We know that one of the big reasons your or your loved ones got a Mac is because you didn’t want to worry about viruses, malware or other technical time wasters. Unfortunately, the Mac Flashback trojan may have infected over 500,000 Apple computers and is attempting to use these computers to generate email spam and more.
F-Secure Labs has laid out the steps to detect and, if necessary, remove the trojan. Advanced users should do that now. Start at step 1.
To prevent further infections, F-Secure Labs recommends all Mac users update, disable or remove their Java client plugin/installation. (Windows users, too. Actually. But for once, we’ll make this post almost entirely about Mac malware.)
How to Update or Disable Your Java in Mac OSX
Snow Leopard (Lion doesn’t come with Java by default)
1. In Finder, go to “Applications” folder.
2. From “Applications” go to “Utilities” to “Java Preferences”.
3. Uncheck everything in the General tab.
1. Open Safari.
2. From the Safari menu, select “Security”.
3. Uncheck “Enable Java”.
1. Input the address “chrome://plugins“ into Chrome’s address bar.
2. Scroll down to “Java”
3. Click “Disable” for any instance of Java you see.
4. Use the same procedure to start using Java again, just click “Enable”.
Mirai – malware designed to infect internet of things devices - is behind some of the biggest DDoS attacks in history. It knocked Twitter, Netflix, and other popular websites offline in October. And now, it looks like a variant of Mirai has been modified (or upgraded) to infect routers. Nearly a million people in Germany have lost their internet access over the past few days due to infected routers. News reports say that over 900,000 routers from Deutsche Telekom (DT), Germany’s largest telecommunications provider, were knocked off the internet over the past few days. The attack(s) are being attributed to Mirai based on their use of infrastructure seen in previous Mirai attacks. “Mirai was designed to infect IoT devices. And since IoT devices and routers have many of the same security issues, adapting Mirai to target routers seems worthwhile for attackers,” says F-Secure Security Advisor Sean Sullivan. “It takes a bit of work to adapt the malware, but since the code has been dumped online, it’s doable.” The Mirai variant hitting routers in Germany exploits a vulnerability in the firmware of particular models of Speedport and Zyxel routers. Previous Mirai variants have been more focused on IoT devices (most notably webcams), and brute forcing passwords to infect devices with malware. You can find a list of affected router models here. DT has apparently already developed a fix for this, which is impressive given the general industry-wide neglect of vulnerable firmware. But reports say that there may be as many as five million devices connected to the internet that are susceptible to the same attack used against DT routers. And this estimate doesn’t include devices with other security problems leveraged by Mirai, such as the use of weak default passwords set by manufacturers. How to Troubleshoot Bots Attackers infect devices with Mirai, and then connect tens or maybe even hundreds of thousands of infected devices together to create a network of bots (hence the term, botnet). Using botnets, attackers can do things like issue commands to infected devices, launch devastating DDoS attacks, install additional malware, or spread the infection through more networks (thereby increasing the size of their botnet). But fighting botnets isn’t a huge priority for anyone but ISPs. A phone, laptop, or webcam can be part of a botnet without really inconveniencing the device owner. However, that doesn’t mean bot infections should be ignored. Many bots, including Mirai, receive instructions from attackers. New instructions can give bots new capabilities, including having them attack device owners in more direct ways. And because Mirai (and bots like it) can infect non-traditional PCs, it’s more difficult to get rid of. Here’s a few things you can do to get rid of bot infections on devices that can’t run antivirus software. Reset your device Resetting routers and IoT devices infected by Mirai is enough to remove the infection. It’s a good first step. But this doesn’t fix the underlying problem, so you’ll remain vulnerable to future infections unless you take additional actions. And because Mirai spreads aggressively, you may only have a matter of minutes until you’re infected again. Change default passwords (if possible) Most people don’t change default passwords on their routers or IoT devices. This is a HUGE problem, since many of these devices use common passwords for the same model or line of products. And to make things worse, lists of default passwords are often available online. Many attackers know people don’t change passwords on their devices, and use that to help them plan attacks. Mirai is programmed to try logging in using popular passwords like “123456” and “password”, as well as passwords that have proven effective against specific devices (such as “admin” and “xc3511”). So change default passwords whenever possible. Contact device vendors/ISPs Some devices cannot be fixed easily. Sometimes passwords cannot be updated by users. Firmware often ships with vulnerabilities, requiring vendors to create and distribute patches. In these cases, ISPs or device manufacturers need to get involved. So make an effort to check their websites, and if needed, contact them. They may or may not help. DT is making an effort to restore service to customers affected by the recent outbreak. And after the massive Mirai attack on Dyn in October, a Chinese webcam manufacturer recalled some of its products that used passwords that could not be changed by users. In the worst case scenarios, people may be forced to actually throw out an infected device. “Like any new technology, it’s buyer beware,” says Sean. “Security researchers and even hackers have been talking about insecure IoT devices for years. Now the problems are starting to arrive, and they’ll most likely get worse before they get better.” There are multitude of other security measures you can take to protect things like routers and IoT devices. Some of the best ones include making sure Universal Plug n Play is disabled, checking that your DNS settings are configured correctly, and that you log out of devices’ admin portals after changing any settings. [ Image by Sascha Pohflepp | Flickr ]
