Flashback Malware now with Twitter C&C

Published: 2012-03-05
Last Updated: 2012-03-05 19:33:08 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

The OS X malware family Flashback is making news again. This time around, antivirus vendor Intego uncovered a new version of Flashback that will use Twitter as a command and control channel [1]. The malware will check twitter for daily changing hashtags to look for commands.

Today's hashtag, #pepbyfadxeoa, has already been heavily "abused" on twitter. Given all the additional posts, it isn't really clear if the actual command will be parsed correctly by the bot.

Overall, the twitter channel isn't exactly implemented very strongly. For example, Intego points out that the bot will use specific, but alternating, user agents to hide. However, some of these user agents are pretty easy to spot. Hiding in plain sight only works if you are actually trying to blend in and not lighting yourself with a big flare.

So far, we haven't seen any first hand reports of the infection. If anybody runs across a sample, let us know. I would like to test if Apple's XProtect software adds a signature for it, or if existing signatures cover this one. Apple has been steadily updating the XProtect signatures, but it is not always if it covers version reported by other vendors as the naming is not always in sync. According to my monitoring of XProtect, it was last updated February 7th.

[1] http://blog.intego.com/flashback-mac-malware-uses-twitter-as-command-and-control-center/

Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: flashback os x virus
1 comment(s)


Each version,
Version 44- Snow 10.6.8 https://configuration.apple.com/configurations/macosx/xprotect/1/clientConfiguration.plist

Version 1023- Lion 10.7.3 https://configuration.apple.com/configurations/macosx/xprotect/2/clientConfiguration.plist

Version 2013- Well you get it. https://configuration.apple.com/configurations/macosx/xprotect/3/clientConfiguration.plist

This is similar to what we saw back in Sept, the criminals are throwing the Kitchen Sink at the OS. As long as it is updated along with Java, there it little threat. Older versions of the OS should turn off Java as should anyone who does not use it. Disable Open Safe downloads, etc.

Also to avoid any communication on a channel you do not use, if you are not using IPv6. (Check your Pipes so to speak.)

networksetup –setv6off <interface example Wi-Fi | Ethernet>

Something to keep an eye on but think there is plenty of hype here.


Diary Archives