Flashback Malware Authors Using Twitter to Talk to Infected Machines

by

We've been following for some time the story of the Flashback trojan that has been targeting Mac users by masquerading as a Flash Player installer but which has also been evolving to include increasingly sophisticated tactics for infecting users' computers.

Antivirus firm Intego now reports that Flashback's creators are using an interesting new tactic for communicating with machines infected by the trojan: Twitter. According to the report, Flashback is programmed to search Twitter for Tweets containing a unique 12-digit code that changes daily, with the malware's authors being able to issue commands to infected computers by posting from any number of Twitter accounts simply by including the appropriate code as a hashtag.

These hashtags aren’t as simple as, say, #Flashback or #MacMalwareMaster, but are seemingly random strings of characters that change each day. Intego’s malware research team cracked the 128-bit RC4 encryption used for Flashback’s code and discovered the keys to this system.

The hashtags are made up of twelve characters. There are four characters for the day, four characters for the month, and four characters for the year. [...]

So, for today, March 5, 2012, the hashtag would be #pepbyfadxeoa.

Intego is monitoring Twitter to look for any commands being issued using the hashtag codes, also noting that Flashback uses a number of different user agent strings in its web queries looking for the Twitter contacts, seeking to avoid detection and removal.

Top Rated Comments

(View all)
Avatar
110 months ago

I just upgraded my gfs flashplayer last week ... What are the chances that it's this Trojan ?? How can I check?

Go to your /Users/yourusername/Library/ folder and look to see if you find any of these files:
~/.MacOSX/environment.plist
~/Library/LaunchAgents/com.apple.SystemUI.plist
~/Library/Preferences/perflib
~/Library/Preferences/Preferences.dylib
~/Library/Logs/swlog
If you don't have any of these files, you're not infected.

Your Library folders are hidden by default in Lion. To get to your /Library or /Users/yourusername/Library (also known as the ~/Library) folders in Lion, Launch Finder and click Go > Go to Folder and type: /Library or ~/Library

Here's how to avoid any question:

With my flash player I'm careful. I never click on a pop-up when it tells me it's out of date.

I go to Adobe's site and update there.

This is very important:

To repeat: the vendor has provided no actual evidence that such messages are happening.

In fact, while I may have missed it, I've seen no corroborating evidence supporting the recent reports coming from Intego. I haven't seen any other security firm confirming the presence of these variations, or the variation that supposedly installs itself without user intervention, as they also claim. Until such claims are proven by other companies, I'll continue to find Intego's claims suspicious, at best.

Generally speaking, these reports by security firms are little more than thinly veiled attempts to scare users into buying their security software, which you don't need. However, such reports can be useful reminders for users to continue to practice safe computing.
[LIST=1]
* Make sure your built-in Mac firewall is enabled in System Preferences > Security > Firewall


* Uncheck "Open "safe" files after downloading" in Safari > Preferences > General


* Uncheck "Enable Java" in Safari > Preferences > Security. Leave this unchecked until you visit a trusted site that requires Java, then re-enable only for your visit to that site. (This is not to be confused with JavaScript, which you should leave enabled.)


* Check your DNS settings by reading this (https://guides.macrumors.com/Mac_Virus/Malware_FAQ#Why_am_I_being_redirected_to_other_sites.3F).


* Be careful to only install software from trusted, reputable sites. Never install pirated software. If you're not sure about an app, ask in this forum before installing.


* Never let someone else have physical access to install anything on your Mac.


* Always keep your Mac and application software updated. Use Software Update for your Mac software. For other software, it's safer to get updates from the developer's site or from the menu item "Check for updates", rather than installing from any notification window that pops up while you're surfing the web.

That's all you need to do to keep your Mac completely free of any virus, trojan, spyware, keylogger, or other malware.

