Menu > Articles de la revue de presse : - l'ensemble [tous | francophone] - par mots clé [tous] - par site [tous] - le tagwall [voir] - Top bi-hebdo de la revue de presse [Voir]

---

S'abonner au fil RSS global de la revue de presse

---

Présentation : Malware continues to be a minimal threat to most Mac users, but that doesn't mean attackers aren't constantly trying to come up with new ways to steal information or turn users' machines into botnet drones. The latter appears to be the case with a new Mac trojan posing as a PDF file, discovered by security researchers at F-Secure. The malware in question has been identified as Trojan-Dropper OSX Revir.A, which installs a backdoor, Backdoor OSX Imuler.A, onto the user's Mac. Currently, however, the backdoor doesn't communicate with anything. The command-and-control center for this particular malware is apparently a bare Apache installation, which has been sitting at its current domain since May of this year. Because of this, users who might fall victim to this attack aren't likely to see many ill effects for the time being, but that could change if the files end up spreading to a wider audience. As mentioned earlier, this trojan spreads by masking itself as a PDF, which displays a Chinese-language document on the screen in an attempt to hide its background activity. This isn't a new strategy on the surface, as F-Secure notes, but some deeper digging indicates that it might be stealthier than its Windows counterparts. This malware may be attempting to copy the technique implemented by Windows malware, which opens a PDF file containing a '.pdf.exe' extension and an accompanying PDF icon, reads the post on F-Secure's blog. The sample on our hand does not have an extension or an icon yet. However, there is another possibility. It is slightly different in Mac, where the icon is stored in a separate fork that is not readily visible in the OS. The extension and icon could have been lost when the sample was submitted to us. If this is the case, this malware might be even stealthier than in Windows because the sample can use any extension it desires. As for how this trojan is spreading, that's a bit of a mystery. The researchers noted that they're not yet sure of the methods it uses to propagate, but they believe the most likely explanation is that it's circulating via e-mail attachment. Read the comments on this post

Les mots clés de la revue de presse pour cet article : trojan botnet backdoor
Les videos sur SecuObs pour les mots clés : trojan botnet backdoor
Les mots clés pour les articles publiés sur SecuObs : botnet backdoor
Les éléments de la revue Twitter pour les mots clé : trojan botnet





Les derniers articles du site "Security" :

- Using ASAN as a protection
- Execute without read
- Together, we can make a difference
- Internet Bug Bounty issues its first 10,000 reward
- vtable protections fast and thorough
- Exploiting 64-bit Linux like a boss
- Exile for the BBC Micro some elegant solutions
- Using ASAN as a protection
- Execute without read
- Together, we can make a difference
- Internet Bug Bounty issues its first 10,000 reward
- vtable protections fast and thorough
- Exploiting 64-bit Linux like a boss

---

S'abonner au fil RSS global de la revue de presse

---