OS X Malware Demands $300 FBI Fine For Viewing, Distributing Porn 173
An anonymous reader writes "A new piece of malware is targeting OS X to extort money from victims by accusing them of illegally accessing pornography. Ransomware typically uses claims of breaking the law and names law enforcement (such as the CIA or FBI) to scare victims, but it is usually aimed at Windows users, not Mac users. The security firm Malwarebytes first spotted this latest threat, noting that criminals have ported the ransomware scheme to OS X and are even exploiting a Safari-specific feature. The ransomware page in question gets pushed onto unsuspecting users browsing high-trafficked sites as well as when searching for popular keywords."
Ok? (Score:5, Insightful)
I thought we were past the "being surprised that apple products get malware" stage years ago. This seems like a pretty run-of-the-mill scam. I can't really see what's notable about it. Someone help?
Re: (Score:2, Funny)
Apple never have bugs, everything is perfect. Move along now, citizen.
Re: (Score:2, Funny)
You know the "x on the internet" effect in which it is somehow more novel than x by itself?
Well "x on a mac" effect is even worse.
Re: (Score:3, Funny)
Don't let the patent office hear that.
Re:Ok? (Score:5, Informative)
It's not malware. It's just a webpage.
Gullibility isn't OS-specific.
Re: (Score:2)
Safari isn't OS-specific either, but the primary Safari market is OS X users. So if it's exploiting Safari, then it's probably aimed at Mac users.
Re: (Score:2)
Re:Ok? (Score:5, Informative)
there's no payload and no exploit involved. it's just a webpage that opens another webpage when you try to close it.
Re:Ok? (Score:5, Insightful)
Re:Ok? (Score:4, Informative)
Re: (Score:2)
Based on another article I read, it only works in the Safari browser.
Re: (Score:3, Informative)
It was demonstrated on Safari, but apparently it works on Chrome as well. And I'd say it'll probably work on Firefox too.
It's especially annoying since the browser helpfully restores your last session when they crash, so this site and its 150 popups make it persistent indeed.
Re: (Score:2)
Exactly my first thought. This isn't malware there is nothing particularly OS X about it.
FTFY (Score:4, Insightful)
I thought we were past the "being surprised that websites get hacked" years ago.
This is not malware, it's a hacked site with annoying javascript. The only news here is how desperate some people are to show that OSX is vulnerable to malware - even when the malware never is installed on the system...
Re: (Score:2)
It is malware, it's just not running from a platform usually used for such things.
I guess you think that the various ms word worms aren't malware because they are scripts that run on ms word.
(And yes, those ms word worms are viruses because they are infecting an executable code, even if it's something most people don't realize is executable code. And executable code does not mean
Re: (Score:2)
I guess you think that the various ms word worms aren't malware because they are scripts that run on ms word.
No, they are all location on your system. And they have wide access to your system.
Javascript going a bit wild is not malware, any more than any advertisement or popup is. It's just a hacked site.
Re:FTFY (Score:4, Insightful)
It is malware, it's just not running from a platform usually used for such things.
True, but the important point is the platform in question is not OS X and it is somewhat disingenuous to pretend it is. The platform is "any web browser that automatically reloads the last visited site if you force it to quit".
Re:FTFY (Score:4, Interesting)
No, I am saying OS X is much LESS vulnerable to malware, and that some people are desperate to make it SEEM as though OS X gets malware to the same extent PC's do even when facts do not bear that out.
So desperate in fact, that they jump the gun and claim a Javascript hack is the same as system level malware... all because they didn't simply try to look at the facts at what it was, just react to the presence of "OSX" in the headline.
Re: (Score:2)
I thought the annoying thing about the infection was the ransom notice put up by the bad guys.
Apparently not since the headline was about OS X even though the "malware" is cross-platform thanks to it being only in a web browser.
Don't look at me, chide the person who wrote the article and summary.
Re: (Score:2)
I guess on the bright side, semen being on the keyboard isn't a huge concern compar
Re: (Score:3, Insightful)
Re: (Score:2)
Malware (Score:5, Informative)
Re: (Score:2)
In a minor sense, since the javascript is software.
really there should be a good way to kill the page without resetting everything in the browser.
