Exciting times in Mac malware…

…though not the long-promised deluge.

I won’t be posting about OSX/Revir here for the moment, since I already did at Infosecurity Magazine: Revir’s Ride not a Derby Winner.

 I’ve also just followed up on Apple’s inclusion of detection of Revir in its rudimentary XProtect facility in an article that also takes a first look at the malware Intego are calling OSX/Flashback, which masquerades as a Flash Player Installer. 

That article’s not up yet, but you might be interested in the following links:

• http://blog.intego.com/2011/09/26/intego-security-memo-%E2%80%93-september-26-2011-mac-flashback-trojan-horse-masquerades-as-flash-player-installer-package/
• http://blog.intego.com/2011/09/27/more-about-the-flashback-trojan-horse/
• http://www.h-online.com/security/news/item/Apple-updates-malware-definition-list-to-defend-against-PDF-trojan-1350430.html
• http://www.appleinsider.com/articles/11/09/27/new_mac_os_x_trojan_disguises_itself_as_adobe_flash_installer.html 
• http://reviews.cnet.com/8301-13727_7-20111639-263/another-os-x-trojan-imitates-adobe-flash-installer/ 
• http://www.scmagazineuk.com/mac-malware-disguised-as-adobe-flash-update/article/212899/

David Harley CITP FBCS CISSP
Small Blue-Green World/AVIEN