Post by: Xairbusdriver on September 23, 2011, 05:22:38 PM
Post by: gunug on September 24, 2011, 03:01:59 PM
QUOTE
The new piece of malware hides inside a PDF file and delivers a backdoor that hides on the user's machine once the malicious file is opened. Once the user executes the malware, it puts the malicious PDF on the user's machine and then opens it as a way to hide the malicious activity that's going on in the background, according to an analysis by researchers at F-Secure. The Trojan then installs the backdoor, which is named Imuler.A, which attempts to communicate with a command-and-control server.
https://threatpost.com/en_us/blogs/new-mac-...ious-pdf-092311
https://threatpost.com/en_us/blogs/new-mac-...ious-pdf-092311
Apparently this is a threat to Macs!
Post by: Xairbusdriver on September 24, 2011, 04:39:59 PM
Post by: kimmer on September 24, 2011, 05:28:07 PM
Post by: Paddy on September 24, 2011, 08:52:25 PM
http://www.macnews.com/2011/09/23/mac-pdf-...e-gallops-scene
Post by: gunug on September 25, 2011, 02:45:44 PM
Post by: Xairbusdriver on September 25, 2011, 03:28:16 PM
Post by: kimmer on September 25, 2011, 06:41:02 PM
Post by: Xairbusdriver on September 27, 2011, 01:29:43 PM
Later: Some info on how to check when your last update occurred and force it to update immediately: <http://www.macworld.com/article/160253/2011/06/force_mac_update_malware_definitions.html>
- When was the last update?
- Launch Terminal, and paste this command:
more /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist
You should see something like this:
- [attachment=2332:XProtect...Run_Time.gif]
- Launch System Preferences
Go to the Security preference pane
Uncheck the “Automatically update safe downloads list” box
Re-check that box.
Post by: Paddy on September 27, 2011, 02:53:29 PM
http://www.macworld.com/article/162535/201...l#lsrc.rss_main
The Flashback trojan that Jim mentions still hasn't been addressed, however.
Post by: Xairbusdriver on September 28, 2011, 01:47:43 PM
Post by: Xairbusdriver on October 03, 2011, 03:30:48 PM
- <OSX/Revir-B info at Sophos>
Post by: kimmer on October 03, 2011, 07:05:13 PM
Post by: Paddy on October 03, 2011, 08:33:56 PM
QUOTE(kimmer @ Oct 3 2011, 08:05 PM) <{POST_SNAPBACK}>
Do I have to download and install this software from Sophos in order to find/quarantine this trojan?
No. You can also do it by hand:
http://www.infosecurity-magazine.com/view/...ac-pdf-trojan-/
But why would you download this PDF anyway? I don't imagine it's out there on trusted sites, just lurking, ready to pounce.
As Brian Krebs writes in his dissection of the Trojan:
QUOTE
It’s worth noting that these threats, like most of those facing Windows users today, rely on social engineering — tricking the user into clicking an attachment or link. Regardless of which operating system you use, it’s a good idea to develop a healthy sense of skepticism and paranoia about any unexpected documents that arrive via e-mail, or random prompts to “update” software. Rule #1 from my 3 Basic Rules for Online Safety applies just as well to Mac users as it does folks using Windows: “If you didn’t go looking for it, don’t install it!”
Post by: Xairbusdriver on October 03, 2011, 08:59:37 PM
At any rate, if you spot any PDF's that you don't recognize in your "downloads" folder (where ever that may be on your set up). Simply delete it and Empty the Trash, as well. Then, try to refrain from visiting the some of the types of sites you visit.