems as “safe”.
Finally, Intego promotes its VirusBarrier X6 program as the best way to stay out of harm’s way, not just for this recently discovered virus, but for many others.
The company notes that the code in this malware specifically targets and deactivates Little Snitch, but has no effect on VirusBarrier X6.
VirusBarrier is commercialware. For those of you who wish to employ free antivirus software, Sophos has you covered.
You can learn more about Intego’s discovery over at their Mac Security Blog.