And don’t think that checking your OS X dock or switching between apps using Cmd-Tab will reveal that a program is being run. The Trojan deliberately hides itself from appearing in those places. Mac malware? It's been a while.]]>
Apple has never guaranteed developers that timers will run at exact times, either, so this isn't necessarily a break with convention. Apple currently tells developers that "because of the various input sources a typical run loop manages, the effective resolution of the time interval for a timer is limited to on the order of 50-100 milliseconds," and it notes that busy apps may have their timers affected even more. Isn't that going to mess with music apps, which rely on timing precision that's more granular than that? (Thanks @rquick for the link.)]]>
The attacks apparently use poisioned Microsoft Word documents to exploit a Microsoft Office vulnerability.
Victims are targeted via email, with messages that appear to include a relevant attachment, sometimes a Word document entitled “Concerns Over Uyghur People’s Fundamental Rights Under The New Chinese Leadership,” other times masquerading as a white paper.]]>
But before we go into details, let’s start with a quiz:The Dalai Lama walks into an Apple Store. Why? It does make sense, honest. More to the point: it seems that Mac-using activists are being targeted by Chinese-written malware.]]>
No one has ever reported that, for 18 months, Project Marklar existed only because a self-demoted engineer wanted his son Max to be able to live closer to Max's grandparents. Quora, proving its worth.]]>
This is probably a good move for the vast majority of Mac users, but for folks with even a small amount of interest in tinkering with the configuration files and caches of various applications, it’s an outright nuisance. A quick trip to the Terminal can fix it, or he has an app for that.]]>
“It’s going very slowly, and there’s still a ways to go, but I think in a month it will be over,” says Boris Sharov, Dr. Web’s chief executive. They were reckoned to be making about $10,000 per week at the peak. Wonder if that's better than they could do off a Windows botnet. And of course: what's next?]]>
~/Library/LaunchAgents/com.java.update.plist
~/.jupdate
It then deletes all files and folders in ~/Library/Caches/Java/cache in order to delete the applet from the infected Mac, and avoid detection or sample recovery.
The no-password thing is just more drive-by fun. Unclear: prevalence. (Thanks @rquick for the link.)]]>
Code was injected into the main pages when the blogs were hacked. As a result, when any of the compromised sites were visited, a partner program TDS was contacted. Depending on the operating system and browser version, the browser then performed a hidden redirect to sites in the rr.nu domain zone that had the appropriate set of exploits installed on them to carry out an infection.]]>