Re: (Score:2)
Re: (Score:2)
You could enable the the "Develop" menu in preferences and then select "Disable JavaScript" on the problematic page without having to reset anything (you could also open the JavaScript console and stop it). This really has nothing to do with OS X and isn't even browser-specific. There's, of course, a browser-specific answer to it (it only takes a few minutes to create a Safari plug-in to block it).
Re: (Score:2)
But MACS!!! ARE!!! NOT!!! IMMUNE!!! TO!!! BAD!!! THINGS!!! is way catchier.
Filter: I know it's yelling, I am trying to make a point here.
Re: (Score:2)
The definition in the article is "ransomware is malware which restricts access to the computer it infects, spamming the user with prompts that demand a ransom paid for functionality to be reinstated"
I'd say it qualifies. It restricts access to the computer. Malware usually follows the KISS principle better than most other software, which is one of the reasons why it can become so widespread even though a commercial software package can be a pain in the ass to get it to work. If your software absolutely, pos
Safari related bug (Score:2)
Clever use of a bug in Safari, who would have thought of that.. I'd say the US should be able to knock out this site in a few minutes, by using the provisions in the SOPA act. Right?
Sounds like... (Score:3)
Comment removed (Score:3, Insightful)
Re: (Score:2)
A lot of this comes from the effort of MS to turn the web browser into an application front end, and many of the legitimate uses are
obviously fake (Score:2)
Law enforcement is never that straightforward and efficient.
Re: (Score:2)
Or that cheap.
Not malware (Score:2, Informative)
It's just a site that uses javascript to try and keep you from leaving, which is hard to get out of on safari because if you forcequit safari, safari "recovers" the page when you open it again.
Re:Not malware (Score:5, Informative)
Hold down "Shift" when you re-launch Safari - that'll solve that problem.
Art (or spam) imitates life? (Score:2)
The cynic in me wonders how long before this stops being malware and starts being efficient delivery of government policy.
Does not appear to be Safari-specific (Score:4, Informative)
It takes advantage of Safari's "restore last window" feature, which is optional (though on by default in some versions) and also available in Firefox and Chrome (and possibly also on by default in some versions.)
And the OS X version is limited to a browser, as opposed to the Windows versions (which I've seen) which lock you out of the whole OS and can be VERY hard to get around.
The author's suggestion is to reset Safari (as in, clear cache, remove cookies, etc.) but wouldn't you also just be able to turn off the "restore session" option and then force-quit and relaunch? Also, you could relaunch, and press 'escape' or 'command-period' repeatedly to keep the page from loading.
Disable JavaScript (Score:2)
Disable JavaScript[1], close page, there's no step 3.
[1] Preferences -> Security Tab -> uncheck 'Enable JavaScript'
Re: (Score:2)
Or just select the Reset Safari menu option.
See: http://blog.malwarebytes.org/intelligence/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/ [malwarebytes.org]
So Safari is broken? (Score:2)
Re: (Score:2)
There's a simple menu option to reset Safari, which completely eliminates the lingering web page. See: http://blog.malwarebytes.org/intelligence/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/ [malwarebytes.org]
Re: (Score:2)
You can turn off that behavior in the app Preferences, which is not locked out by this "malware." Also, hold shift while launching Safari after the force quit, and it won't re-open to last visited.
Desperate (Score:2)
Calling this malware is a pretty desperate stretch.
We've had these for years (Score:2)
Re: (Score:3)
2003 called, they wanted their scaremongering back.
If you use OSX and practice safe computing (that means NO JAVA FOR YOU), then yea, you're tough as nails to crack. No OS is idiot-proof, though.
The same can't be said for many variants of Windows, especially those still using XP where inserting an infected thumb drive will wreck havoc on your system, hell no, on your entire enterprise network.
Re: (Score:2)
If your 2013 enterprise network is vulnerable to infection spread from a Windows XP machine... trust me, the cause isn't that an unpatched Windows XP installation caught a cough.
