Mac malware Crisis as Apple lets slip its Mountain Lion
Miscreants have developed a sophisticated multi-platform attack dog designed to maul Windows and Mac OS X computers.
The malware comes bundled in an Java Archive file which pretends to be Adobe Flash Player, named AdobeFlashPlayer.jar. Inside the malicious archive is a .class file named WebEnhancer, and two files named win and mac. The WebEnhancer applet decides if a user opening the file is running either Microsoft Windows or Apple Mac OS X before pushing the corresponding software nastie.
If run on an OS X system the malware drops multiple components, reconfigures system settings and installs a backdoor and rootkit combination onto infected machines. The Mac OS X component of the malware – called Crisis or Morcut – arrives on the eve of Apple's release of Mac OS X Mountain Lion, but this is probably a coincidence. The new operating system build goes on sale today.
When run on a Windows systems, a version of the Swizzor malware is installed instead.
The Mac malware uses anti-analysis and stealth techniques that are uncommon among OS X malware but have been a mainstay of the windows malware landscape for several years, as a write-up on the threat by Mac security specialists Intego explains. The threat can install itself on Mac systems without requiring a password.
The threat has not appeared in the wild, but its complexity and use of clever infection techniques point to possible infections in future.
Samples of the malware were submitted to the VirusTotal website but it's unclear who created it or what their motives might be. virusTotal routinely shares samples of malware submitted to the site to anti-virus firms.
(Source: theregister.co.uk)
