Latest news
Have the predictions made yearly by many security firms finally come true? Will Mac users be forced to invest in a good antivirus solution? According to the latest numbers produced by security firm Sophos, the penny has indeed dropped.By analyzing the results provided by its Mac AV solution installed on a 100,000 computers included in the sample, its researchers have discovered that one machine out of 36 has Mac OS X malware installed.
75 percent of these installations (unsurprisingly) consist of the infamous FlashFake malware, followed by nearly 18 percent of fake AV installations.
But what's interesting to note is that apart from getting infected with Mac malware, 20 percent of those machines also harbored Windows malware.
"Although Windows malware on Macs won't cause symptoms (unless users also run Windows on their computer), it can still be spread to others," says Cluley and advises users to "be a responsible member of society and ensure that you're keeping your Mac squeaky clean."
In the meantime, the decline in numbers of machines enslaved into the FlashFake botnet has been disproved by Dr. Web researchers, who explain that the statistics provided by the hijacking of botnet control servers effected by a number of security firms have not been correct.
"After communicating with servers controlled by Doctor Web, Trojans send requests to the server at 74.207.249.7, controlled by an unidentified third party. This server communicates with bots but doesn't close a TCP connection. As a result, bots switch to the standby mode and wait for the server's reply and no longer respond to further commands," explained the researchers.
"As a consequence, they do not communicate with other command centers, many of which have been registered by information security specialists. This is the cause of controversial statistics - on one hand, Symantec and Kaspersky Lab reported a significant decline in the number of BackDoor.Flashback.39 bots, on the other hand, Doctor Web repeatedly indicated a far greater number of bots which didn’t tend to decline considerably."
In short, the number of affected computers seems to reach 550,000 - nearly as many as those counted when the botnet was first spotted.
It is disheartening to see that all the attention the issue has received in the media and all the downloads of the FlashFake removal tools haven't made a considerable dent in that number.
Is it that the disinfected computers get easily infected again since the latest variants don't require any user interaction and are installed onto the systems via exploits of unpatched flaws? If that's what's happening, installing an AV solution onto one's Mac seems to be unavoidable.


Spotlight

The security of WordPress plugins
Posted on 18 June 2013. | Checkmarx’s research lab identified that more than 20% of the 50 most popular WordPress plugins are vulnerable to common Web attacks, such as SQL Injection.

Information security executives need to be strategic thinkers
Posted on 17 June 2013. | George Baker, the Director of Information Security at Exostar, talks about the challenges in working in a dynamic threat landscape, offers tips for aspiring infosec leaders, and more.

Large orgs in denial about own security breaches?
Posted on 14 June 2013. | Over two thirds (66%) of large organizations said they either had not experienced a security incident in the last 12-18 months or were unsure if they had.

Vulnerability scanning with PureCloud
Posted on 12 June 2013. | nCircle PureCloud is a cloud-based network security scanning product built upon the companies' vulnerability and risk management system IP360.

Reactions from the security community to the NSA spying scandal
Posted on 11 June 2013. | Read on for comments on this scandal that Help Net Security received from a variety of security professionals and analysts.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.







