Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

More on MAC OSX Malware - MACDefender Fake Antivirus

Published: 2011-05-02
Last Updated: 2011-05-02 15:13:55 UTC
by Rob VandenBrink (Version: 2)
0 comment(s)

A new strain of malware going by the name of "MACDefender" is making the rounds - Fake Antivirus in a new disguise!  It's dowloaded as a compressed ZIP containing JavaScript.  In some cases users are directed to download this malware from a specific site, but there are reports that it's also showing up directly in Google Image Searches.

If you have "Open Safe files after downloading" enabled in Safari, downloading this file will auto-install this code.

In it's current incarnation, MACDefender shows up in the installed applications list, so can be uninstalled.  If you have accidentally installed this, go ahead and uninstall it.  I would not expect this "uninstall" option to be a good long term protection strategy.  I'd suggest that OSX users disable "Open safe files after downloading", and also invest in a reasonable anti-malware suite.  Installing a real anti-malware package is also a good idea (no matter what the Apple Fans say ..)

As in all platforms, downloading any code from the internet that suggests anything like "click here and we'll check you for malware" or "you have a virus, click here to clean your machine" or "click here to tune your computer to run faster" is probably a really bad idea.  Almost without exeption, these sites are enticing you to help install malware on your computer, not protect it.

More detail here ==>

================ Update  1 =====================

ISC reader Andra reports that on some sites this malware is charging $99 via Paypal during the install. 

I guess this malware is going with the direct-deposit route to pay back development costs !



Rob VandenBrink


0 comment(s)

"Do It Yourself" Crimeware Kit for OSX

Published: 2011-05-02
Last Updated: 2011-05-02 13:39:31 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

CSIS reports that a new "do-it-yourself" crimeware kit has surfaced for the OSX platform, being sold under the name "Weyland-Yutani BOT" (Interesting name choice, all the way back to the "Alien" film franchise).

The current version works on Firefox, but Safari and Chrome versions are coming. It's reported that the templates used are the same as for Zeus, so expect this to take off once it hits the mainstream.

More details here ==>

Rob VandenBrink

0 comment(s)

Bin Laden Death Related Malware

Published: 2011-05-02
Last Updated: 2011-05-02 04:18:52 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)

We don't have any examples yet. But with any large news event like this, we expect a flurry of e-mails, and likely black hat search engine operations trying to take advantage of the event to distribute malware. Please let us know if you see any examples.

There are some image searches that return a image claiming to be an image of dead Bin Laden, but right now, none of the servers hosting it respond. Some of the sites return SQL errors indicating that the sites are receiving too much traffic.

Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: bin laden malware SEO
2 comment(s)
Diary Archives