Web-based malware determines your OS, then strikes

21 hrs.

Suzanne Choney

New malware that is spread via the Web, and is operating system-agnostic, has been discovered by researchers at F-Secure.

The malware uses social engineering by showing this "warning" (top?version shown here is for Windows, the bottom is?for Mac) when a user visits the tainted page and gets the "warning."

It doesn't matter which operating system you're using, says F-Secure; the file first?"checks if the user's machine is?running in Windows, Mac or Linux then downloads the appropriate files for the platform."

The payload? "Once it has found out which operating system you are running, the Java class file will download the appropriate flavor of malware, with the intention of opening a backdoor that will give hackers remote access to your computer," writes Sophos Security's Graham Cluley on that company's blog.

Topher Kessler of CNET's Blog Network notes that if "at any?point you see a program, applet, or other resource attempt to use a self-signed certificate, then be sure you personally trust the source before using it (i.e., it is from a server you own or manage)."

Legitimate vendors will "use certificates signed by an authority like VeriSign, which authenticates to the root certificates in your system to ensure applets and other transactions with the service are legitimate and secure," he writes.

Cluley notes that this "isn't, of course, the first cross-platform malware that we have seen. For instance, in 2010 we saw the?Boonana malware?which similarly used a malicious Java applet to deliver a cross-platform attack that attempts to download further malware on Windows, Unix and Mac OS X."

With more malware attacks on Apple's OS in the past year, and ongoing strikes against Windows-based systems, "although the amount of malware written for different operating systems can vary, it's becoming increasingly hard to argue on any OS that it's safe to surf the Web without anti-virus protection," Cluley wrote. And it's hard to argue with that.

Check out Technolog, Gadgetbox, Digital Life and In-Game on?Facebook,?and on Twitter, follow Suzanne Choney.

Source: http://www.technolog.msnbc.msn.com/technology/technolog/new-web-based-malware-seeks-backdoor-your-pc-876194

the big chill tony blankley steelers charles barkley beyonce troy polamalu james harrison