Forget Apple: Oracle to bring Java security fixes directly to Mac users

"Oracle released Java SE 7 Update 4 this week, which finally gives Mac owners the means to receive critical Java security patches at the same time they're available for users of Windows and Linux operating systems. The new release means that OS X should be receiving regular Java updates directly from the source—helping to prevent attacks like the recent Flashback infection—as well as a fully supported Java development environment."

Forget Apple: Oracle to bring Java security fixes directly to Mac users

Half-million Mac infection estimate backed by new analysis

A second security firm took a shot at estimating how many Macs are infected by the Flashback malware and it arrived at the same conclusion as the first—more than half a million machines. That figure, documented in a Kaspersky Lab blog post published on Friday, would mean Flashback has infected slightly more than 1 percent of the 45 million Macs in existence.

Kaspersky Lab Expert Igor Soumenkov said researchers arrived at that number by registering a domain name used as a fallback command and control channel and logging the number of machines that reported to it. In less than 24 hours, a total of 600,000 unique bots connected to their server. Because Flashback shows the universally unique identifier of each bot, he said they're confidant they didn't count the same one multiple times, although they couldn't rule out the possibility that some of the machines were running FreeBSD, Linux, Windows, or other operating systems.

Continue reading: Half-million Mac infection estimate backed by new analysis

Russian Security Experts Analyze Backdoor.Flashback.39

Backdoor.Flashback.39, the piece of malware designed to target computers running Mac OS X, caused a lot of headaches for Mac users, especially because one of the Java vulnerabilities it exploited remained unpatched by Apple.

Security experts have found that even after Apple patched the flaw, the cybercriminals behind the operation didn't seem to be discouraged.

Researchers from Russian security firm Doctor Web analyzed the malicious element and determined that the infection begins when users are redirected to shady sites from compromised domains.

A piece of JavaScript code, placed on websites such as godofwar3.rr.nu, ironmanvideo.rr.nu, killaoftime.rr.nu, or gangstasparadise.rr.nu, loads the Java applet that contains the exploit.

The exploit then saves an executable onto the infected Mac machine. This executable file connects to a remote server from which it downloads and executes the final payload.

Continue Reading