Mac Flashback Trojan Affecting Thousands: Apple Issues Fix (UPDATE)

UPDATE: On April 5, MacRumors reported that Apple released another update to Java for OS X, called Java for OS X 2012-002. The site also indicates it's still unclear what this newest update actually does, as its support document gives no new information.

Mac security blog Intego explained that Apple may have discovered a minor glitch in the first update it released on April 3 and points out that this latest update seems to only be available for Lion, while the last one was available for both Snow Leopard and Lion.
____

PREVIOUSLY: If you thought your Mac was safe from harmful computer viruses, think again.

Ars Technica reported on April 4 that Trojan BackDoor.Flashback.39, or the "Mac Flashback trojan," has returned with a vengeance in recent weeks, now affecting hundreds of thousands of Apple laptops.

Ars first reported about the issue on April 2, explaining that anti-virus and computer security firm F-Secure had spotted the trojan in action.

Later, on April 4, the site pointed out that it was Russian IT-security solutions vendor Dr. Web that revealed how widespread the problem has become in a post published on the Dr. Web blog earlier on the same day.

"Systems get infected with BackDoor.Flashback.39 after a user is redirected to a bogus site from a compromised resource or via a traffic distribution system," explained Dr. Web. "JavaScript code is used to load a Java-applet containing an exploit."

In response to the problem, Apple released an update on April 3 to patch up the security holes that exist in Java. While all Mac-owners should make sure to update their devices, you can always check to see if your Mac has been infected using your device's Terminal. Directions for this process, as well as for how you can manually disinfect your Mac, have been provided by F-Secure. (You can access the patches via Apple Support, here or here.)

As of April 4, Dr. Web found that more than half of the 555,000 infected computers were in the United States, nearly 20 percent were in Canada and nearly 13 percent were in the United Kingdom.

Malware analyst Sorokin Ivan has since shared that the trojan has now reached 600,000 devices, tweeting the following, later on in the day on April 4:

@mikko, at this moment botnet Flashback over 600k, include 274 bots from Cupertino and special for you Mikko - 285 from Finland

— Sorokin Ivan (@hexminer) April 4, 2012

First signs of the Mac Flashback trojan appeared last September; back then it had masqueraded as malicious links offering installation of Flash Player.

The trojan eventually prompted software company Oracle -- which, according to CNNMoney, has been responsible for Java programming since it acquired Sun Microsystems in 2010 -- to release a Java security update on February 14, more than a month before Apple did.

Mike Geide, senior security researcher at cloud security company Zscaler ThreatLabZ, warned of the importance of keeping your software up to date, no matter what OS you use.

“This latest wave of infections is a wake-up call to Mac users that their system is not immune to threats," Geide said in an emailed statement. "And the need to follow best security practices, such as remaining current with patches, is ubiquitous -- it doesn't matter if you’re using Windows, Mac, or even mobile phone.”

Have you updated your device? Let us know in the comments below!

Related on HuffPost:

From our partners

Comments

[Tammylynn Sipe]

02:35 PM on 09/05/2012

Some one Hacked into The Apple Data bank and got all my info. I cant use my credit cards because some one else is using them. I got a macbookair What can we do about it?

[Customs]

03:02 AM on 07/29/2012

AMD 3.4GHZ, 8GB Corsair RAM 1600Mhz, AMD 6770 and more.
Ahhhhh my good old custom. Cheaper than an iMac by arnound 3 times, yet more powerful.

[vi is better]

01:35 PM on 06/26/2012

Ok. So now for virii, and I use that term loosely, we have Macs - 1, Windows - can't count that high and Linux - 0.

[thirstyderp]

07:28 PM on 04/08/2012

Here's a new app that will check for and remove the offending malware (if found.)

http://macupdate.com/app/mac/42571/anti-flashback-trojan

[jeaninealex]

04:42 PM on 04/08/2012

The comments are interesting to me. It is like Democrats and Republicans fighting - better yet, children. "I have the better computer, ha-ha-ha...." People choose their computers according to their needs. Good for you if you have a MAC and super duper for you if you have a PC. They both have their good points and bad points.

[briantopping]

04:55 PM on 04/08/2012

Indeed. It's really tiring.

