New OS X Trojan Adware Injects Ads Into Chrome, Firefox, Safari 129
An anonymous reader writes "A new trojan specifically for Macs has been discovered that installs an adware plugin. The malware attempts to monetize its attack by injecting ads into Chrome, Firefox, and Safari (the most popular browsers on Apple's desktop platform) in the hopes that users will generate money for its creators by viewing (and maybe even clicking) them. The threat, detected as "Trojan.Yontoo.1" by Russian security firm Doctor Web, is part of a wider scheme of adware for OS X that has "been increasing in number since the beginning of 2013," according to the company."
Clarification (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3)
It's their own fault. They do automatic signup and usage of advertising, without ever meeting their customers or getting a contract. Imagine an ad agency doing this with radio and television stations; you could just mail in a letter saying you are manager of WAFK 101.1 FM, and their spot played 27 times, so please pay up.
Better Question (Score:5, Interesting)
Can Someone explain to me why Yontoo is detected on the Mac Platform but on Windows it's totally ok.
While we're at it, why are any of these still not detected by any malware scanner. Even as a Potentially Unwanted Program? I'm sure just about anything listed here does a lot more malicious stuff than anything spyware like Gator ever did.
Anything from Conduitt
Anything from Mindspark Interactive
myfuncards
arcadecandy
arcadeweb
funweb
freeze.com
pricegong
getsavin
coupon wonderland
fantistigames
big fish games
quiklinkx
defaulttab
mywebsearch
we care ASCPA Reminder (my personal favorite. When you uninstall it, it basically accuses you of wanting to kill puppies.)
shop to win
inbox toolbar
anything from Crawler
24x7 help
blekko
dealply
ETC
Most of the above either popup ads, install, or trick users into installing more junk like registry scanners, fake flash players and the like. Yet almost no scanner I've found short of JRT or ADWcleaner gets rid of these things.
It's about time these AV companies wake the heck up and realize that Spyware is back disguising itself as adware and is more prevalent than ever,
Re: (Score:2)
Hello,
Not sure which anti-malware software you are using, but a quick check of my employer's gave me half-a-dozen hits:
Not sure about the others, but would not be surprised if they are detected, just with a different name than you wrote. Maybe you just need to ch
Re: (Score:2)
My guess is that you work for ESET.
I recently had a job change a few months ago, and at my current job we have been using ESET NOD32 Antivirus Business Edition 4 (I'd like to move to the latest version, but Labtech is keeping us on 4)
From my Experience, ESET does do a pretty good job detecting PUPS, but in our console, when we look at the threat log, it constantly says "unable to clean" I'm sure it's just a setting wrong in the policy but i'm still learning the console since my previous employer used Sophos
Re: (Score:2)
Hello,
A lucky guess.
I'm not as familiar with the remote management side of things as I used to be, but I suspect that with potentially unwanted applications (PUA), the option to use would be "delete" instead of "disinfect." The latter is really only applicable to parasitic infecting viruses which actually modify host code. In the case of a PUA, there is no clean host program inside the PUA, it's a PUA all the way down.
I would suggest checking with the LabTech or ESET support folks to verify the settings,
Re: (Score:2)
Did I miss a memo about Big Fish Games, or are they evil on Windows? I thought the were a legit game vendor... at least, their Mac client doesn't seem to do anything too stupid/nefarious.
Re: (Score:2, Funny)
Meanwhile the communists using Linux are not a target since they all have ad blockers and get their content via torrents anyway.
Great Strategy (Score:1)
>hopes that users will generate money for its creators by viewing (and maybe even clicking) them
Nothing makes me want to support a company more than when in injects advertising onto my computer.
Re: (Score:1)
Wait, are you saying that there's no such an urban myth among the prime Apple consumers that Apple products can't be infected by malicious software? Or you're saying that it is indeed the case that there are no worms, viruses or ad-ware on on OS-X devices.
If any of these two, I would call you ignorant fool my self.
I'll worry when it can spread without an installer (Score:5, Insightful)
Re: (Score:2, Funny)
Re:I'll worry when it can spread without an instal (Score:5, Insightful)
THIS!
The user is a flaw every OS has.
Re: (Score:1)
Only now, it's "Blame the user" instead of the way it used to be - "Blame that Buggy OS" ..
Re:I'll worry when it can spread without an instal (Score:5, Insightful)
Not at all.