Re: (Score:2)
Absolutely no contest there, man, although that doesn't mean it does not happen.
Our hospital network just changed from a major XP install to a Seven one, and most clients are running WITH admin priviledges. Hey, that's not a bad thing on my side: I'm just a practicing MD, but I bet my workstation is far safer than everyone else's because I can fix the dumb stuff they did via GPOs.
Re: (Score:2)
Oh it happens, of course. Did happen in the company I work for. However, only the workstations themselves got infected, nothing did spread over the network
Re: (Score:2)
Re: (Score:3)
Our corporate Macs which I maintain have an antivirus installed due to policy, but the only thing it ever finds is Windows viruses that arrive via email attachments that manage to get through the email gateway scanner.
The #1 thing that protects our Macs: The user does not have administrative credentials.
The #2 thing that protects our Macs: Applications are all deployed via a centrally managed repository, which allows for #1.
Re: (Score:2)
The user does not have administrative credentials.
Ditto on all versions of windows released in the last 7 years.
Re: (Score:2)
XP is more than a decade old. Lets compare XP to a similar vintage of OSX-- what would that be, 10.3? 10.2?
Re: (Score:2)
XP is still on about 40% of Windows machines. The Windows user culture is a big part of why they have a much worse malware problem.
Re: (Score:2)
>Also, last time I inserted any USB into my XP box, it popped up a dialog asking what I should do with it.
Then I have two bad news for you: one, you're not up to date on your security patches, namely disabling autorun from removable drives, and two, you are one social engineering step away from being infected. That's how it starts, you click on an icon that looks like a folder but you're actually running malware.
Re:Not so Invulnerable now, huh...? (Score:5, Funny)
This isn't malware. It's a javascript on a web page.
Calling this malware is like calling a firecracker a weapon of mass destruction.
Re: (Score:3)
So the GP's point still stands then, any platform with a web browser isn't immune to malware or malware-like scams.
Re: (Score:2)
Is it? A malware program like this has been attacking windows computer lately. It scans IPs for port 3389 (remote desktop) and then tries to brute force into the system. Once it's inside, it runs a script that RARs all your files with a huge random password. Then they demand a $2000 ransom to recover it.
It happened to a customer of mine who "refused to run a VPN because it slowed things down" and had port 3389 open to the public. There are also scans on port 5900 (VNC server).
To be fair: neither an antiviru
Re: (Score:2)
This isn't that malware. This is just an annoying bit of javascript.
Re: (Score:2)
It is convenient for some to call this OSX malware, it's called hyperbole [wikipedia.org] and it's disgusting whoever uses it to fearmonger.
Now that I've insulted everyone but Mac users, hopefully they'll keep me from being modded into oblivion
No, still pretty invulnerable... (Score:5, Informative)
No product is totally invulnerable. But it's a simple fact that an OSX user can go a long, long time before ever seeing a virus or malware.
That said - this is not an example of the OS being vulnerable, the whole "malware" is Javascript that takes over Safari a bit, basically a hacked website. I'm not even sure if it works if you have popup blocking on. The computer is never compromised.
Re: (Score:2)
No product is totally invulnerable. But it's a simple fact that an OSX user can go a long, long time before ever seeing a virus or malware.
A user can go along time without seeing virus and malware in OSX because OSX holds 7.18% of the market as opposed to Windows 7 and XP at a combined total of 81%.
If I were to write malicious code with the intent to prey on the gullible and make quick money which OS would I target?
Re: (Score:2, Insightful)
A user can go along time without seeing virus and malware in OSX because OSX holds 7.18% of the market as opposed to Windows 7 and XP at a combined total of 81%.
Who cares why it is true when it *is* true?
It's still the case that by far a non-technical user is vastly safer running a Mac.
If I were to write malicious code with the intent to prey on the gullible and make quick money which OS would I target?
Obviously people too stupid to choose the safer, instead of the more popular, choice.
Re: (Score:3)
> A user can go along time without seeing virus and malware in OSX because OSX holds 7.18% of the market as opposed to Windows 7
That's just the deluded nonsense of a Lemming.
