Worth Reading: An analysis of the Flashback/Flashfake trojan
Kaspersky Lab's Alexander Gostev has examined the Flashback/Flashfake trojan that recently infected more than half a million Mac OS X systems. Among other things, Gostev describes how specially crafted WordPress pages were used to attack Mac users with four different Java applets, initially in order to install a custom downloader.
This component then downloaded the actual botnet client in encrypted form and tried various different ways of anchoring itself into the system. If a user failed to input their administrator credentials when prompted by the malware installer, the trojan used the dynamic DYLD loader to hook into a number of processes as a library.
- The anatomy of Flashfake Part 1, from Alexander Gostev of Kaspersky Lab.