[Midnight Son]

11:21 AM on 04/09/2012

They're all PCs.

[MetrointheWoods]

03:09 PM on 04/08/2012

Now those uppity Mac users know how the rest of us feel.

[JohnTheMac]

03:47 PM on 04/08/2012

No, we don't. Really.
To start with, we bought Mac OSX. Period.
Every version was "Ultimate".
We didn't have 6 versions like Pro, Home, etc.
Lately, OSX has been a $29 full package install, not an upgrade price.
Not $129 or whatever your Win7 software costs.

[ca bucky]

12:47 AM on 04/09/2012

I can see your logic, but the biggest problem that I see with it is that Apple has no one else to compete with. Please stop comparing Apple to Microsoft. Apple is a hardware company and that is what they have been known as, and Microsoft is a software company. That is actually like comparing the glass to the drink you stick in it. No one else out there can write the Mac OS except for Apple themselves. Microsoft writes an operating system that they try to make as compatible for many types of computers that they can. I would say that Microsoft tech's job is harder than the Apple tech's job as the Apple tech only need to write it for one type of computer. If you only write for one type of system, yes you can guarantee that it will work with your device, hence giving you the ability to keep the price lower. If Apple has their way of basically wiping out all other computer competition out there, then everybody's computers / tablets / smartphones / mp3 players will all look the same and there will be no individualism.

[ca bucky]

12:55 AM on 04/09/2012

Plus, if you only have to write code for one type of device, then you can claim it as far superior to everybody else. I have heard that argument time and time again that the Apple hardware is by far superior to any other PC out there. If that were the case, then when I run Ubuntu Linux on a MacBook Pro, why to I need many patches to the OS to help it work with Apple's hardware, and yet it can crash on there? I have also seen Windows crash on Apple hardware more often and cause overheating then on PC compatible systems.

If you like the way the house looks when you buy it and don't want to knock down any walls for remodeling, then by all means, stick with the Apple / Mac. If you want to customize the house by knocking down walls and repainting, then go with something else that you are comfortable with.

[briantopping]

04:56 PM on 04/08/2012

You sound like a really pleasant person yourself!

[Seer Clearly]

03:01 PM on 04/08/2012

Strange - my software update function never told me there was a critical patch available. With Microsoft, I expected (sometimes near daily) emergency patch alerts. Yet, when I checked for updates, the patch was there. Is this any way to address security?

[briantopping]

04:58 PM on 04/08/2012

It's a setting in System Preferences -> Software Update. It may be set to something other than "daily". But for the most part, there aren't a lot of updates needed.

[thirstyderp]

07:30 PM on 04/08/2012

The headline is misleading. There have been two updates to Java released over the last week, but these will not remove or find the malware. For that I suggest this:

http://macupdate.com/app/mac/42571/anti-flashback-trojan

[Durt Bagg]

02:26 PM on 04/08/2012

Instructions to check if you have the Flashback here:
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

[elicourey]

01:32 PM on 04/08/2012

I'm a computer technician and haven't seen this malware yet, but I hear it's simple to remove using Software Update on OS X. I hope it never gets that easy to remove Windows malware, I might be out of a job, haha.

[Seer Clearly]

03:04 PM on 04/08/2012

Maybe you should already be out of a job. The Malware is NOT easy to remove with Software Update. What is easy to do with Software Update is to update your Java installation so that you don't get the Malware in the first place. Once you have it, it's not that simple. However, there are instructions for removing it out on the web.

The time to be gloating over the superior security of the Mac is long gone - as proven by this article. And in fact, your and Apple's complacency is why this disaster actually happened. Apple issued the patch, but none of my Macs actually announced that it was available or urgently needed. I had to read about it here on HP first before I checked to see if it was available. Not good. And not as good as Microsoft.

[elicourey]

03:16 PM on 04/08/2012

Did you get the malware on your Mac? It sounds pretty simple to remove, I'm curious what issues you may have run into. I work on a lot of computers each day, so I figured if this becomes a big problem I may start seeing some of these infected Macs soon. Malware is what pays my bills, so if it's coming to the Mac, I'm fine with that.

[dunshire]

12:45 PM on 04/08/2012

Oh the glee of the PC user that Mac finally has one newsworthy malware. If you live in a small town that's rapidly growing eventually you'll have to lock your doors or at least pay more attention to who's trying to get in. I am happy for the past 20 years where I used my computer without fear and I am happy to pay the extra money for a Mac. The sky is not falling...I think we'll get through this.

[Durt Bagg]

02:27 PM on 04/08/2012

1 or 2 viruses a decade vs 100 a week for Windows and Android.

Android Devices Seeing 'Malware Epidemic'
Mobile phones running on Google's Android operating system are experiencing a "malware epidemic," with the amount of malicious software having risen nearly fivefold since July. - http://tinyurl.com/7nrfofh

Study: 99% of Android devices vulnerable to attack
Bad news for Android users! A study shows that 99 percent of Android devices are vulnerable to a security attack which allows hackers to access their Twitter, Facebook, or Google accounts. -- http://tinyurl.com/6fbzuyl

Study: Android malware up 400 percent
Android malware up 400 percent and Wi-Fi networks increasingly vulnerable to attack. -- http://tiny.cc/1m677

[Seer Clearly]

03:05 PM on 04/08/2012

An exponentially increasing value always starts with "one or two" in the first period. Your "logic" is like saying that after 23 missions, the Space Shuttle was safe. Result? BOOM!

[Ichigo Kurosaki]

10:36 AM on 04/08/2012

Apple has prattled for years that THEIR OS is immune to viruses and trojans, etc. Too bad that was never true and never will be true.
Apple simply didn't have the numbers of units in service for most malware developers to target MacOS. MacOS has tons of built-in security holes.
It seems that some malware monkey has decided to hammer MacOS.

In fact, because of this, I would hope that all iOS users (who far exceed the number MacOS users) take notice and be more careful.

[JohnTheMac]

12:28 PM on 04/08/2012

"Apple has prattled for years that THEIR OS is immune to viruses and trojans,"

No they haven't. That's your imagination again.

[Seer Clearly]

03:08 PM on 04/08/2012

Oh yes they have. Well not "Apple" but it's spokespeople. You know, like Jobs. And even the corporate website - with what is now a bald-faced lie:
http://www.apple.com/why-mac/faq/

[Agnt Duke]

06:52 PM on 04/10/2012

Um, yes they have. They've sent out warnings, and when the users complained, they withdrew their security warnings/counsel. They've just been dodging the issue forever.

Truth is, they're just as vulnerable as everyone else. They're just not as popular as everyone else. Having prosecuted hacking and intrusion cases plenty of times, they're just not a profitable target for thieves. Because money has now taken over as the driver for most world-wide hacking efforts.

[Brandon R Lucas]

08:19 AM on 04/08/2012

Common sense + PC = no problems Idiots + PC =BSOD

[Zoidberg2016]

02:33 PM on 04/08/2012

I couldn't agree more. I've been running Win7 since Dec '09 on my Lenovo and haven't had one virus or piece of malware. Just left UAC on and run MS security essentials (which is pretty nice for being free).

[Agnt Duke]

06:56 PM on 04/10/2012

Absolutely. And add this:

overconfidents + MAC = flashback outbreak. PCs may have a lot of risks, but that's attributed to both their popularity as well as their compatability. Half the risks are because the PC is the primary vehicle for users in the world marketplace. It just works with everything, and that means more security risk potential.

Apple has proven time and again they don't play nice with others, and neither does their software, so compatability has never been an issue for them. Personally, I'd take useful over isolated anyday.

[JohnTheMac]

10:50 PM on 04/10/2012

"Apple has proven time and again they don't play nice with others, and neither does their software, so compatability has never been an issue for them. Personally, I'd take useful over isolated anyday."

huh? I have more problems getting different versions of Windows to see each other on a network than the macs on a network.
Guess what I'm using RIGHT NOW, and I'm not feeling very isolated! LOL

[Lillian Bailey]

02:24 AM on 04/08/2012

Since switching to macs you couldn't give me a pc. Macs are so far ahead pcs just aren't even in the same category.Kinda like a beta vcr and a blue ray player.

[Brandon R Lucas]

08:14 AM on 04/08/2012

Haha this made me laugh, for the amount of a mac i could build a pc that would literaly murder any mac out there.

[JohnTheMac]

11:14 AM on 04/08/2012

Can you make a laptop?
That's mostly what people are buying today.