You don't need any 3rd party antivirus app to keep your Mac malware-free. Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. You cannot infect your Mac simply by visiting a website, unzipping a file, opening an email attachment or joining a network. The only malware in the wild that can affect Mac OS X is a handful of trojans, which cannot infect your Mac unless you actively install them, and they can be easily avoided with some basic education, common sense and care in what software you install. Also, Mac OS X Snow Leopard and Lion have anti-malware protection (http://support.apple.com/kb/ht4651) built in, further reducing the need for 3rd party antivirus apps.
Mac Virus/Malware FAQ (https://guides.macrumors.com/Mac_Virus/Malware_FAQ)
Score: 8 Votes (Like | Disagree)
Avatar
110 months ago
The claim is interesting, but a quick search on Twitter doesn't show that #pepbyfadxeoa is actually being used by any program for anything. If the vendor's claim is true, they should be able to tell us a prior hashtag which shows actual nefarious activity.

We are still suffering from Adobe's lax attitudes for security around their products. All of the "Get Flash Player" and "Get Adobe PDF Reader" links that Adobe encouraged in the past have helped foster a lackadaisical attitude towards the clear risk of installing a trojan horse on machines. I will be happy as Flash on the WWW continues to fade into the sunset.

I think this uses twitter even if you don't use it personally, they are just using the open nature of the site as a means to communicate with the malware.

Bingo. If the trojan is actually using twitter as a conduit, it's probably using accounts that were embedded in the trojan. Blocking those would require the blocking of connections to twitter servers with something like Little Snitch (http://www.obdev.at/products/littlesnitch/index.html)
or outbound blocks in your network's firewall.

To repeat: the vendor has provided no actual evidence that such messages are happening. I see no evidence with todays hashtag.

One other note: the Twitter stream is a real cesspool these days. As far as I can tell, Twitter does nothing to automatically remove the 'bot accounts that send out Amazon Associates link-spam. They're also doing nothing to automatically censor accounts that send @mentions that spam the "adult" dating sites. Doesn't Twitter have any friends in the Valley who could help them keep the toxic pollution out of their stream?
Score: 7 Votes (Like | Disagree)
Avatar
110 months ago


Much like life, if you hang around in bars, you can come down with diseases.

So if you don't hang around in bars, you won't catch any diseases???
Score: 6 Votes (Like | Disagree)
Avatar
110 months ago

I'm always suspicious of anti-virus firms who seem to know very specific details of viruses/malware/trojans.


I'm even more suspicious when the claimed evidence doesn't pan out. To alter the slogan from that famous Wendy's commercial (//www.youtube.com/watch?v=Ug75diEyiA0):

Where's the tweets? :D
Score: 5 Votes (Like | Disagree)
Avatar
110 months ago

I'm always suspicious of anti-virus firms who seem to know very specific details of viruses/malware/trojans.


Word, bro. And what about those pesky "doctors" who seem to know all about illnesses and bacteria and whatnot? Damned scientists!
(Fricking magnets, how do they work?)

----------

Then you can send a message to the hacker how dumb he was. With the same amount of work he had put into this malware he could have created an app and probably made some money.


You mean he has no bussiness plan for this?
Score: 4 Votes (Like | Disagree)
Avatar
110 months ago

Nasty!!

(I'm breaking my arm patting myself on the back for my non-involement with social media.)

I do feel bad for the majority of the world who does use social media...this is really lousy.

Much crap on social media, but a tremendous amount of good in places where free expression is only possible through Twitter, etc. It's a powerful tool for many in the world, and any sympathy I might have for certain hackers is totally absent in situations like this.


Well, don't over pad yourself. The infection doesn't come from Twitter, but from a fake Adobe Flash Installer. Twitter is only one of the many ways hackers use to communicate with the hacked Macs.
Score: 3 Votes (Like | Disagree)

Top Stories

Apple Takes Legal Action Against Small Company With Pear Logo

Saturday August 8, 2020 11:09 am PDT by
Apple is taking legal action against the developers of the app "Prepear" due to its logo, according to iPhone in Canada. Prepear is an app that helps users discover recipes, plan meals, make lists, and arrange grocery deliveries. The app is a spinoff of "Super Healthy Kids," and the founders claim that they are facing litigation from Apple. Apple reportedly takes issue with Prepear's logo, ...

Apple Seeds iOS 14 and iPadOS 14 Public Beta 4 to Testers

Thursday August 6, 2020 10:05 am PDT by
Apple today seeded new public betas of upcoming iOS 14 and iPadOS 14 updates to its public beta testing group. Today's software releases, which Apple labels as fourth betas to keep them in line with developer betas, are actually the third betas that Apple has provided and they come two weeks after the prior beta releases. Public beta testers who have signed up for Apple's beta testing...

