Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
Mac Newsforums, a part of the
04-21-2012, 04:50 AM #1
Russian Security Firm Dr. Web States Symantec and Kaspersky Numbers were Inaccurate
In an updated status report from the Russian security firm that first discovered the Flashback trojan (Dr. Web) it is being said that recent findings disagree with the statements that both Symantec and Kaspersky Labs released. Dr. Web’s status report is warning the public that the number of machines affected by the malware is not declining as many are stating.
After citing data from its analysis of the largest Mac botnet to date, Dr. Web states that around 560,000 computers are still affected, which is quite the contradiction to the 30,000 number recently provided by the well-known security companies, Symantec and Kaspersky. It is being said that the data from the larger companies’ servers were likely inaccurate due to Flashback’s use of complex domain name creation techniques and a unique TCP connection operation that effectively masks bots from command and control servers.
According to the Russian security firm: "BackDoor.Flashback.39 uses a sophisticated routine to generate control server names: a larger part of the domain names is generated using parameters embedded in the malware resources, others are created using the current date. The Trojan sends consecutive queries to servers according to its pre-defined priorities."
Upon the early discovery of the malware, Dr. Web registered for the main domains used as Flashback command servers while other security firms most likely use “hijacked servers” that are in this case less reliable. The report explains that Flashback’s mode of operation allows its network of bots to go largely unnoticed by the hijacked servers which could be the reason for the reported numbers of affected machines. "On April 16th additional domains whose names are generated using the current date were registered. Since these domain names are used by all BackDoor.Flashback.39 variants, registration of additional control server names has allowed to more accurately calculate the number of bots on the malicious network, which is indicated on the graph."
The company continues to notes that the trojan send requests to a server run by an unidentified third party, which in turn communicates with the bots but fails to close the TCP connection. This action is critical to researchers as it puts the bots in standby mode, which means they don’t communicate with other command servers monitored by information security specialists.
As of right now, both Symantec and Kaspersky have not responded to the new report and continue to reflect a “very low” threat level from the Flashback trojan on their respective websites.
Source: Dr. Web
04-21-2012, 05:43 AM #2
Anyone else think they are saying this to get people to buy their anti-virus software?
04-21-2012, 07:40 AM #3
04-21-2012, 09:48 AM #4
I definitively trust Symantec way more than this dr.web crap
04-21-2012, 09:52 AM #5
Yeah, either that or Dr. Web are involved in creating the trojan themselves. Maybe both.
04-21-2012, 10:33 AM #6
Boo-hoo! It takes like 2 min or less to get the trojan off your Mac. At least you don't have to run scans for awhile to actually find the virus/trojan then remove it....probably is a big stunt to sell anti-virus software as mentioned above.
04-23-2012, 07:04 PM #7
Dr.Web is very reputable... I've downloaded more ram from them in the past for a very good price.
04-24-2012, 10:55 AM #8
I have never heard of Dr.Web before; however, I have heard of Kasperski and Symantec. While I don't like Symantec's software (it just runs too slowly), I do know both of these companies to be reputable when it comes to identifying and removing Malware and Viruses, so they are the ones that I will trust.