Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

There's been a couple of trojans recently that imitate the Adobe Flash Player installer one of which is called OSX/flashback.A. (More info here) I've been wary of updating Adobe Flash Player due to this trojan. How do I tell if the installer is the real thing, or if it's just a trojan? Also, where does it come from? I'm pretty sure the DMG for the trojan downloaded automatically, opened the installer, and wanted me to install it.

I know that I can download the official installer from the Adobe website, and will probably do this. However, my questions remain.

share|improve this question
    
Your question is asked and answered. Don't install updates that are pushed on you in your browser. Visit the developer site directly to download updates. –  jaberg Jan 29 '12 at 17:14

3 Answers 3

up vote 4 down vote accepted

There are a couple easy ways to identify the trojan in it's current form (aside from downloading directly from Adobe or using AV software):

  1. The trojan is an installer package that opens with Installer.app, the real installer is an application (it doesn't use Installer.app).

  2. When run, the trojan installer looks like the screenshot of the trojan installer in the CNET article you linked to, the real installer looks like the screenshot of the real installer in that same article. (Screenshots reposted below.)

The trojan is found exclusively on sites that are not adobe.com, generally from malicious sites.

Legitimate Flash Player Installer: Real Flash Player Installer

Trojan Installer: Trojan Installer

share|improve this answer
    
Thanks so much! –  daviesgeek Jan 29 '12 at 22:44
3  
Please note the words "current form". There is no guarantee that 5 minutes from now, you won't find a different version of the malware where you won't be able to tell any difference just by looking at it. –  hotpaw2 Jan 30 '12 at 6:42

If you want to be sure, grab the official installer from Adobe's website. http://get.adobe.com/flashplayer/

share|improve this answer
    
See my updated question. Sorry, was going to add that then forgot. –  daviesgeek Jan 29 '12 at 17:10
    
Even with your update, the answer is the same. While I appreciate your academic interest, the solution, particularly for general users, is to discard updates offered up "out of the blue". –  jaberg Jan 29 '12 at 17:19
    
@jaberg Ok, yes and no. IMO, this answers the question, but not the way I asked it to be answered. –  daviesgeek Jan 29 '12 at 17:23
    
Okay, if you want to dig, this is why Apple encourages developers to "sign" installers. You may find Apple's Security Overview developer document useful. –  jaberg Jan 29 '12 at 17:29

Try either Onyx (Free) or Cocktail ($) that will, among a myriad of things, will also search for malicious known stuff.

share|improve this answer
    
As will OS X (10.6+) itself once the ProtectX definitions include the malware in question. –  jaberg Jan 29 '12 at 17:21
    
Thanks for the answer, but I'm really looking for specifics on how to recognize it, not for anti-virus software. –  daviesgeek Jan 29 '12 at 17:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.