Russian Security Firm Says Flashback Botnet Is Not Shrinking

CRN (Computer Reseller News) ^ | 4/23/2012 | Kevin McLaughlin

[johncatl]

Contrary to recent reports, the worldwide botnet of Macs infected with the Flashback malware has remained relatively steady in size, the Russian security vendor Dr. Web said over the weekend.

Dr. Web discovered the botnet -- which it calls BackDoor.Flashback.39 -- on April 4. It claims that more than 817,000 bots have connected to the botnet thus far, and that an average of 550,000 infected machines are interacting with a command-and-control server each day.

[for-q-clinton]

Impossible. OSX can’t get malware. At least that’s what they tell us.

But seriously. It was just a matter of time before OSX had a big enough footprint to start being targeted. And they are ripe for the picking. Many of their users are people who never used AV on Windows and thought going to Mac would protect them. So now the Mac user base is growing with some of the dumbest of the dumb users—you know people who say there’s no need for 3rd party AV solutions on Macs.

Yep those are the idiots that will be getting malware as Mac sales increase.

[for-q-clinton]

I’m sure the usual suspects will be in here to dismiss this as FUD and when that fails they will blame Microsoft somehow. Or attack Windows XP (a decade old OS) as being less secure than OSX’s most current version.

[Lazamataz]

Anyone who uses a Mac is a Communist.

Anyone who shoots a 1911A frame, over a Glock, is a Communist.

Anyone who sides with the Union in the Civil War is a Communist.

Anyone who sides with the Confederacy in the Civil War is a Communist.

[donozark]

So what is the best 3rd party AV/anti-Malware for Macs?

[Lazamataz]

Glock.

[for-q-clinton]

Why do you say that? No one is saying they are communist. Just that they need good AV software on their machines as Apple clearly doesn’t really understand what they are up against. http://www.crn.com/news/security/232900172/apple-building-malware-removal-tool.htm

[for-q-clinton]

But on a more serious note...true statistic. OSX is the preferred OS for homosexuals and pedophiles. That doesn’t mean all users are homosexual or pedophiles—it’s just a statistic.

[iowamark]

Get a Mac. Resistance is futile.

[Lazamataz]

Why do you say that? No one is saying they are communist. Just that they need good AV software on their machines as Apple clearly doesn’t really understand what they are up against.

Look, if you use a Mac, you are a Communist. Period.

If you KNOW someone who uses a Mac, you are a Socialist.

[Lazamataz]

No, you were right the first time. Anyone who uses a Mac is a homosexual pedophile Communist.

[FreeAtlanta]

How do they know how many hits a day are contacting the control server?

[Lazamataz]

Communist.

[veracious]

Intersting question. Assuming they know the server address, then it must be in some unknown location so no one can do anything about it. The server is either owned by the botnet providers or is controlled by the bot.

[TexasRepublic]

Everyone is a Communist except me and thee, and I’m not too sure about thee.

[Waywardson]

F U D !!

[Swordmaker]

More evidence that Doctor Web is perpetrating a fraud... Doctor Web claims that the Mac Flashback botnet is NOT getting any smaller after Apple has pushed out the fix to ALL Macs to remove the so called FlashBack trojan, and after other AV companies did NOT find 600,000 infected Macs, reporting far fewer (One, analyzing data provided by Doctor Web from their sinkhole, claimed the evidence only supported 217,434 infected Macs, another, using the same data concluded it represented fewer than 180,000... but note it is ALL from a single source, Doctor Web's sinkhole!), and many users connecting to Doctor Web's automated "check your Mac for the infection by UUID" website found Macs KNOWN to be uninfected were reported as members of the botnet, and the complete lack of self-reporting infected Mac users on the forums! Instead you find users who use the provided tools only reporting "No infection here!"

This claim that the botnet has not shrunk defies logic when Apple and others have provided the removal tools for a Trojan that is NOT being reported by users as existing on their computers. . . unless my original conclusion that all they have is a list of UUIDs that have been spoofed is true. There is evidence that is the case when users with BRAND NEW OSX LION MACS, just out of the box, that DO NOT HAVE JAVA even installed or included, have their UUIDs submitted to Doctor Web's test and are reported to be already members of the botnet! This HAS happened. That indicates what they have is a list of UUIDs that have been assigned to Apple computers, either generated by themselves, or they are receiving them from an outside source, and they do NOT represent actual infected computers.

WHERE ARE THE INFECTED MACS??? They simply are not being reported. Only one Freeper contacted me to say that he thought the "Apple tool had removed a Flash trojan on his Mac, on the third try"... but he was running OSX Lion... which cannot BE infected by this trojan! Ergo, that was a false positive.

Please!
No Flame Wars!
Discuss technical issues, software, and hardware.
Don't attack people!

Don't respond to the Anti-Apple Thread Trolls!
PLEASE IGNORE THEM!!!

Apple Security Ping!

If you want on or off the Mac Ping List, Freepmail me.

[Swordmaker]

But on a more serious note...true statistic. OSX is the preferred OS for homosexuals and pedophiles. That doesn’t mean all users are homosexual or pedophiles—it’s just a statistic.

I am going to DEMAND that you prove your assertion. PROVE IT.

[for-q-clinton]

I just did.

[Fresh Wind]

How do they know how many hits a day are contacting the control server?

They own the control server. They're Russians, after all.