“Following the discovery of a new version of OSX/Leverage, a backdoor first spotted in 2013, Apple has issued an update to its XProtect malware definitions to version 2093,” Derek Erwin reports for Intego.
“This update provides basic detection for this new threat, which the Apple security team named OSX.Leverage.A,” Erwin reports. “Intego VirusBarrier already provides protection against this threat, which it identifies as OSX/FlashyComposer.A.”
“The malware is a newer version of OSX/Leverage.A, which Intego analyzed back in 2013,” Erwin reports. “The new iteration disguises itself as a fake Flash Player update, which Intego warned could happen in our 2013 blog post. A potential victim will land on a webpage designed to appear as though it is a legitimate Adobe website, which loads an iframe from a URL with malicious code. If a victim allows the execution of the malicious file when prompted or manually executes it from the Downloads folder, the Leverage malware installs a backdoor…”
Read more in the full article here.
MacDailyNews Take: How to tell if an update for Adobe’s shiteous Flash Player is valid here.
Easy solution to this problem?
Just say NO TO ADOBE FLASH!
Here’s the full name list for this thing:
OSX.Trojan(Backdoor).FlashyComposer.A-B
OSX.Trojan(Backdoor).FkFlsh-C.A-B
OSX.Trojan(Backdoor).Suspici.BBAC4570.A-B
OSX.Trojan(Backdoor).Leverage.A-B
[Note that I personally add ‘Backdoor’ in order to better describe it’s actions beyond just Trojan.]
For security technos, here are the two VirusTotal.com pages for it:
https://www.virustotal.com/en/file/58509ec67ce9a271bf4a1ec3cad3a37bb666c1df4cc90f16db7038982b57dcf1/analysis/1499784274/
https://www.virustotal.com/en/file/57f02bb637bc6be2ea6b1f45f77321aaa86bbcfe8a1817d97a25e107c06c0a74/analysis/1499784264/
Why multiple names for the same thing in the anti-malware community? IMHO the lack of scientific approach toward the subject. It’s a bunch of companies competing with one another resulting in a certain level of chaos. Note the published naming standard I use above. Getting companies to even agree to using that published standard is impossible. (o_O)