However, the Flashback attack that affected over half a million Macs isn't specifically a MacOS attack. Rather, as Chris Valasek, Senior Security Researcher at Coverity, explained, it totally relies on vulnerabilities in Java.
"Unlike a handful of other Mac malware, Flashback does not require the user to click an actual executable file," said Valasek. He pointed out three Java vulnerabilities that let Flashback do its dirty work.
- CVE-2011-3544 "allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability."
- CVE-2008-5353 "allows remote attackers to run untrusted applets and applications in a privileged context."
- CVE-2012-0507 doesn't have an official description, as it is still under investigation, but it is Java-specific.
"Not only are they all Java vulnerabilities, but they’re not your typical 'memory corruption' vulnerabilities," said Valasek. "Memory corruption vulnerabilities usually require some very application- or OS-specific information to execute code on a remote machine. These Java vulnerabilities, on the other hand, only require executing Java code or providing a pre-compiled executable."
Worse yet, these aren't new problems. Valasek noted that "all of these vulnerabilities have had public exploits available for a while. This means that the malicious attackers didn’t have to spend the time writing their own exploits."
Like Kaspersky's Roel Schouwenberg, Valasek chastised Apple for its slow response. "All of these vulnerabilities are patched in the Windows version of Java. Unfortunately, Mac typically is a few weeks behind with Java patches. This leaves OSX users vulnerable to known, patched vulnerabilities for quite some time after public disclosure. Imagine having to wait 2 months for Windows Update to have the correct patches."
"It’s not that Mac has ever been virus 'bullet proof'," Valasek continued. "The malware... was just behind the times when compared to Windows. Now that the malware is being distributed via the browser through exploits derived from public examples, they tend to be on par with the Windows world (of malware)."
"Welcome to the club OSX, it’s nice to meet you," he concluded.
Apple did finally issue patches for these vulnerabilities last week. Just yesterday they announced that a detection and removal tool for Flashback is in the works, without specifying a release date. If Apple's security team doesn't start addressing flaws more expeditiously, they risk losing what's left of MacOS's reputation for security.