The Flashback backdoor is then active with no indication to users that anything untoward has happened.Ī few points need to be made regarding Java and Mac OS X. Most users won’t understand what this means, and click on Continue to allow the installation to continue.įound in the wild, this new variant installs an executable file in the /tmp directory, applies executable permissions with the chmod command, then launches the executable with the nohup command. The applet displays a a self-signed certificate, claiming to be issued by Apple. If these vulnerabilities are not available – if the Macs have Java up to date – then it attempts a third method of installation, trying to fool users through a social engineering trick.

If this is successful, users will be infected with no intervention. The malware first tries to install itself using one of two Java vulnerabilities. There is no more installer, no request for a password. Taking advantage of two Java vulnerabilities, this latest variant is able to install itself on a Mac with much more limited user intervention.

The people behind the Flashback Trojan horse have begun using a novel delivery method to infect Macs. In the past few months, Intego has found new variants of the Flashback Trojan horse every few days, but the company’s latest discovery is a bit surprising. A variant discovered in October 2011 notably damaged some system files. Intego first discovered the Flashback Trojan horse in September 2011, and since then has seen a number of variants of this malware. Malware New Flashback Trojan Horse Variant Uses Novel Delivery Method to Infect Macs

Flashback express mac