rationalskepticism.org

The_Metatron wrote:

PsYcHoTiC_MaDmAn wrote:

The_Metatron wrote:Yeah, this big story comes from a company called Kaspersky. Guess what they sell?

which is why you only trust political news from kids tv characters, and get nutritional advise from a mechanic etc.

ffs, who do you think actually do the most research in computer malware.

[Reveal] Spoiler: comments on which I am not commenting

on the nature of this threat, apple decided that java was an integral aspect of the OS, and therefore built it into the OS code itself. this means apple are responsible for maintaining java. 6 weeks ago Oracle patched java for windows/linux, but not for mac as it does not maintain it. apple only submitted the update this week, this java vulnerability is what the virus is exploiting , and is likely to reoccur for other forthcoming java vulnerabilities unless apple significantly increase their response time for patching java in short order to Oracle updates

(note, all the OS's are vulnerable to java exploits to a certain degree (though linux's compartmentalization makes it harder) hence why known exploits are patched - but the gap between other OS's and apple's java getting patched puts OS-X at more risk because its essentially waving a flag for malware writers saying massive whole here once Oracle update on other systems)

Scar wrote:

orpheus wrote:Isn't OSX built on a variety of Linux, therefore open source? My understanding is that that helps keep it robust and less vulnerable.

It isn't. It's a unix-like OS that is entirely build by apple.

no, its based on UNIX/BSD/NeXTSTEP kernel that apple rewrote aspects of and added too

Follow the money, man. You don't see a possible conflict of interest with a seller of anti-virus software telling us the sky is falling?

There are other sources for this sort of information.

Apple Update for Java for OS X Lion and Mac OS X
Wednesday, April 4, 2012 at 10:03 am

Apple has released a Java update for the following products to address multiple vulnerabilities:

OS X v10.6.8
OS X server v10.6.8
OS X Lion v10.7.3
Lion Server v10.7.3

These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or disclose sensitive information.

US-CERT encourages users and administrators to review Apple article HT5228 and apply any necessary updates to help mitigate the risks.

Additional information regarding CVE-2011-5035 can be found in the US-CERT Vulnerability Note VU#903934.

Russian anti-virus firm Dr. Web reports that they have been able to sink-hole one of the command and control servers used to control victims of this latest attack.

The result? Dr. Web is stating that more than 600,000 OS X users are part of this botnet, including 274 from Cupertino, California.

The Flashback malware being distributed by this exploit is what we refer to as a "downloader". In and of itself it doesn't do any harm to the system, it simply compromises the system and downloads a further payload that can do just about anything the attackers desire.