Got the Flashback Trojan? OS X update removes it
I'd clap my hands and slap Apple on the back, but yesterday's Flashback fix took too long -- and lots of negative publicity with it -- coming. There shouldn't have to be an uproar, or massive Mac botnet, for Apple to get an urgent security fix out there. Technically, a fix released last week. This one goes further and does what many Mac users will need most: Malware removal.
Criticism aside, there is reason for praise. The update disables Java applets from running. If the user flips on the switch but no applets run for awhile, the capability is disabled again. Smart. Apple already takes a heavy hand to Adobe Flash in Safari. Disable all plug-ins by default, I say. Let people use them only if needed, and when not used for awhile bugger them.
Flashback is the second big Mac Trojan outbreak in a year and lays waste to the ridiculous contention that OS X doesn't get malware or is somehow more secure than Windows. The real problem is something else: The false sense of security Apple marketing creates about Mac security.
"Our main takeaway from [Flashback] should be that many Mac users have been lured into a false sense of security, and will be, or may already be, in for a rude awakening", security consultant Adrian Sanabria explains.
Apple used to claim "Mac OS X doesn't get PC viruses", which is a bit misleading. Many viruses are operating system-specific. But OS X can get Mac viruses and is vulnerable to worms that can affect any operating system. Now Apple claims "OS X has you covered...With virtually no effort on your part, OS X offers a multilayered system of defenses against viruses and other malicious applications, or malware".
The Trojan infected as many as 600,000 Macs. "The numbers I've heard report 2-3 percent of all Macs are infected, or were infected at the peak", Sanabria reports.
Apple took six weeks to patch the vulnerability, doing so a second time because of problems with the first. Meanwhile, millions of Macs were unprotected, largely because of that false sense of security.
This week, I conducted two polls that alarmingly aren't that different from identical ones taken 11 months ago. Seventy-four percent of respondents do not have anti-malware installed on their primary Mac. By comparison, 91 percent do on their primary Windows PC. Apple apologists would argue that the disparity isn't surprising, since Windows is more prone to viruses than OS X. But that kind of thinking is the problem. Denial.
Yesterday, security consultant Christopher Budd answered a question that shouldn't need asking: "Do I really need anti-malware?" D`oh. Do you lock up your home, or car? Do you leave your paycheck cash on a Starbucks table while you go to John? Or do you keep it in your wallet or purse? Or in a bank? You protect your valuables in many ways. Why wouldn't you install security software, particularly when there are so many free options?
Apple distributes the fix/removal tool via Software Update. Run it from your Mac. What can you expect. Apple explains:
This Java security update removes the most common variants of the Flashback malware.
This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.
Java for OS X Lion 2012-003 delivers Java SE 6 version 1.6.0_31 and supersedes all previous versions of Java for OS X Lion.
This update is recommended for all Mac users with Java installed.
For more information: OS X 10.6; OS X 10.7.
Photo Credit: Jirsak/Shutterstock