blog trackingRealtime Web Statistics MalwareasPDF Archives | Gregory D. Evans | Worlds No. 1 Security Consultant | Gregory D. Evans | Worlds No. 1 Security Consultant

Posts Tagged ‘malwareasPDF’

Apple blocks malware-as-PDF threat but new attack emerges

Apple has quietly added detection for the recent malware attack that used PDF files as lures to trick Mac OS X users into downloading a malicious Trojan dropper.

The detection was added into the rudimentary XProtect.plist malware blocker built into Mac OS X.

The malware, flagged as a trojan dropper, installs downloader component that downloads a backdoor program onto the system, while camouflaging its activity by opening a PDF file to distract the user.

However, in what has become a classic cat-and-mouse game, researchers have spotted a new Mac malware threat posing as a legitimate Flash Player installation package.

Researchers find Mac OS X malware posing as PDF file ]

Intego explains the characteristics of the new threat:follow Ryan Naraine on twitter

Users visiting certain malicious websites may see a link or an icon to download and install Flash Player. Since Mac OS X Lion does not include Flash Player, some users may be fooled and think this is a real installation link. When they click the link, an installation package downloads, and, if the user is using Safari as their web browser, the Mac OS X Installer will launch. (Safari considers installer packages, with .pkg or .mpkg extensions, to be “safe” files and will launch them after download, if default settings are used.)

If the user proceeds with the installation procedure, the installer for this Trojan horse will deactivate some network security software, Intego said.

After installation, [it] will delete the installation package itself. The malware installs a dyld (dynamic loader) library and auto-launch code, allowing it to inject code into applications the user launches. This code, installed in a file at ~/Library/Preferences/Preferences.dylib, connects to a remote server, and sends information about the infected Mac to this server: this includes the computer’s MAC address, a unique identifier. This will allow the malware to detect if a Mac is infected.

The company said it has spotted this new malware in the wild but notes that it is not widely distributed.

Article source:

View full post on National Cyber Security » Virus/Malware/Worms

Gregory Evans | LinkedIn

Interview With Gregory Evans

Gregory Evans Security Expert

Gregory Evans on Cyber Crime

My Twitter

  • Cyber Security News Today is out! @gregorydevans #hacker
    about 1 hour ago
  • RT @GregoryDEvans: Another Case in Which a School District Is Found Not Liable for Student Bullying – The S #securi…
    about 7 hours ago
  • RT @GregoryDEvans: Credit card skimmer found at another Butler County gas station
    about 18 hours ago
  • RT @GregoryDEvans: #galaxylife #samsung4life Another hospital’s been hacked, this time in Kansas
    about 18 hours ago
  • RT @GregoryDEvans: Cyber Security Takes Centre Stage in UK Government’s Strategy #security #hacker #HTCS
    about 1 day ago By Gregory D. Evans

Hacker For Hire By Gregory Evans

Gregory D. Evans On Facebook

Parent Securty By Gregory D. Evans

National Cyber Security By Gregory D. Evans

Dating Scams By Gregory Evans