There have been virus ridden minority platforms before. This was quite common back when there were actually other platforms to choose from. Operating systems in those days were much less robust. Viruses were common because those platforms suffered from similar nonsense that Windows does now.
Windows is crap. It gets viruses because it
Re: (Score:2)
Re: (Score:2)
Whatever it takes to make you sleep better. But the illogic of that has long been shown (e.g., compromised web servers used to be nearly all IIS despite it having a minority share -- yeah, times have changed, but that just further illustrates that "market share" is not a controlling factor). Your overly facile argument reveals how little you know of the business.
In reality malware was originally written by people trying to show off their "super skills" or who had a grudge of some sort. By and large they wer
Re: (Score:2)
On paper Windows has always been more secure than Mac OS. It isn't the OS
1) A user community that upgrades quickly
2) A willingness to break backwards compatibility
3) Apple's ability to get their community to fall in line if there is a crisis
4) A community with a heavy percentage of computer enthusiasts.
etc... means that Apple doesn't have the problems that Windows does.
Re: (Score:3)
Re:Not so Invulnerable now, huh...? (Score:5, Funny)
Just a rouge website with some crafty Javascript!
What does the color of the web page have to do with anything?
Re: (Score:2)
Re: (Score:2)
"The Rouge Rogue" sounds like a supervillian from the 1950s!
Re: (Score:2)
Different viruses. The one for windows attacks through RDP port. I've seen scans on port 5900 too. Nothing would keep a similar virus from attacking Mac if you run any sort of remote access and a weak password.
The virus for windows encrypt your files and demands a ransom. Nothing would keep a similar virus from doing the same on a mac, since you don't need admin privileges or any sort of exploit to manipulate your own files.
Re: (Score:2)
The virus for windows encrypt your files and demands a ransom. Nothing would keep a similar virus from doing the same on a mac, since you don't need admin privileges or any sort of exploit to manipulate your own files.
Almost certainly would be a trojan rather than a virus in that case.
Mind you, it's a bit rich to equate "Macs don't get viruses" (true) with "Macs are immune to all forms of malware" (patently false).
Re: (Score:2)
There is no meaningful distinction between a "trojan" and a "virus". The old, simplistic application of the terms "trojan", "virus" and "worm" never really made that much sense, but it is pretty meaningless now. Each of those designations simply refers to a method of infection and nothing prevents multiple vectors from being employed. And plenty of malware does that. In fact, the majority I run across do none of those things.
The predominate vector in use today is malvertising. It generally exploits a vulner
Re: (Score:2)
That's pretty much my point - Macs may not get viruses in the traditional sense of the word, but the computer virus in its traditional sense is more-or-less extinct. They're sure as hell vulnerable to malware, which is a far better term for modern use.
Re: (Score:2)
> Nothing would keep a similar virus from attacking Mac if you run any sort of remote access and a weak password.
It's funny you should mention that because I run a daemon that checks /var/log for suspicious activity. When it finds something that looks like a brute force attack, it blocks the attacker with a firewall rule.
Now this thing is a nice ready made app available through my distro's standard repos. But in the old days, I cobbled the same thing together with a bash script.
If you aren't operating un
Re: (Score:2)
Good for you. I use port knocking.
But for the non-tech folk out there who just thought it was going to be cool to be able to check his home computer from work, you can't blame him for trying. Maybe he thought clicking "enable remote access" didn't have such heavy security implications.
We learn from our own mistakes. Given your 4 digit UID, I seriously doubt your record is spotless. I'm sure you had a system or two compromised until you learned to become almost paranoid about security.
Not a virus, how does your foot taste? (Score:5, Insightful)
Pretentious? Or maybe just realistic? (Score:3)
I love how the Windows users get *so* irritated when Mac users point out to them how their machines generally "just work" without all the virus and malware hassles, need for (often costly) anti-virus software and subscriptions, etc.
The only people I see really trying to "pound some sense" into OS X users to use anti-virus software are the companies hawking the stuff.
