New Mac trojan found to exploit same Java weakness as 'Flashback'A new piece of malware that takes advantage of a well-documented Java vulnerability has been found on a website dedicated to the Dalai Lama, with the trojan able to install itself on an unwitting Mac user's computer to capture keystrokes and other sensitive data.
Screenshot from a Google cache of the gyalwarinpoche.com webpage. | Source: F-Secure
Dubbed "Dockster," the malware was first found by antivirus and security firm Intego to have been uploaded to the VirusTotal detection service on Nov. 30. At the time of its discovery, the remote address associated with trojan was not active, possibly indicating that the code's creators were testing whether it would be detected, but as of this writing the malicious code is now "in the wild."
As noted in a separate report from F-Secure (Flashback exploit from September 2011. Dockster leverages the same Java vulnerability to drop the backdoor onto a Mac, which then executes code to create an agent that feeds keylogs and other sensitive information to an off-site server.
In the case of Flashback, which was also discovered by Intego, a reported 600,000 Macs were affected before both Apple and Oracle released a Java patches to remove the malware and protect against future attacks.
Although the newly-found Dockster takes advantage of an already fixed weakness, users who haven't yet updated their Macs or are running older software may still be at risk.
On Topic: General
- This week on AppleInsider: Ive's promotion, Apple Watch apps, augmented reality & more
- Apple CEO Tim Cook donates $6.56M to charity
- Exclusive Video: Apple Campus 2 Spaceship ring rising with Lego-like interlocking slabs
- Apple's Upper East Side store in Manhattan to open after WWDC on June 13
- Apple tops Consumer Reports satisfaction survey for computer technical support