Supposed iPhone 12 Display Unit Leaks

Thursday August 6, 2020 8:13 am PDT by
An image supposedly of an iPhone 12 display unit has been shared online by leaker "Twitter user Mr. White". Compared to images of an iPhone 11 Pro display piece, this new unit has a reoriented display connector, reaching up from the bottom of the display, rather than from the left-hand side on iPhone 11 Pro. This may be due to the logic board moving to the other side of the device. A...

8 Third-Party Home Screen Widgets That You Can Try Out Now on iOS 14

Wednesday August 5, 2020 12:56 pm PDT by
One of the biggest new features of iOS 14 is Home Screen widgets, which provide information from apps at a glance. The widgets can be pinned to the Home Screen in various spots and sizes, allowing for many different layouts. When the iOS 14 beta was first released in June, widgets were limited to Apple's own apps like Calendar and Weather, but several third-party developers have begun to test ...

New 27-Inch iMac's Storage Affixed to Logic Board, 4TB and 8TB Configurations Have Expansion Connector

Friday August 7, 2020 7:46 am PDT by
Following a report from German blog iFun.de that claimed the new 27-inch iMac's flash storage is soldered to the logic board, MacRumors has obtained additional information in an internal document for Apple technicians. In the document, Apple says that the flash storage is indeed affixed to the logic board and cannot be removed. However, for the 4TB and 8TB configurations, Apple says that a...

2020 iMac Teardown Reveals Internal Changes and Similarities

Saturday August 8, 2020 12:44 pm PDT by
A teardown video, shared by OWC, reveals the internal changes in the new 2020 27-inch iMac. The 2020 27-inch iMac was announced earlier this week with 10th-generation Intel Core processors, AMD Radeon Pro 5000 series graphics, up to 128GB of RAM, up to 8TB of storage, a 1080p front-facing FaceTime camera, a True Tone display with a nano-texture glass option, higher fidelity speakers, and...

Kuo: iPhone 12 Camera Lens Supplier Experiencing Quality Issues, But May Not Affect Launch Schedule

Thursday August 6, 2020 9:30 pm PDT by
One of Apple's camera lens suppliers for the upcoming non-Pro iPhone 12 models is having quality issues, according to a new research note from analyst Ming-Chi Kuo seen by MacRumors. The issues are, however, unlikely to have an impact on Apple's shipping schedule, presuming that Apple's other main supplier can make up the difference. Kuo says that Genius Electronic Optical has discovered...

Google's $349 Pixel 4a vs. Apple's $399 iPhone SE

Wednesday August 5, 2020 1:45 pm PDT by
Google this week launched its newest smartphone, the $349 Pixel 4a, a low-cost device that's designed to compete with other affordable devices like Apple's iPhone SE. We picked up one of the new Pixel 4a smartphones and thought we'd check it out to see how it measures up to the iPhone SE, given that the two devices have such similar price points. Subscribe to the MacRumors YouTube channel ...

Sony WH-1000XM4 Noise-Canceling Headphones Now Available for $350

Friday August 7, 2020 2:01 am PDT by
Sony's flagship WH-1000MX3 noise-canceling headphones have been among the best on the market for some time, and this week Sony released its fourth-generation WH-1000XM4 headphones boasting some notable improvements on the previous model. The XM4s feature the same basic design as the XM3s, but are one gram lighter at 254 grams due to slightly larger ear pads and some subtle tweaks to the...

Apple Announces New 27-Inch iMac With 10th-Gen Processors, Up to 128GB RAM, 1080p Webcam, True Tone, and More

Tuesday August 4, 2020 8:07 am PDT by
Apple today announced a new 27-inch iMac with faster 10th-generation Intel Core processor options, next-generation AMD graphics, up to 128GB of RAM, a higher-resolution 1080p front-facing FaceTime camera, a True Tone display with a nano-texture glass option, a T2 chip, higher fidelity speakers, studio-quality microphones, and more. A breakdown of the new 27-inch iMac's features and specs:10th...