Blame the buggy OS is when you get a nice drive by install or virus. Adware that requires a user to install is always the users fault.
Re: (Score:2)
Maybe they are complaining that MacOS runs any software you like, unlike iOS where everything is curated by Apple. This "criticism" (I view it as a complement) is often levelled at Android, for example.
Re: (Score:2)
Then you tell the user to do a jailbreak. Sure it might not always work, but conning users is conning users.
I would rather take the risk, than have my ability to own my computers stolen from me.
Re: (Score:1)
Then you tell the user to do a jailbreak.
Get real.
Re: (Score:2)
Things like this have happened and users have done it.
They get an email telling them about free applications if they visit this website with their iphone. This was back when a webpage could do a jailbreak.
Re: (Score:2)
This was back when a webpage could do a jailbreak.
Oh, sure. Back then it was possible. It's certainly possible to trick a proportion of people to click on a link, and if that does a jailbreak then it's done.
Mind you, to actually be worth the criminal's effort, they'd then have to get the user to also install the app. And it's going to be hard when the last link you gave them took them through a worrisome jailbreak procedure.
However, even that faint possibility is in the past. Drive-by jailbreaking has been dead since July 2011.
Re: (Score:2)
Until another such flaw is found.
Nothing is perfect, this sort of DRM being the least likely to be perfect. You are trying to secure a device against its owner.
Re: (Score:2)
Until another such flaw is found.
Maybe, but that would be a flaw in the OS. Again, the system removes the user as being the flaw that allows trojans to be installed.
You are trying to secure a device against its owner.
No, we are talking about security against malware here. Contrary to your claim, the user is not a flaw in this regard with iOS and the games consoles.
Re: (Score:2)
You might want to think so, but it is a flaw with both of those devices.
If the user wants to install malware that is no different than any other application. The user having control is more important that protecting the system from him.
Re: (Score:2)
The user having control is more important that protecting the system from him.
(Using your definition of control)
It might be to you. For plenty of people, having no worries about software that's downloaded, and having a one stop shop to get apps are both advantages. For them there aren't any downsides.
Re: (Score:2)
There will be when they find out something they wanted is not in the app store. Let someone else pick what you can do and you will soon find they don't like the same things you do.
Re: (Score:2)
There will be when they find out something they wanted is not in the app store.
If.
As I pointed out before, this isn't something unique to Apple, console manufacturers have had the same power of selection for decades. And funnily enough, people don't have a problem, because they don't come across types of games that they want, but aren't allowed. But they do get the advantage that selection keeps most of the shit out.
Pretty much the only people that are complaining about Apple's curated store are Android users who don't even have an iOS device. And they face the uncomfortable truth tha
Re: (Score:2)
When not if. A recent case was some games were removed, before that is was tethering applications, and before that other bullshit.
In consoles what happens is a person buys all the consoles to get the games that are exclusive to each.
I will not respond to you last statement since it is a lie. Those stores are just as curated.
Re: (Score:2)
I will not respond to you last statement since it is a lie. Those stores are just as curated.
If they're just as curated, how come there's so much Android malware?
Re: (Score:2)
Find me some in the google play store. I will wait.
Actual Malware is generally found in pirated apps.
Also there is not much of it, I have never seen it live.
Stop trolling, and educate yourself. Either way user control is more important than safety.
Re: (Score:2)
Find me some in the google play store.
It doesn't seem hard to find.
http://arstechnica.com/security/2012/07/more-malware-found-hosted-in-google-android-market/ [arstechnica.com]
http://wmpoweruser.com/trend-micro-one-in-ten-google-play-store-apps-is-malware/ [wmpoweruser.com]
http://thenextweb.com/insider/2013/02/03/android-malware-emerges-on-google-play-which-installs-a-trojan-on-your-pc-uses-your-microphone-to-record-you/ [thenextweb.com]
Oh, and of course not all app types are available from Google Play Store are they? Where are the ad-blockers for example?
Stop trolling, and educate yourself.
It's you that headed down this path. I m
Re: (Score:2)
Removing the user flaw, has costs that are not acceptable.
No, this is a truth. I say that because one day you will find it out yourself. Once you trade freedom for security you will have and get neither.
Re: (Score:2)
Sorry, but I won't be drinking the OSS Koolaid. It looks every bit as stupid as the Moonies or the Scientologists to me.
Choosing to buy a product of any description is not trading freedom for anything. It's exercising freedom. That's where your religion goes wrong.
