Apple reportedly tries to shut down Flashback discoverer's server
In what may be a case of mistaken identity, it was revealed on Tuesday that Apple attempted to shut down a server belonging to the security firm that first discovered the Flashback malware, giving insight into how the Cupertino, Calif., company handles third-party assistance.
Boris Sharov, chief executive of the relatively unknown Russian security firm Dr. Web, was notified by web registrar Reggi.ru on Monday that Apple had requested the shut-down of a domain belonging to the Moscow company on claims that it was being used as a "command and control" for Macs affected by Flashback, reports Forbes.
“They told the registrar this [domain] is involved in a malicious scheme. Which would be true if we weren’t the ones controlling it and not doing any harm to users,” Sharov said. “This seems to mean that Apple is not considering our work as a help. It’s just annoying them.”
The domain in question was one of three Dr. Web was using to monitor the spread of Flashback in what researchers call a "sinkhole," or a spoofed command and control server. This technique allowed the firm to first the trojan that has so far rooted into an estimated 600,000 machines, more than one percent of all operating Macs.
Apple may have prematurely requested the shutdown, which is standard practice in this type of security scenario, before further investigating the background of the server and Sharov believes that the move was merely a mistake.
Adding to the confusion is Apple's notoriously secretive nature. Sharov said that his company has dealt with the oft-maligned Microsoft on similar situations which, unlike Apple, has fostered fruitful working relationships with outside security firms. Apple has not seen a botnet of this scope and therefore does not share the same ties with outside security sources, he adds.
“For Microsoft, we have all the security response team’s addresses,” Sharov said. “We don’t know the antivirus group inside Apple.”
Dr. Web chief executive Boris Sharov. | Source: Forbes
By shutting down command and control servers, Apple is looking to quash Flashback, which in its current iteration has created a worldwide botnet by exploiting an unpatched Java vulnerability.
Apple recently pushed out two successive Java updates last week in an attempt to catch up with the malware, but some see the move as too little too late.
“Their response should have been much earlier when they should have updated their Java,” Sharov said. “Now calling registrars to shut down domains is not as important. The infection has already taken place. There are dozens of domains [controlling] the botnet. Shutting down one does nothing.”
Apple remains closed for comment, and hasn't released any official statement regarding Flashback.
“These are not pleasant days for them,” Sharov said. “They’re not thinking about us. The safety of Macintosh computers is going down very quickly, and they’re thinking what to do next. They’re thinking about how to manage a future where the Mac is no longer safe.”
[ View article on AppleInsider ]
Comments
... Sharov said. ?This seems to mean that Apple is not considering our work as a help. It?s just annoying them.? ...
Would seem to be a huge leap/assumption that isn't backed up by any facts and is actually quite unlikely.
Why wouldn't Apple want those servers to be shut down. If they are hosting some malware, then they SHOULD be shut down.
those servers were used to attract botnet attacks. it's like catching living specimens in a test lab so you have a controlled environment with which to study them. some botnet attacks thrive on live hosts in a peer-to-peer environment. if you purposely join the environment (in hopes of fooling everyone that you're just a innocent target of the trojan), you can quietly remain infected while you diagnose the problem and kill the trojan.
This part here: (the actual basis for this being a "story" BTW) ...
the entire article is, in fact, newsworthy. i doubt most people, here, knew how security firms track down and ultimately eliminate threats. the Forbes article gives some insight into the legitimate tactics deployed by Dr Web and other security firms.
Would seem to be a huge leap/assumption that isn't backed up by any facts and is actually quite unlikely.
while i agree the assumption is a bit arrogant, the bigger picture is people shouldn't necessarily be equally as arrogant to dismiss the notion that OS X can be victims of certain kinds of digital threats.
One of our printers recently got their website hacked. Somehow they were able to compromise the http file uploader using php. Perhaps they target businesses that are known to be popular with Macs like printers. They hack the website then distribute their malware to the company's regular clients.
The Fortune piece was such obvious click bait sensationalism that tells one side of a story because Apple isn't in business to generate fame for companies like this.
The piece says what Apple did (attempting to block DNS for sites involved in the malware) wasn't even suspicious, but that fact is buried under a headline and 90% of the story that's all attributing phony motives to a company out of thin air.
Might as well go interview Mike Daisey about Apple in China again.
