There was a question about removing the Flashback malware from your OS X machine, but I'm still not clear on what it does. What exactly does the Flashback malware do once it is installed on your Mac?

  • 1
    This is an excellent question. I was unfortunately hit with this one (surprising as I am "Mr. Security" in my circle of friends) and scoured the net to go hunting down how big a threat this was (and what kind of information it leaked back to the nefarious authors). I'll put in a pin in this one and provide my findings for you. – user10355 May 7 '12 at 16:57
  • Makes every1 freak out and bog down their macs with anti virus that makes their mac run slower than if they just got the malware lol – Alexander May 13 '12 at 22:48
  • You can get a very detailed and technical answer from Kaspersky: Part 1, The anatomy of Flashfake – gentmatt May 14 '12 at 6:04

From Wikipedia:

The Trojan [FlashBack] targets a Java vulnerability on Mac OS X. The system is infected after the user is redirected to a compromised bogus site, where JavaScript code causes an applet containing an exploit to load. An executable file is saved on the local machine, which is used to download and run malicious code from a remote location. The malware also switches between various servers for optimised load balancing. Each bot is given a unique ID that is sent to the control server.. The trojan, however, will only infect the user visiting the infected web page, meaning other users on the computer are not infected unless their user accounts have been infected separately, this is due to the UNIX security system.

For a lengthier, more technical description, read this F-Secure article.

  • 3
    Not sure why this was voted down, it does answer the question... – Aaron Lake May 7 '12 at 16:57

It means someone has bypassed the security on your Mac and can install new programs, steal data like passwords, banking web site locations and perhaps other sensitive personal emails and information.

It also means then can install other software on your Mac if it connects to the Internet to further do similar acts of I'll repute.

Lastly, it could crash your Mac if the program has logic errors or was not thoroughly tested.

If you are really interested in this subject, here are some links I have found to be helpful to understand the problem. The program itself is clearly quite sophisticated and will try to install itself as an admin process (total control) and if it cannot escalate itself to the equivalent of root access, will still install itself as a user level process and work with your files, but not the whole machine's data.

The company, Intego, that first reported this exploit has a established good record for providing balanced reports and assessments of the risks of Mac malware. It was specifically designed to grab passwords and although reports of mitigation efforts have surely lessened the brunt of the damage, I believe it's folly to assume all variants of the "flashback" trojan are completely neutralized or even detected perfectly.

What is always worrisome is when a trojan successfully has gotten control of a computer and can check in with other computers to download new instructions, the sky is the limit as to what can be done if the program is undetected and the people running it have a chance to make money from exploiting personal information, passwords or just driving traffic to sites that they receive compensation from legitimate and networks like Google and others.

Additional reading:

I don't mean to cause undue alarm, but this program not only was caught steering search results to pay click revenue on a massive scale but also did a good job of attempting to collect passwords from macs that were compromised before countermeasures were deployed.


the short answer is that it did nothing, the long answer is The malicious servers were not "turned on" as of the date of the OP question. they were not "turned on" to push anything towards the botnet, or towards the infected machines.

if they are turned on today.. or when ever someone reads this, they will still not be able to do anything, because the number of machines infected was exaggerated in the first place by "estimates", (which is why it was not "turned on", it didn't have enough) and what ever the real number was, it is now down to such a small number that the effectiveness of the botnet, (which was set up to do a Denial of service type of attack) is completely non effective as a DNS.. so it did and does, and will do nothing....

malware can also try and steal passwords or user logins... what people fail to tell you is that the app that would have to be downloaded to do that is extremely complex, and also not actually done here. (none of the applets you hear about that it "installed" did this) (nor could it in reality)

there has been a lot of mis-information passed off about this... including the "estimates" of infection.. done by a Russian security firm... (the mis-information is mainly done to hype security products and brand names to try and get people to spend some money someday)

to prove how "off" the estimates were, other teams of "security" firms, that were not russian, weeks later showed far fewer infections, which is not proof in itself, what was proof, was that the original Russian security firm then came out with a new number that was close to the original number of infections... showing their "estimates" to always be off... (a second russian security firm "confirmed" their numbers, but in reality they were working together)....

the second bit of misinformation was that it could "infect" your computer without you putting in your password, this is not correct, it could put an applet in a directory of safari(or other), only if you gave it your password... what it was doing if it did not get you to type in a password, was other vectors of attack which in general were not effective...

as proof of this... the steps to remove the applet from "security firms" included terminal sudo commands that require your password, in otherwords to delete it, you needed a password, to add it also needed your password... (there are exceptions to this, like running as root, and the number of users doing this in my immediate vicinity of 1000 mile radius I could count on one hand) (i am exaggerating, but only to show the point)...

in short you are only a victim of overhype... WAY overhype... nearly every variant of this until people were so aware of it that it no longer could infect, was a version that pretended to be a flash update, or similar... (hence the name)

if you didn't get a prompt to "update" your flash with a big box like installer message... and more importantly were smarter than an average computer user and recognized that every social engineered attack route starts out by... "you need to install an update" or you should install a anti-virus software app...

then you don't even need to check to see if you have the malware...

as a matter of fact a little bit of a fact goes a long ways in understanding this...

more people are infected by installing "anti-virus" software, which infact was the trojan than other malware now adays...

and here is some more... more computer users have lost data (or down time) to LEGITIMATE anti-virus software, than Mac users have lost data (or down time) to malware... because the software programs themselves had bugs in them that updates from the companies would go rogue believing some files were not correct... which were actually important files...

here is another, not a single AV software package detects or are able to get rid of the malware, until the malware is in the wild... and you have to update that AV-software.... this is not preemptive software, it is after the fact software... which does a mac user little good... especially if you are a user who does keep on top of things.. and you know about things about the same time an update is available...

  • Your claims that flashback couldn't have possibly done anything go against many mainstream press reports. Might you have some references that explain which russian firms even reported the things that you state are overblown? – bmike May 14 '12 at 3:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .