Trojan Alert: Fake Adobe Updater and "Diaoyu PDF"
As if Adobe doesn’t already get enough bad press in the Apple world, a new malware attempt has been spotted that pretends to be an update to Adobe’s Flash Player. Dubbed “Flashback,” it appears to be a legitimate update and includes the same logo and graphics that Adobe uses for their Flash products. However, it does not update Flash; it installs a backdoor that allows a hacker to access your system.
Similar to “Mac Defender,” Flashback makes every attempt to look legit so you will install it. Most of the time when malware hits a Windows system, it installs itself without any indication that anything is happening (like a robber climbing in through a back window of your house). OS X does not allow this kind of hidden infection, so in order to get around your Mac’s security, the malware preys on the weakest link in the fence—the person using the system. Somehow it has to trick the user into running the application so the malware can be installed. (Criminals will sometimes pose as police officers or utility workers to gain access to your home. They look harmless, so you allow them access.)
Flashback does not spread on its own; it has to convince people to download and install it. As with most malware, it plays to the public’s obsession with current events and scandal to spread. For example, a webpage claims to contain nude photos or a “leaked video” of someone famous. A popular tactic used on Facebook advertises a controversial video, just begging people to click on it. The “video” leads to a website that says an update to Flash is needed and offers to install it. There’s no video, there’s no Flash update, there is just the backdoor program that now allows someone to steal your data.
The best way to avoid this kind of infection is to download updates only from legitimate sources. For Mac OS X updates, the built-in Software Update will keep you current, but for other applications and utilities, you have to check their site or rely on their own update alerts. If you’re surfing the Net and are told that you need an update to some component of your operating system, ask yourself, “Is this in response to something I just did?” If you clicked on a link to a video on YouTube and were told that you needed an update to your Flash Player, it’s most likely real. YouTube is a trusted site. If you’re on some other back-alley-type site, you can’t always be sure.
The update notification MIGHT be real, but hackers are getting smarter. Not only are they finding new ways to trick people, but they also know what people are searching for and try to lead them down an unsafe path to get it. If you are at all in doubt, check the official site to see if there really is an update available. For Flash Player, go to adobe.com and check to see if there really is a new version of the Flash Player or Adobe Reader. If there is, download it from there so you know you have the real deal. If you go back to that link and it now works, it’s probably safe. If it still says you need an update, the link could be a bad place to go and you should navigate away from that page.
Another recent hack attempt takes the form of a PDF file. It claims to be a document outlining the ongoing dispute between China and Japan over ownership of the Diaoyu/Senkaku Islands. It’s not actually a PDF: it’s an application that opens a document and infects your system with a backdoor program to allow remote access. The idea of an infected PDF file is not new, and has been plaguing Windows users for years, but this is the first time someone’s tried it on a Mac. Oddly enough, this attempt didn’t work, but people who disassembled the file found suspicious code that at least made the attempt. The next version of it may actually work, so there’s one more thing to watch out for.
As with anything else, my recommendation is a) watch where you click and b) install something to actively scan your system so you don’t get caught by the latest scam. Sophos’s free anti-virus for Mac is one such solution.