Shame on you AI.
I am not totally convinced there is not some collaboration here, to sell antivirus software. I guess I am just naturally suspicious.
This part here: (the actual basis for this being a "story" BTW)
Would seem to be a huge leap/assumption that isn't backed up by any facts and is actually quite unlikely.
Indeed. This is some unknown company that claims to be a security firm etc but for all anyone knows they are behind this whole thing. And even if they are not, they are gathering info about infected systems that could be used for malice. I would much rather Apple assume the worse and have it shut down than not
And to claim Apple doesn't care? Says who? They might not be giving out info to this unknown company but if they didn't care they wouldnt have done two java updates after publicly saying they were stopping such updates and users need to get it from Oracle directly
This part here: (the actual basis for this being a "story" BTW)
Would seem to be a huge leap/assumption that isn't backed up by any facts and is actually quite unlikely.
I agree. Understanding the nature, signatures, and source of attacks is a tough business. It sounds like this guy is attempting to capitalize on the incident and Apple's reaction. Good marketing is where you find it, eh?
I'm sorry. Something here seems mighty suspicious. Russian security firm, trojan virus, servers they have to monitor, and then they have a tool where they can check your computer, but receive its identification numbers? I far prefer just checking to see if the virus is there, and updating the computer.
I am not totally convinced there is not some collaboration here, to sell antivirus software. I guess I am just naturally suspicious.
Technically It was a "Trojan", not a "Virus". A trojan sits on the infected computer without user ever knowing it existed and waits for the command to launch an attack.
The only symtom were that the computer or the Internet seemed slow and crashed a lot lately.
Indeed. This is some unknown company that claims to be a security firm etc but for all anyone knows they are behind this whole thing. And even if they are not, they are gathering info about infected systems that could be used for malice. I would much rather Apple assume the worse and have it shut down than not
Kapersky confirmed the same thing as Dr. Web found, and used the same "sinkhole" redirect as Dr Web to gather the evidence. They're legit.
“These are not pleasant days for them,” Sharov said. “They’re not thinking about us. The safety of Macintosh computers is going down very quickly, and they’re thinking what to do next. They’re thinking about how to manage a future where the Mac is no longer safe.”
This last quote of Sharov strikes me as FUD. Sharov is trying to spread FUD, what is his purpose? "Safety is going down very quickly", seriously? There are 0 self replicating and self installing viruses for the Mac. There is one active trojan, the previous trojans have been squashed. This one is in the process of being squashed. How is the safety of the Mac going down quickly?
I suspect Apple know more than we do.
Agreed.
Kapersky confirmed the same thing as Dr. Web found, and used the same "sinkhole" redirect as Dr Web to gather the evidence. They're legit.
Both companies have a highly vested interest in scaring the crap out of newbie Mac users. I don't trust a word they say.
It's like running a million ads saying "Ask your doctor for our drug that cures restless nose syndrome ... you do have a restless nose don't you ...?" Cut to video of people just like you with restless noses.
The only difference is I wouldn't put it past one of that bunch of AV companies to be behind the trojans in the first place. These guys are all dead when the PC dies and they know it.
Mac itself wasn't vulnerable, it was Java. The right thing to do would be point this to Java. If you install a vulnerable piece of software in your OS, then it makes that OS, no matter how secure, vulnerable. This vulnerability also existed on Linux boxes as well.
What Apple should do is simply remove Java from Mountain Lion. If the user needs Java, they can download it from Oracle. And if there are vulnerabilities in that, then it's Oracle's fault.
Apple stopped carrying Java a long time ago, for good reasons. Having to maintain third-party distributions is insane, and this time they were blamed for it was well.
$30 for a clean install of Lion, no Java problem solved or an AV solution.
This last quote of Sharov strikes me as FUD. Sharov is trying to spread FUD, what is his purpose? "Safety is going down very quickly", seriously? There are 0 self replicating and self installing viruses for the Mac. There is one active trojan, the previous trojans have been squashed. This one is in the process of being squashed. How is the safety of the Mac going down quickly?
His purpose is to scare folks so they will buy his company's software and services to protect themselves. Same as when all these anti-virus etc companies discover some new threat that in truth only affects computers running 10.3 with Classic still installed using IE as their browser with Office installed or some other "perhaps 5 people have it" set up