News for hackers. Stuff that matters.
Re:New Mac OS X botnet discovered by spectres_ on Friday October 03, 2014 @04:21PM (#8407439)
To see if you haven't got it:

In terminal run:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

You should get this error:

The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist

Then run:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

You should get this error:

The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

If you do you are clean of this variant!

If this doesn't happen go to http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb... to fix it

[ Parent | on HN ]
Re:New Mac OS X botnet discovered by cpncrunch on Friday October 03, 2014 @07:13PM (#8408139)
That is for the Flashback trojan, but this is a new trojan, according to the post.
[ Parent | on HN ]
Re:New Mac OS X botnet discovered by bane on Friday October 03, 2014 @05:36PM (#8407769)
It's hard to believe, the claim is that is uses Reddit's search functionality to find connection addresses. I've never been able to find anything using Reddit's search.
[ Parent | on HN ]
Re:New Mac OS X botnet discovered by scottdeto on Friday October 03, 2014 @03:36PM (#8407233)
Many independent reports of this, but I haven't seen any instruction for detecting or fixing

http://www.tuaw.com/2014/10/03/thousands-of-macs-infected-wi...

[ Parent | on HN ]
Re:New Mac OS X botnet discovered by pjl on Friday October 03, 2014 @03:43PM (#8407268)
At least for detection (from the article): "During installation it is extracted into /Library/Application Support/JavaW, after which the dropper generates a p-list file so that the backdoor is launched automatically."
[ Parent | on HN ]
Re:New Mac OS X botnet discovered by milesf on Friday October 03, 2014 @03:34PM (#8407219)
Hmm. I've never heard of drweb.com before, and there's no instructions on how to detect the worm, but they want to sell me anti-virus software.

This might be legit, but I'll wait and see if this appears anywhere else before I trust it as being valid.

[ Parent | on HN ]
Re:New Mac OS X botnet discovered by cpncrunch on Friday October 03, 2014 @07:12PM (#8408136)
Yes, I was a little suspicious myself, although looking at their wikipedia page it does seem to be a genuine company.

https://en.wikipedia.org/wiki/Dr._Web

Also, more info here seems to support the fact that they are the real deal:

https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback

(as usual with wikipedia, you should check the original sources to verify).

[ Parent | on HN ]
Re:New Mac OS X botnet discovered by eyeJam on Friday October 03, 2014 @03:48PM (#8407289)
Has there ever been a company that covertly creates a virus and releases it into the wild, and then "catches" it and sells an anti-virus remedy?
[ Parent | on HN ]
Re:New Mac OS X botnet discovered by jason_slack on Friday October 03, 2014 @03:32PM (#8407210)
I've never even heard of drweb....I dont see any other security companies reporting on this.
[ Parent | on HN ]