share share via: 
 
 
 
 
 
 
 
 81 days 
 
 Sophos Security 
 
 A new Trojan known as "Sabpab" could hurt Mac users who run Java and Microsoft Word. Security researchers are warning users to make sure their computers have the latest software updates from both Apple and Microsoft, and to use anti-virus software. In some cases, manual removal of Sabpab may be needed. 
 
 
 
 Word about Sabpab comes on the heels of another nasty piece of malware, Flashback, that infected up to as many as 600,000 Macs, security experts said, by exploiting a vulnerability in Java software. Apple last week issued a software-base removal tool for that malware, which can be used by criminals to steal personal information, including passwords. 
 
 
 
 Both Sophos Security and Kaspersky Lab warned users about Sabpab. One version of the malware takes advantage of the same Java exploit used by Flashback. 
 
 The other version of the malware arrives in an email attachment called "10th March Statemnet" (with "statement" misspelled). 
 
 
 
 "The name of the file ("10th March Statemnet") is directly linked with the Dalai Lama and Tibetan community," said Costin Raiu of Kasperky Lab. "On March 10, 2011, the Dalai Lama released a special statement related to Anniversary of the Tibetan People’s National Uprising Day -- hence the name." 
 
 
 
 Says Graham Cluley, senior technology consultant at Sophos: 
 
 
 
 If you open the boobytrapped Word document on a vulnerable Mac, a version of the OSX/Sabpab Trojan horse gets installed on your computer opening a backdoor for remote hackers to steal information or install further code. 
 
 As a decoy, a Word document is dumped onto your drive and displayed -- effectively acting as a camouflage for the Trojan's true intentions. 
 
 
 
 Mac users, Cluley says, may be caught off guard by the attack, "as there is no prompt to enter your username or password when the malicious software installs itself onto your Mac. 
 
 
 
 Microsoft released a security update in 2009 for Microsoft Office for Mac users that will take care of another recent crop of malware. "Of course, it would also be sensible to update your installation of Microsoft Word -- as a patch has been available for the vulnerability being exploited here since 2009," says Cluley. 
 
 
 
 On Monday, Microsoft confirmed that the security update will cover Sabpab. 
 
 (Msnbc.com is a joint venture of Microsoft and NBC Universal.) 
 
 
 
 If you use Norton AntiVirus or Symantec Endpoint Protection for Macintosh, Symantec has more information here about how to remove Sabpab. 
 
 
 
 At this point, while "there no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," wrote Cluley, and take steps to protect themselves, whether it's with Sophos' software or another company's. 
 
 
 
 "Mac users -- please get an anti-virus, for goodness sake," added Cluley. "If you don't want to pay for one, there is free anti-virus for Mac home users available for download." 
 
 
 
 While these recent attacks can be handled, they won't be the end of them. Dennis FIsher of Kaspersky, in a blog posting last month, wrote, "Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers in China now have taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in the Windows world." 
 
 
 
 Check out Technolog, Gadgetbox, Digital Life and In-Game on Facebook, and on Twitter, follow Suzanne Choney. ||||| There are few things Apple users love more than being Apple users. The tight security features and largely virus-free ecosystem have long given the Mac enthusiast a feeling of superiority over virus-ridden PC brethren. One problem: It's no longer true and hasn't been true for some time. 
 
 Apple's reputation for security was earned long ago. A group of hackers proved how dated that notion is earlier this week when they took control of the Transmission BitTorrent app and used it to distribute malicious software to Mac users that encrypts files on a victim’s machine and demands a $400 ransom payment to release the affected files. 
 
 It is not clear which versions of OS X, Mac's operating system, are affected. But it is clear that much of the Mac's reputation for safety was simply a function of not being attacked. For most pro hackers, the smaller Mac ecosystem simply wasn't worth the time. But that's changing. Indeed, the 6,500 people who downloaded the software unwittingly showed that cybercriminals’ investment in cracking Apple software is starting to pay off. 
 
 “Windows was really insecure for a long time, and Mac didn’t have a lot of market share so they weren’t as much of a target,” said Patrick Wardle, a former U.S. National Security Agency staffer who's now director of research at the security firm Synack. “If I’m going to hack an organization's devices now, it’s going to be Apple. They’re a security soft target.” 
 
 Apple's security weaknesses begin with the software designed to protect it. 
 
 Apple's Gatekeeper, first introduced in 2012 as part of OS X Mountain Lion, has become the primary security measure on OS X computers. It's meant to ensure that users only download apps and other software that have already been approved by Apple, either via the App Store or from identified developers who include a preapproved developer certificate (which verifies a developer's identity) in their product. It's a measure that's meant to prevent users from downloading outside programs that would enable hackers to steal their passwords and financial information, secretly capture audio or video or worse. 
 
 But Gatekeeper also includes a number of vulnerabilities that researchers have proved can be exploited for nefarious means. Last year Wardle exposed a mechanism in Gatekeeper that would allow hackers to bypass the protection by infecting software that has already been approved by Apple. Essentially, once an app was approved by Gatekeeper, it was always trusted, even if it started distributing malware later on. 
 
