Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Java Trojan on OSX

Hello,

I get updated notes as a memeber of SC Magazine which specialises in security risks across different platforms.

Yesterday I had notification that Apple have found a hole in its Java Scripting

This is what it says:-

After security researchers spotted active exploits taking advantage of the vulnerability, the update, for both Lion (10.7.3) and Snow Leopard (10.6.8) versions of the platform, was released to close a dozen holes in Java 1.6.0_29. Apple said the most serious may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.

That presumably refers to CVE-2012-0507, which researchers at Mac security firm Intego said was the latest variant of the password-stealing Flashback Trojan.

Intego said it had samples of variant ‘R' since 23March and had been finding new samples and variants of this malware almost daily since then. It recommended Mac users turn off Java in their web browser.

It also said Java is no longer provided with Mac OS X 10.7 Lion, but the first time a user needs to run it – when a Java applet loads, or when a user launches a Java applet on their Mac – the system will ask if the user wants to download it; if so, Apple provides the download directly and maintains its own version of Java.

Wolfgang Kandek, CTO of Qualys, said: “In addition, Mac users and IT admins for Macs should review whether Java is actually needed for their usage. If not, Java can be disabled through the Java Preferences program. Just uncheck 64-bit and 32-bit versions.”

Unpatched Java deployments are one of the largest malware threats facing enterprises today, according to Microsoft.

So my questions are :-

1) How do I ensure that Java is secure, as it states that I need to lock down and uncheck the the Java on 32 or 64bit versions

2) Is it now expedient to purchase Anti _Virus software for OSX?

Thanks David

MacBook, Airport and ms word critical update

Posted on Apr 5, 2012 2:13 AM

Best reply

X423424X

Level 6

14,265 points

Posted on Apr 5, 2012 2:22 AM

1) How do I ensure that Java is secure, as it states that I need to lock down and uncheck the the Java on 32 or 64bit versions

It's pretty secure if you turn it off! 😉 Generally you don't need it. You need Javascript for most browsers which is an entirely different thing.

You can disable in the browser you are using and/or more globally using the Java Preferences too (in Utilities), General tab (uncheck the checkboxes).

More new tricks from Flashback

How to check for and disable Java in OS X

Protect Yourself from the Mac OS X Java Vulnerability

If it turns out you need it for some specific application or web site that you trust then turn it on only when running that application or visiting that site.

2) Is it now expedient to purchase Anti _Virus software for OSX?

No. These things can't keep up with the ever changing trojans anyhow and there are no known viruses on OSX.

View in context

23 replies

MadMacs0

Level 5

5,221 points

Apr 6, 2012 7:22 PM in response to WZZZ

WZZZ wrote:

MadMacs0 knows the difference between a virus and a trojan. Please stop baiting him.

Thanks for the vote of confidence. I even know that Flashback is technically a "Backdoor" and not a Trojan, but I don't really want to debate that issue, either.

Apr 11, 2012 11:00 PM in response to denisefromsalisbury

Apple's statement about Flashback malware:

http://support.apple.com/kb/HT5244

Link to Java Update 7 for Mac OS X 10.6:

http://support.apple.com/kb/DL1516

Link to Java Update 2012-002 for OS X 10.7:

http://support.apple.com/kb/DL1515

Over a half-million Macs have been affected. Note that the above Java updates don't delete infected files. What you need to know about Flashback is here with links to removal tools and recommended antivirus apps:

http://www.forbes.com/sites/adriankingsleyhughes/2012/04/07/an-easy-way-to-check -your-mac-for-the-flashback-malware/

How to disable Java in Safari, Chrome and FireFox (highly recommended):

https://community.rapid7.com/videos/1373

For those who don't understand the difference, Java and JavaScript are two competely different things.

Apr 12, 2012 5:54 PM in response to denisefromsalisbury

2 new Java security updates issued today:

Java for OS X Lion 2012-003:

http://support.apple.com/kb/DL1515

Java for Mac OS X 10.6 Update 8:

http://support.apple.com/kb/DL1516

Apple Summary:

These updates remove the most common variants of the Flashback malware

Apr 12, 2012 7:49 PM in response to smackntoss

I still see Java for OS X Lion 2012-002 at the above link?

MadMacs0

Level 5

5,221 points

Apr 12, 2012 7:58 PM in response to Gerard James

Gerard James wrote:

I still see Java for OS X Lion 2012-002 at the above link?

Strange, I see 2012-003. They must still be rolling out updates to various support servers around the world.

Apr 12, 2012 8:06 PM in response to MadMacs0

MadMacs0 wrote:

Gerard James wrote:

I still see Java for OS X Lion 2012-002 at the above link?

Strange, I see 2012-003. They must still be rolling out updates to various support servers around the world.

What I meant is that if you go to these two links:

Java for OS X Lion 2012-003

http://support.apple.com/kb/DL1515

Java for Mac OS X 10.6 Update 8

http://support.apple.com/kb/DL1516

Which are both pointed to from the main Apple Support Downloads page at:

http://support.apple.com/downloads/

You'll still see:

Java for OS X Lion 2012-002 and Java for Mac OS X 10.6 Update 7 respectively. Maybe they haven't fully updated their site yet or maybe they're only available through software update. Has anyone tried them yet?

MadMacs0

Level 5

5,221 points

Apr 12, 2012 9:58 PM in response to Gerard James

Gerard James wrote:

Which are both pointed to from the main Apple Support Downloads page at:

http://support.apple.com/downloads/

You'll still see:

Java for OS X Lion 2012-002 and Java for Mac OS X 10.6 Update 7 respectively. Maybe they haven't fully updated their site yet or maybe they're only available through software update. Has anyone tried them yet?

But I don't. I've been seeing Java for OS X Lion 2012-003 and Java for Mac OS X 10.6 Update 8 since late afternoon (US/PT), when I returned to my computer.

Several people in the Apple Community Support discussions forum have used both without issue. Those who thought they might be infected were and most who were just testing were not. The update tells you if you were infected but is silent if not.

Why do you not want to use Software Update?

Apr 13, 2012 10:04 AM in response to MadMacs0

They seem to be pointing to the right place now, they were flipping back and forth between Mac OS X 10.6 Update 7 and Mac OS X 10.6 Update 8 yesterday. I downloaded the security update just now.

Why don't I want to use software update? I never use it. Always manually download combo updates and security updates. Look what happened with the last 10.7.3 delta update and the last security update for 10.6. Too many problems.

Java Trojan on OSX