The first known use of the term "trick or treat" was found in a November 1927 edition of Blackie, Alberta's Canada Herald: Hallowe’en provided an opportunity for real strenuous fun. No real damage was done except to the temper of some who had to hunt for wagon wheels, gates, wagons, barrels, etc., much of which decorated the front street. The youthful tormentors were at back door and front demanding edible plunder by the word “trick or treat” to which the inmates gladly responded and sent the robbers away rejoicing. "No real damage" from "youthful tormentors?" Sounds a lot like the early days of hacking. Unfortunately those days are long over. “It’s a business,” F-Secure's Chief Research Officer Mikko Hyppönen told Wired UK. “There’s a whole structure there that’s needed,” F-Secure's "Cyber Gandalf" Andy Patel told ITPRO. “An individual can’t just go in and do this now; it’s not a one man job… these are companies.” The cyber crime "industry" has raked in hundreds of millions and possibly even billions of dollars. And it does it, in general, by counting on people to make mistakes. “People do stupid stuff,” Mikko explained. “You cannot patch people.” The first step to avoiding a threat is knowing it exists. So this Halloween as you search for treats online, look out for these tricks. Ransomware F-Secure Labs has warned about malware that holds your digital files hostage to demand a ransom for most of the last decade. But it's in the last year that the threat has burst into the mainstream and become something you can't go a few weeks without hearing about it on the news. How do you avoid this trick? Keep your system software updated and run security software at all times. Make regular backups of every file that matters on your computer and never click on attachments and links in emails that you weren't expecting. Find My iPhone Scam This scam answers the question, "How can losing your iPhone get any worse?" People who use the "Find My iPhone" app have been targeted by criminals who've gotten ahold of their phones with a scam that allows the crooks to gain access to the device and -- possibly -- the owner's most intimate financial details. How do you avoid this? Check the URL before entering any confidential data. Or as Apple says, "You should never enter your Apple account information on any non-Apple website." Phishing Scams As cyber criminals have gone pro, they've gotten better at using old tactics that we thought had faded away -- like email attachments and phishing scams. Like the trick that gives crooks access to stolen iPhones, a phishing scam just tricks you into entering your private credentials into the wrong site. And it then uses those credentials to hack your email, financial accounts, etc. Checking URLs before entering data is crucial because with the explosion of photo editing software and skills, it's now easier than ever to make a fake site look real. Experts believe that one wrong click to a fake site led the chair of a major presidential campaign to expose his entire inbox to the world. Having someone else leak your password Millions and millions of passwords have been leaked in 2016, some from breaches of data that took place years ago. It might not sound scary that your Yahoo! password from 2005 is now public, except if you are still using that password today on a critical account. This is why you need to use strong, unique password for each important account. Yes, remembering all that is almost impossible. So consider using a tool like F-Secure's KEY to manage your passwords. KEY is free to use on one device. Haunted IoT devices As our homes are getting smarter by connecting almost everything to the internet, they're also getting haunted -- by cyber criminals. A botnet is a network of computers that have been hacked and "enslaved." Security expert Brian Krebs was recently hit by a monster attack on his site that he believes was powered by a botnet powered by "'Internet of Things,” (IoT) devices — routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords." What can you do? So much of this problem requires manufacturers to improve their security. But you can help by keeping every device updated with the latest software from the manufacturer and always changing your default passwords. [Image by Daniel Lewis | Flickr]
When he was still working in cyber security for the Finnish government, Erka Koivunen met a NATO diplomat who said that there was "nothing new" about the era we now live in. Foreign envoys have always lived with the constant awareness that their private communications could be "leaked" for their enemies to exploit. "Anything that was written down could eventually be discovered," Erka, who is now an F-Secure Cyber Security Advisor, told me. "So the most sensitive conversations never took place in writing." Given the massive email leaks that have now hit the worlds of business, with the Sony hacks, and politics, with the leaks of U.S. political figures, is this how we should all start thinking? Does everyone alive in the twenty-first century have to operate like a NATO diplomat? Or a C-level executive who knows any word she types could be subpoenaed? Or the campaign chair of a presidential campaign? The answer, unfortunately, seems to be increasingly clear. "Whatever you write, you may need to defend your position in public," Erka said. Relying on an insecure medium The problems with email begin with the general insecurity of it as a means of communication. It's more like sending a postcard than sending a sealed letter, Erka explains. "As soon as the message goes out of your or your company’s systems, you lose control of it," Erka explained. "This is by far the biggest problem of the good-ole-email. Messages can be eavesdropped, altered, delayed, replayed or dropped altogether without you ever knowing." To actually spy on email as it's being transmitted generally requires legal access to telecommunications infrastructure or extraordinary technical knowhow and resources. Think law enforcement or intelligence agencies. Since these groups have a vested interest in cloaking their activities, they had little incentive to engage in the massive sort of leaking of gigabytes of private data we've seen from Wikileaks. However, we appear to be at the end of the era of "the gentleman's agreement" between countries, as cyber policy expert Mara Tam explained on a recent episode of the Risky.Biz podcast. This