 Apple responded to Wardle's revelations in January by issuing a security update that only blocked the files Wardle provided to the company. The update didn't address the deeper problem: trusted files can still be used to distribute a variety of shady software. That's largely what appears to have happened in the ransomware attack, where attackers faked Transmission's already-approved developer certificate to distribute their own ransomware code. 
 
 “I wasn't really surprised, we were expecting this,” Wardle said, adding that Apple computers running El Capitan, the newest version of the Mac OS, without antivirus software rank at a five on a security scale of one to 10. Windows 10 is closer to a seven. “From a technical point of view there was no reason we hadn't seen this before. It was just neat that it was signed, which is an easy way around Mac Gatekeeper.” 
 
 Apple quickly revoked the digital certificate upon learning Transmission files were infected. 
 
 Photo: Reuters 
 
 Apple’s OS X held 7 percent of the worldwide operating system market as of November 2015, according to figures released by Net Applications. But just because an OS is less used doesn’t mean it’s safe. And now, with Apple computer sales expected to grow after a slight sales dip in the first fiscal quarter of 2016, it’s clear the attacks are going to continue, according to Grayson Milbourne, security intelligence director at the security company Webroot. 
 
 “We’ve seen attacks on Apple growing over the past few years, particularly in adware and apps that change your browser’s settings, but it’s all been much less severe than something like ransomware,” Milbourne said. “It’s really just following what people are doing online and how they’re accessing the Internet.” 
 
 Two years ago, the monthly average of infected Mac computers varied between 10,000 and 70,000 machines, according to the security firm Symantec. Research published last year by the cybersecurity company Bit 9 declared that, in 2015 alone, “The number of OS X malware samples has been five times greater than in 2010, 2011, 2012, 2013 and 2014 combined.” That number is expected to rise drastically in 2016, according to Symantec and other security vendors. 
 
 Apple has yet to employ a number of the security strategies Microsoft has had no choice but to explore as the proprietor of 91.39 percent of the operating systems in use in the world. With the launch of Windows 10 last summer, the company offered a $100,000 bug bounty to anyone who found a security vulnerability and reported it through the proper channels. 
 
 Microsoft also has a history of reaching out to hackers who previously made life difficult for the corporation. In 2006, Microsoft hired members of the Polish hacking group Last Stage of Delirium, which had exploited a hole in the Windows Remote Procedure Call interface and laid the groundwork for the Blaster worm— a program that used Microsoft sites to launch cyberattacks. 
 
 Such tactics could have detected issues in Gatekeeper and the certificate verification process before the security measures were released publicly. 
 
 “If you want to get better at what you do, especially when it comes to security, you need to make sure you plug as many holes as possible,” said Liviu Arsene, senior threat analyst at Bitdefender, a Romanian cybersecurity company that unveiled research on the ransomware affecting Mac computers. “The cost of actually having a breach is much higher than the cost to your company under a bug bounty.” 
 
 Neither of those efforts would have prevented the ransomware from hitting Windows users. Windows computers, widely used by individuals as well as employers, remain a tempting target for ransomware attackers who stand to make millions by separating users from their data. 
 
 Along with Gatekeeper, Apple computers also employ the technique known as Sandboxing, which limits the amount of information apps can access on a user's computer. Users are warned that a file downloaded from an unknown third party could contain malware. Apple's Safari browser also employs a robust anti-phishing algorithm that warns users before they visit websites containing potentially harmful materials. 
 
 "A lot of Apple's security mitigations rest on Gatekeeper," said Patrick Wardle. "They're just not as proactive as Microsoft, with the bug bounty and consulting with external hackers ... but they're making a ton of money, so why would they spend a ton of money on security when they don't really have to?" 
 
 Apple declined to comment for this story. 
 
 Apple fans can at least relax in knowing the iPhone is, generally, safer than Android mobile devices. Along with passcode encryption and end-to-end encrypted iMessages, iPhones include security features that would need to be disabled in order to download a potentially malicious app. Meanwhile, ransomware attackers have disguised their malware as pornography apps and video players that have bilked countless downloaders out of hundreds of dollars apiece. 
 
 “So far there hasn’t been any ransomware for iPhones because you’d have to sideload an app onto the iPhone,” said Liviu Arsene. “Few people really jailbreak their phones.”
– With popularity comes some nasty bugs for the unwary: A Trojan known as "Sabpab" is the latest piece of malware infesting Macs, according to security firm Sophos. The malware is spreading through a weakness in Java and through an infected Word document purporting to be a statement from the Dalai Lama, reports MSNBC. Like others of its kind, Sabpab enables hackers to steal personal information and send remote commands to computers. The spread of Sabpab comes soon after warning about the "Flashback" malware believed to have infected up to 600,000 Macs. Experts say these kinds of attacks tend to come in waves, so there may be many more Mac viruses on the way. "Although there's no reason to believe that this attack is widespread, it's clearly time for some people to wake up to the reality of Mac malware," writes Greg Cluley at Sophos. "Mac users—please get an anti-virus, for goodness sake."