Re: (Score:2)
Practicality is not a religion.
Nor do I have any interest in OSS. Free software, yes.
This is not about that though, this is about having a useful device.
Re: (Score:2)
Only the approach is different. There's nothing preventing you from convincing users to install a web browser that provides some customization features and displays extra ads in exchange. And if you can convince them to install it and use it, you now have adware that isn't really substantially different from adware that installs itself as a Safari browser extension on the desktop.
So yes, adware that requires a user to expli
Re: (Score:2)
There's nothing preventing you from convincing users to install a web browser that provides some customization features and displays extra ads in exchange.
Unless the app is up front about this in it's description, then the app will be rejected. If it *is* upfront, and the user chooses to install it anyway, then it's not a problem. The user decided the tradeoff was worth it for the features they are getting.
Re: (Score:2)
Re: (Score:2)
Well not quite. This is where the curated app store of iOS comes in. The user can only install apps from a store that requires the apps to be prevetted. And the store will remove any malware that manages to sneak past the vetting process, as soon as it becomes known.
This is removing user stupidity as a vector for trojans.
Re: (Score:2)
This is removing the ability to use your own devices as you see fit.
They don't only remove malware, they also remove useful tools. This is why iOS has no good wifi scanning tools for example.
Re: (Score:2)
Well that's the other side of the trade off. And one that lots of people are happy to make. Being safe from malware being more important to them than wardriving tools, and the other things that aren't on the store.
But for sure iOS, and the games consoles, and every other platform that don't allow the user to download from random sites are exceptions that prove "The user is a flaw every OS has" to be wrong.
Re: (Score:2)
What you call war driving tools I call site survey tools I use for my job.
Append on a computer the user is allowed to own and the statement is true again.
Re: (Score:2)
Yes.
This isn't "malware;" it's "stupidware."
hawk
Re:I'll worry when it can spread without an instal (Score:5, Funny)
Like RealPlayer
Re: (Score:1)
At that point, you could have installed something far worse then adware
Like RealPlayer
Or QuickTime. Wait.... OH GOD IT'S A MAC IT ALREADY HAS QUICKTIME.
Re: (Score:3)
QuickTime on Mac is pretty useful. It's shit on WIndows. On the Mac, QuickTime can be used for screen recording and is generally pretty fast. Never knew how useful a screen recorder was until my friend needed to record a training session. Windows version is like me trying to run a marathon in a business suit, isn't very functional and pretty slow.
Re: (Score:2)
Jeez, you just reminded me of one of the things that pushed me to switch to OSX. The Realplayer menace - shudder.
Re: (Score:1)
Re: (Score:3)
Re: (Score:2)
Linus himself owns apple machines.
...and he runs Linux on them, your point is?
Re: (Score:3, Funny)
You and the summary left out the best part: the installer's name is "Free Twit Tube." Almost as bad as a girl on a dating site agreeing to go out with someone with the username "DonkeyPunchLover."
Re: (Score:3)
Exactly. And given past trends, it's entirely likely that there will be a malware definition update pushed out to all Macs running the last few iterations of OS X within the next 24-48 hours, rendering this threat moot.
Moreover, even in the case of idiotic users, the default behavior on all new Macs is to not allow installs from unregistered developers. I.e. This malware will only work against folks who ignore all warnings and are using something other than the latest release, which had an extremely fast ad
Re: (Score:2, Insightful)
And then, after downloading, and authenticating the install, OS-X also reminds you that it is from the Internet and you might want to pause and consider before actually launching the program.
It really does target people who *want* to run it.
Re: (Score:2)
Re:I'll worry when it can spread without an instal (Score:4, Insightful)
Unlike in Windows, where you simply have to view an advert in Internet Explorer and your system is infected...
IE itself is exploited no more than 10% of the time to infect a Windows computer. Windows gets drive-by infections these days from exploits in Java, Acrobat, and Flash, which are not unique to Windows. There's no reason for attackers to focus on a single browser any more when they can instead target a plugin like Java that works across all browsers.
Re: (Score:2)
There's no reason for attackers to focus on a single browser any more when they can instead target a plugin like Java that works across all browsers.
Java... Write once, Infect everywhere!
Re: (Score:2)
Yontoo (Score:2)
Re: (Score:3)
Luckily for Mac users though, that if it installs from a standard PKG or MPKG (which another comment above basically states) you can go to /var/db/receipts and get the entire bill of materials for that package with the lsbom command.