[Ichigo Kurosaki]

10:39 AM on 04/08/2012

I've owned both.
Macs are grossly overpriced for the hardware and there is nothing a Mac can do better than a PC. That was true 20 years ago. Not anymore.
There are, in fact, things I can do with a PC that cannot be done on a Mac at all.
Actually, I would call Macs the Betamax of the 21st century.
Interesting is the fact that you cannot use Blu-ray on a Mac, but I can author Blu-ray video on my PC, something else that Macs can't do at all.

[JohnTheMac]

11:57 AM on 04/08/2012

Final Cut supports BluRay authoring.
But who cares?
BluRay only has 25% market penetration after all these years.
So, you can make your BluRays, but who do you give them to? Only 1 out of 4 of your friends can likely view them.
All of these "disc" formats are dying. The last time I went into a BestBuy, about a month ago, I was shocked by how much the CD/DVD/BluRay area of the store had shrunk. They used to have a huge selection too. Talk about buying into Betamax!
You're expecting me to take my VHS collection, which I duplicated and added to into DVD, and now buy it all again in BluRay? No thanks, I'll get off the merrygoround please.

[elicourey]

01:21 PM on 04/08/2012

Blu-ray will be gone in a few years. streaming and digital copies is the future and the now, and Apple is known for focusing on the future.

[parhelion]

02:19 AM on 04/08/2012

Uhg.

The only reason why Apples were not previously susceptible to viruses was because they controlled a minute portion of the market share. If you were going to be a hacker, it was a total waste of time to attack the Mac OS because it had a crappy chance at propagation. PCs, on the other hand, were as common as flies.

Now that Apple is slowly elbowing its way into a greater market share (I'm seeing more and more average people with Macs, as opposed to five or six years ago when they were more of the caff-latte warrior-poet elitist thing), it's going to start attracting more attention from virus writers.

Give it another few years, Mac-lovers.

[Ichigo Kurosaki]

06:24 AM on 04/09/2012

Actually, Mac's penetration into the overall market remains unchanged, except for laptops, and that's ONLY because of the bullying Apple did to make certain colleges Mac-only and the tons they gave away to various high schools across America.
Probably 50% of all MacBooks were given away by Apple and the rest who bought them subsidized that giveaway with the intrinsically high price tag applied to all MacBooks.
A MacBook costs about double what PC laptop costs given the same hardware specs. A PC laptop that costs as much as a MacBook has far more powerful hardware and greater storage capacity.

[Seth Osmun]

01:34 AM on 04/08/2012

Now the one thing Mac users used to say all the time to those of us who use PC's is no longer valid. To Apple's credit, it seems to have taken forever for anyone to have engineered a virus capable of affecting the Mac OS, but they did it. Figures it would be a trojan, too.

[JohnTheMac]

07:40 AM on 04/08/2012

All the years you suffered under constant attack, but YOU were too smart to get a Mac and not have to worry about all the PC viruses, just use good sense and don't download or install things unless you know what they are.
Now, you're finally vindicated, and the years of extra hassles with PCs are all worth it, seeing the devastation this virus has brought to the Mac community.
There, you made the right choice, oh so long ago. You can feel proud and happy. You were no one's fool! Congrats!

[Ichigo Kurosaki]

06:28 AM on 04/09/2012

I only got attacked once in 15 years. I have over 20 computers in operation, including a MacPro. All of my PCs are homebuilt and have never been attacked successfully. The ONLY computer to get attacked was my MacPro.
At least PCs have anti-virus software, anti-malware, anti-spyware and firewalls. I had to write my own firewall for my MacPro. It didn't work very well, so I ended up building a hardware-based firewall to mount between the router and the MacPro's NIC port. That works, now.
Apple's refusal to even consider the fact that Macs could have vulnerabilities has made them arrogant and lazy.

[Ichigo Kurosaki]

09:38 AM on 04/09/2012

Not true. There have been other attacks against MacOS since MacOS X was first introduced. Apple simply managed to keep a tighter lid on this than anyone else. I've dissected a few of those nasties. Not bad. If they'd gotten out faster, they might have done some serious damage to a lot of systems.
MacOS doesn't even have a decent firewall.