share share via: 
 
 
 
 
 
 
 
 81 days 
 
 Sophos Security 
 
 A new Trojan known as "Sabpab" could hurt Mac users who run Java and Microsoft Word. Security researchers are warning users to make sure their computers have the latest software updates from both Apple and Microsoft, and to use anti-virus software. In some cases, manual removal of Sabpab may be needed. 
 
 
 
 Word about Sabpab comes on the heels of another nasty piece of malware, Flashback, that infected up to as many as 600,000 Macs, security experts said, by exploiting a vulnerability in Java software. Apple last week issued a software-base removal tool for that malware, which can be used by criminals to steal personal information, including passwords. 
 
 
 
 Both Sophos Security and Kaspersky Lab warned users about Sabpab. One version of the malware takes advantage of the same Java exploit used by Flashback. 
 
 The other version of the malware arrives in an email attachment called "10th March Statemnet" (with "statement" misspelled). 
 
 
 
 "The name of the file ("10th March Statemnet") is directly linked with the Dalai Lama and Tibetan community," said Costin Raiu of Kasperky Lab. "On March 10, 2011, the Dalai Lama released a special statement related to Anniversary of the Tibetan People’s National Uprising Day -- hence the name." 
 
 
 
 Says Graham Cluley, senior technology consultant at Sophos: 
 
 
 
 If you open the boobytrapped Word document on a vulnerable Mac, a version of the OSX/Sabpab Trojan horse gets installed on your computer opening a backdoor for remote hackers to steal information or install further code. 
 
 As a decoy, a Word document is dumped onto your drive and displayed -- effectively acting as a camouflage for the Trojan's true intentions. 
 
 
 
 Mac users, Cluley says, may be caught off guard by the attack, "as there is no prompt to enter your username or password when the malicious software installs itself onto your Mac. 
 
 
 
 Microsoft released a security update in 2009 for Microsoft Office for Mac users that will take care of another recent crop of malware. "Of course, it would also be sensible to update your installation of Microsoft Word -- as a patch has been available for the vulnerability being exploited here since 2009," says Cluley. 
 
 
 
 On Monday, Microsoft confirmed that the security update will cover Sabpab. 
 
 (Msnbc.com is a joint venture of Microsoft and NBC Universal.) 
 
 
 
 If you use Norton AntiVirus or Symantec Endpoint Protection for Macintosh, Symantec has more information here about how to remove Sabpab. 
 
 
 
 At this point, while "there no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," wrote Cluley, and take steps to protect themselves, whether it's with Sophos' software or another company's. 
 
 
 
 "Mac users -- please get an anti-virus, for goodness sake," added Cluley. "If you don't want to pay for one, there is free anti-virus for Mac home users available for download." 
 
 
 
 While these recent attacks can be handled, they won't be the end of them. Dennis FIsher of Kaspersky, in a blog posting last month, wrote, "Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers in China now have taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in the Windows world." 
 
 
 
 Check out Technolog, Gadgetbox, Digital Life and In-Game on Facebook, and on Twitter, follow Suzanne Choney. ||||| (Reuters) - The first known ransomware attack on Apple Inc’s (AAPL.O) Mac computers, which was discovered over the weekend, was downloaded more than 6,000 times before the threat was contained, according to a developer whose product was tainted with the malicious software. 
 
 Hackers infected Macs with the “KeRanger” ransomware through a tainted copy of Transmission, a popular program for transferring data through the BitTorrent peer-to-peer file sharing network. 
 
 So-called ransomware is a type of malicious software that restricts access to a computer system in some way and demands the user pay a ransom to the malware operators to remove the restriction. 
 
 KeRanger, which locks data on Macs so users cannot access it, was downloaded about 6,500 times before Apple and developers were able to thwart the threat, said John Clay, a representative for the open-source Transmission project. 
 
 That is small compared to the number of ransomware attacks on computers running Microsoft Corp’s (MSFT.O) Windows operating system. Cyber security firm Symantec Corp (SYMC.O) observed some 8.8 million attacks in 2014 alone. 
 
 Still, cyber security experts said they expect to see more attacks on Macs as the KeRanger hackers and other groups look for new ways to infect Mac computers. 
 
 An Apple iPhone is pictured next to the logo of Apple in Bordeaux, southwestern France, February 26, 2016. REUTERS/Regis Duvignau 
 
 “It’s a small number but these things always start small and ramp up huge,” said Fidelis Cybersecurity threat systems manager John Bambenek. “There’s a lot of Mac users out there and a lot of money to be made.” 
 
 Symantec, which sells anti-virus software for Macs, warned on its blog that “Mac users should not be complacent.” The post offered tips on protecting against ransomware. (symc.ly/1puolix) 
 
 The Transmission project provided few details about how the attack was launched. 
 
 “The normal disk image (was) replaced by the compromised one” after the project’s main server was hacked, said Clay. 
 
 He added that “security on the server has since been increased” and that the group was in “frequent contact” with Apple as well as Palo Alto Networks, which discovered the ransomware on Friday and immediately notified Apple and Transmission. 
 
 An Apple representative said the company quickly took steps over the weekend to prevent further infections by revoking a digital certificate that enabled the rogue software to install on Macs. 
 
 Transmission responded by removing the malicious 2.90 version of its software from its website (www.transmissionbt.com). On Sunday, it released version 2.92, which its website says automatically removes the ransomware from infected Macs. 
 
 Forbes earlier reported on the number of KeRanger downloads, citing Clay.
– With popularity comes some nasty bugs for the unwary: A Trojan known as "Sabpab" is the latest piece of malware infesting Macs, according to security firm Sophos. The malware is spreading through a weakness in Java and through an infected Word document purporting to be a statement from the Dalai Lama, reports MSNBC. Like others of its kind, Sabpab enables hackers to steal personal information and send remote commands to computers. The spread of Sabpab comes soon after warning about the "Flashback" malware believed to have infected up to 600,000 Macs. Experts say these kinds of attacks tend to come in waves, so there may be many more Mac viruses on the way. "Although there's no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," writes Greg Cluley at Sophos. "Mac users—please get an anti-virus, for goodness sake."