I use both Windows machines and Macs practically every day. I work in a corporate environment where we're pretty much a 50/50 mix of both platf
Re: (Score:2)
Has it occurred to you that PC users get nailed all the time while Mac users mostly don't. They are pretentious because it is justified by experience.
And no a misbehaving website is not going to "pound sense into them" because they are being quite sensible.
Re: (Score:2)
What good does anti-virus software even do. Every machine I have come across that is infected has an up to date av package on it. It doesn't even slow down an infection anymore.
Re: (Score:3)
A proper anti-virus should work quietly behind the scenes. There's no such thing as a fool-proof AV any more than there's a 100% effective vaccine. For every infected machine we have, we have several dozen more that report blocking infections or at least crippling the malware.
Re: (Score:2, Flamebait)
Re: (Score:3)
Are you saying you don't use an AV on any of your machines?
Re: (Score:3, Informative)
Well, I certainly don't. As far as I am concerned, it is the same attitude you hear when people say "But we have to do something!!!". It doesn't work. Don't bother. Use a more secure browser. Use an ad-blocker. Have a decent firewall installed. These will help. Perhaps you can enlighten us on which Antivirus program you use on the networks you manage. Then tell us which infections it stopped. I have customers who own solutions from Symantec, VIPRE, Kaspersky, McAfee, AVG, Avira, and Trend (among ot
Are you sure? (Score:2)
[...] and so far Windows Defender and MS Internet Essentials have blocked everything.
That you know about...
Re: (Score:2)
I've been running OSX since 10.1 no anti-virus no problems. And since then: wife, daughter, parents, inlaws, friends.
OSX people mostly don't get virus. They aren't immune but they are rare and Apple often handles them on their end.
Re: (Score:2)
Perhaps you should become aware of XProtect.
Re: (Score:3)
If "any old one would do" then you should realize that unless they are running ancient version of OS X that all macs have antivirus built in. Apple added it several years ago and updates it regularly.
Re: (Score:2)
It's more of a liability issue, that's why we're not too concerned with which AV they use. They sign off on their computer being protected, and if it gets infected, it's on them. Most people bitch about having to sign off on having some form of malware protection because "it's a Mac"
Re: (Score:2)
Re: (Score:2)
A pre-installed antivirus is worse than useless.
Note, for example, that MSSE was a perfectly good antivirus until Microsoft baked it into Windows 8. Then, surprise surprise, it started failing every AV comparatives, because a every virus was compiled specifically to evade detection.
Lets put it another way. If every OSX box has the same anti-virus updated on the same schedule, why would anyone release a virus for OSX that didnt 1) evade current detections and 2) break the updating mechanism so that it cant
Re: (Score:2)
You can't break the updating mechanism. That runs in a protected mode applications don't have access to it. That's one of the differences between capabilities and permissions, which NT supports too but Microsoft can't use as aggressively because of worries about backwards compatibility.
Re: (Score:2)
Right, that's not because these users are not aware that there's a threat of getting some kind of malware on their machine. This is because the problems caused by the antivirus software are as bad as the problems caused by a virus, so basically, you're asking them to guarantee that they have something malicious on their system, rather than simply having a 1 in a million chance that they do.
Re: (Score:2)
... and copyright infringement is a tort, not a crime.
Re: (Score:2)
Re: (Score:2)
I find a surprising number of people who don't know the difference, not just dumb people but even those with normal intelligence who are competent in their fields.
Perhaps we can illustrate with movie examples. CIA = Jason Bourne, assassin we send abroad to kill foreign nationals who create trouble for the U.S. gov't. They only operate outside the USA, as they are forbidden by law to spy on or kill anyone inside the USA.
FBI = Jodi Foster in Silence of the Lambs, police who catch criminals inside the USA. The
Re:makes sense (Score:4, Insightful)
Still bitter about that Mac user stealing your girlfriend, I see...
Re: (Score:2)
Wow. 1999 called. They want their meme back.
Re: (Score:2)
echo 'Mac user here.'
echo 'Hello!'
sudo killall -u slashmydots
echo 'Goodbye!'