Pipe that into a delete routine, and you're all set.
(this works as a fairly effective uninstall for most PKG installs)
Re: (Score:2)
Interesting. Is that how apps like AppZapper know what to delete when uninstalling some random app?
I'm not sure how useful it would be for malware though, because when it's run for the first time, it can of course create new copies of files with different names and/or locations.
Re: (Score:2)
I haven't looked at AppZapper, but I did write a perl script that would uninstall just about any PKG by reversing the order of the lsbom output, and then deleting files, and deleting the directory if it was empty.
Worked like a champ for getting rid of an application that liked to scribble all over the disk, rather than be a good Mac app and self-contain...
As for the malware thing, it's got to run from somewhere. As they can't even be bothered to find themselves a proper exploit to get installed, I doubt th
Here it comes (Score:1)
In this corner, wearing the green trunks, the Apple FanBoys. In the opposing corner, wearing the blue trunks, the Windows FanBoys. Standing outside the ring, holding the steel folding chair and molotov cocktail, the Linux FanBoys. LET THE GAMES BEGIN!
Re: (Score:2)
uh oh (Score:5, Interesting)
Re: (Score:2)
Lies..... (Score:1)
Lies.. All Lies.. Mac's can't be infected.
Best thing about adware on OS X? (Score:1)
So, use Opera... (Score:2)
ibid.
Scrolling Trolling (Score:2)
Scrolling Trolling is about as much fun as Strolling Bowling [youtube.com]. I can't believe the Slashdot devs can't fix this.
Re: (Score:2)
Re: (Score:3)
Is that you, Ron Paul? (Score:1)
Inb4 apple h8rz (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Interesting)
Apple intentionally mislead people. It does not matter if they are technically correct, they left out key information that would have assisted the listener in understanding the issue better. That makes it AOK in my book at least to gripe about the fact that Apple mislead the pleebs.
Food for thought::
Bill Clinton said he did not have sex with Monica, and he didn't, and people still got piss
Re: (Score:1)
Re: (Score:1)
I understood you correctly if you were saying that apple never made the overt claim that they are safe from trojans. Therefore people should not make any disparaging comments concerning their previous statments.
My supposition is because they made an overt claim that it was safe from viruses, that they implied that they were protected from malware. Due to the implication that Apple was safe and others were not, that they mislead consumers.
T
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Given the percentage of people who watch television and the number of some of the advertisements I've seen, I'd venture that most people consider Trojans to be a brand of raincoat to be worn by Mr. Willie "Pud" Johnson for, among other things, preventing the spread of viruses and such.
Re: (Score:2)
One should not be responsible for the ignorance of others.
If I'm going to drive in U.K., it's my responsibility to keep the car on the "wrong side" of the way. No british should be liable if he says to me "keep you car on the right side of the street", and I take it literally.
The same should happen with computers. There's a clear, well known, accepted definition for Virii and Trojans. For decades now. They invented this "malware" concept for a good reason.
Re: Inb4 apple h8rz (Score:3)
Re: (Score:3)
Re: (Score:2)
Furthermore, even if you don't use the blacklisting, both Lion (Pretty sure, since 10.7.4) and Mountain Lion both have gatekeeper. Which if enabled or left enabled will warn that this software is not signed.
Sure, if you have this option turned off then you can run and install it like any other software. But if you've turned that option off, it is expected that you know what you are doing.
Re: (Score:2)
But Windows is protected. I smell a conspiracy.
Re: (Score:2)
shred -fuz /*
Re: (Score:2)
shred -fuz /*
If you're not logged in as root (and many linuxes strongly discourage it), you'd need a sudo in front of that. Anyway, /*
sudo srm -rz
would work better, as it will wipe many jounaled file systems. Both would leave fragments around on NFS volumes, however.
While you're at it, don't forget to leave the shred or srm command until last, after you've cleaned "empty" space and the swap file. To clean empty space, first fill it with:
sudo scrub -X -s 1G /
Some versions of scrub will also remove the file
Re: (Score:2)
... aaaaand this is why I continue to visit Slashdot! Great post, man. Just spiffy. /nosarc
Re: (Score:2)
How can you use sudo without the account password? Also, what if sudo is not installed?
Re: (Score:2)
Obvious answer is a good configure script :)
Re: (Score:2)
Re: (Score:1)