agreement went something like: "Gentlemen read each other's email, but they don't leak it to the public." The leaks from former CIA contractor Edward Snowden helped make the public aware of how much information the government potentially could access. But the exposure of a private individual's digital communication to the world presents a stark new reality for anyone who conducts business online. "Personal mailboxes store gigabytes’ worth of conversation history that will be a treasure trove for attackers for multiple reasons," Erka said. "There are sensitive discussions about business strategy, customers, competitors, products. There is also internal gossip, badmouthing and other damaging stuff." Activist Naomi Klein told The Intercept that "this sort of indiscriminate dump is precisely what Snowden was trying to protect us from." And we don't yet have a full sense of the potential ways this mass of data can be used against us. A competitor could use private information to tarnish someone’s reputation and hackers can mine the data to prepare for future cyber intrusions or to gain access to your other accounts through password resets. Letting the public decide what's private Leaks have already cost some executives their jobs and could swing the U.S. presidential election. But in a sense, we're all victims of this new risk to all of our privacy. "Whatever you write in an email you have to consider, are you ready for your boss, your spouse, your business partners to read it?" Erka asked. This new reality leads inevitably to the tragedy of self-censorship. Zeynep Tufekci -- a "techno-sociologist" -- has been doing a running commentary on the Wikileaks revelations and is very disturbed by what she's seeing. "People gossiping in internal conversation is not a scandal—but destroying public/private boundaries will paralyze dissent, not the powerful," she tweeted. Wikileaks is releasing more documents than it could ever sift through in the hopes that the newsworthy information will be discerned by interested researchers around the world. But along with potentially relevant items, intensely private information has been revealed. "For example, a suicide attempt was publicized through Podesta indiscriminate dump (Wikileaks tweeted it out)," she noted. "Who will want to be political?" This makes the loss of email seem dire, but perhaps it speaks to a not just a flaw in the medium's security but the medium itself. "The deeper problem with email is that it has never quite settled on a social mode," The New York Times Farhad Manjoo wrote. "An email can be as formal as a legal letter or as tossed off as drive-by insult. This invites confusion." What can you do? So, should you be like that NATO diplomat content to keep all of your deepest secrets out of writing? Can you expect yourself to remove all snark and potentially offensive thoughts from your emails? Should you assume that your email box is like a box of letters in your attic, vulnerable to anyone who can get access to it? These answers are ultimately up to you and how you use -- or don't use -- email. F-Secure security advisor Sean Sullivan has found that young people he's interviewed are increasingly abandoning email as communication tool. "They only have an account -- typically Gmail -- in order to sign up for stuff," he said. If this continues, email is on its way out, whether it's private or not. For now, lawyers, doctors and other professionals with explicit legal responsibilities, email has a much more defined role that cannot be easily abandoned or circumvented. As far as your work email goes, consult your IT staff for guidance as you may be under legal obligation to preserve your data. But for your personal email, Erka suggests you have to at least be aware of how likely you are to be a target and what you can do to contain any potential damage -- besides using a strong unique password for every email account you have and only entering your account information on the secure webpage of your email provider. If you are involved in international politics, for instance, there's no question. You are a target. Hackers are either after your emails or are trying to get access to powerful people in your contacts. If you're someone with no power, no tumultuous relationships and no interest in politics, you're likely not to be on anyone's radar... yet. The problem is no one knows where you'll be in a few years and our inboxes are big enough to last a lifetime. "When everyone is using cloud-based emails like Gmail, there's no need to save space," Erka said. "That's the whole selling point of those services: Never delete anything." If you see the potential for enough damage, you many want these recent leaks as an inspiration to launch a serious spring cleaning of your personal online inboxes, including email and social media. "You may want to delete the messages you don't need and sort the stuff you do want into folders that you take off the web and can store on a secure backup," Erka suggested. Yes, you will lose the convenience of being able to search your Gmail box through a simple interface, but so will potential hackers. He also recommends sharing documents through sharing platforms and cloud services such as Sharepoint, Salesforce or Dropbox. "These links can require separate authentication upon opening and the sender can control how long it will be valid," Erka said. "If the email gets stolen and leaked years later the chances are the link will be invalid by that time." For quick conversations, Sean suggests Wickr, which offers self-destructing messages through a mobile app or a desktop client with easy encryption, something that just doesn't exist for most email. "For professionals, Wickr has a paid service which will retain messages for a legal requirement, and will then securely delete them post-requirement," he said. Regardless of policy, employers have a vested interest in moving their staff away from an over-reliance on email for more than privacy reasons. "Actual phone calls and face-to-face discussions that get out of your chair are probably more useful than email or chat threats," Sean said. "So rather than swap from one to the other – just learn to better utilize what you work with best." These leaks offer a sobering reminder that email is not secure. But, perhaps, the more important message is that it as a means of communication, it was never very smart. [Image by Alan Levine |Flickr]