Flashback Trojan on Macs

Posted on: April 10th, 2012

I just heard about the news that allegedly a good portion of Apple Mac computers got infected by a trojan called Flashback. I’d like to provide you with some information and background on this. [Since the numbers of infected machines are just a wild guess, I'm not going to repeat it. My purpose is not to scare people but to provide usable information. Knowing how the media works they picked the highest number of all estimations.]

[Update: Apr 23, 2012: So far we have not seen or heard of a single infected Mac machine. So my assumption was correct about this being blown out of proportion.]

The most important thing is knowing what to do if you have a Mac: The first thing you should do is apply the updates from Apple. – Click on the little apple on the top left corner of the screen and click on Software update.

So far there are only one removal tool I could found that was made to deal with this outbreak. Here’s the link to it:
http://www.macupdate.com/app/mac/42571/anti-flashback-trojan
There are also “simple” instructions on checking and removing:
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtml
If you feel adventurous then you can try following the instructions.

And of course, if you are not comfortable doing either of them you can contact us to check out your machine for the presence of this virus and to remove it, if it’s there.

What this infection do?

Flashback’s purpose is to create a pool of remotely controllable machines which then could be used for illicit activities such as sending out spam, sending overwhelming amount of requests to certain websites to take them down (Denial of Service Attack), etc.
Apparently, it does not harm the computer or steal personal information but it could slow down the computer and because it makes your computer a tool of online criminals you probably don’t want it on your machine.

How was it able to spread?

It is interesting to note that the outbreak of this infection was made possible by human negligence, specifically on the part of Apple. The vulnerability that allowed Macs to get infected just by visiting an infected website was in a component called Java (we have an article on What is Java). That vulnerability was fixed in Java more than 1 month ago. However, Apple didn’t include that in their updates until just a few days ago. That long delay allowed the creators of this virus to spread it pretty easily. Hopefully, this will be a wake up call for Apple and they will get on the ball with the updates in the future.

Do I Need an Antivirus Now?

This is an inevitable question at this point. Macs did very well without any kind of antivirus because they were rarely target of virus attacks, mainly due to their small market share (only a few percent of personal computers are Macs). As far as I know this is the first infection that made any headlines. So it’d be probably too early to jump the gun and slow down your nicely running Mac with a hefty antivirus software. However, make sure that you do keep your Mac updated and follow the common sense precautions, such as:
- Don’t download attachments or click on any link from spam, or any suspicious email
- Don’t download any files from websites that you don’t trust, even if they claim something like “you need to update your flash player”.

This one incident is still the exception, rather than the rule. PCs are subject to thousands of viruses, Macs have a few. So it’s still much, much safer to go online if you have a Mac.

Did you find this information useful?
Please consider donating.