• Your favorite

    Apple

    ,

    iPhone

    ,

    iPad

    ,

    iOS

    ,
    Jailbreak
    , and
    Cydia
    site.
  • Russian Security Firm Dr. Web States Symantec and Kaspersky Numbers were Inaccurate


    In an updated status report from the Russian security firm that first discovered the Flashback trojan (Dr. Web) it is being said that recent findings disagree with the statements that both Symantec and Kaspersky Labs released. Dr. Web’s status report is warning the public that the number of machines affected by the malware is not declining as many are stating.

    After citing data from its analysis of the largest Mac botnet to date, Dr. Web states that around 560,000 computers are still affected, which is quite the contradiction to the 30,000 number recently provided by the well-known security companies, Symantec and Kaspersky. It is being said that the data from the larger companies’ servers were likely inaccurate due to Flashback’s use of complex domain name creation techniques and a unique TCP connection operation that effectively masks bots from command and control servers.

    According to the Russian security firm: "BackDoor.Flashback.39 uses a sophisticated routine to generate control server names: a larger part of the domain names is generated using parameters embedded in the malware resources, others are created using the current date. The Trojan sends consecutive queries to servers according to its pre-defined priorities."

    Upon the early discovery of the malware, Dr. Web registered for the main domains used as Flashback command servers while other security firms most likely use “hijacked servers” that are in this case less reliable. The report explains that Flashback’s mode of operation allows its network of bots to go largely unnoticed by the hijacked servers which could be the reason for the reported numbers of affected machines. "On April 16th additional domains whose names are generated using the current date were registered. Since these domain names are used by all BackDoor.Flashback.39 variants, registration of additional control server names has allowed to more accurately calculate the number of bots on the malicious network, which is indicated on the graph."

    The company continues to notes that the trojan send requests to a server run by an unidentified third party, which in turn communicates with the bots but fails to close the TCP connection. This action is critical to researchers as it puts the bots in standby mode, which means they don’t communicate with other command servers monitored by information security specialists.

    As of right now, both Symantec and Kaspersky have not responded to the new report and continue to reflect a “very low” threat level from the Flashback trojan on their respective websites.

    Source: Dr. Web
    This article was originally published in forum thread: Russian Security Firm Dr. Web States Symantec and Kaspersky Numbers were Inaccurate started by Akshay Masand View original post
    Comments 7 Comments
    1. KraXik's Avatar
      KraXik -
      Anyone else think they are saying this to get people to buy their anti-virus software?
    1. iPittsburgh's Avatar
      iPittsburgh -
      Quote Originally Posted by KraXik View Post
      Anyone else think they are saying this to get people to buy their anti-virus software?
      Yep, sounds like fear mongering to me.
    1. Maxime Caudebec's Avatar
      Maxime Caudebec -
      I definitively trust Symantec way more than this dr.web crap
    1. HCWHunter's Avatar
      HCWHunter -
      Yeah, either that or Dr. Web are involved in creating the trojan themselves. Maybe both.
    1. steve-z17's Avatar
      steve-z17 -
      Boo-hoo! It takes like 2 min or less to get the trojan off your Mac. At least you don't have to run scans for awhile to actually find the virus/trojan then remove it....probably is a big stunt to sell anti-virus software as mentioned above.
    1. Norb's Avatar
      Norb -
      Dr.Web is very reputable... I've downloaded more ram from them in the past for a very good price.
    1. cmwade77's Avatar
      cmwade77 -
      I have never heard of Dr.Web before; however, I have heard of Kasperski and Symantec. While I don't like Symantec's software (it just runs too slowly), I do know both of these companies to be reputable when it comes to identifying and removing Malware and Viruses, so they are the ones that I will trust.