back to article Microsoft latest to 'fess up to Java-based Mac attack

Microsoft appears to be the latest big tech firm to have been hit by cyber attackers targeting Macs with a zero-day Java vulnerability, following a sophisticated campaign which has already infected developers at Facebook and Apple. In a blog post published late last Friday, Microsoft’s GM of Trustworthy Computing Security, Matt …

COMMENTS

This topic is closed for new posts.
Meh

Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

This is not going to be a problem when connecting to your bank’s web site because your bank has no interest in infiltrating your computer or your company’s computer network.

The fact is, visiting gambling and porn web sites has ALWAYS been a risky practice. Malicious software reside on these types of web sites for this simple reason: it is expected that the victim would not want anyone to know they've been there and so never tell the authorities or more importantly, the sys-admin, about any infiltration or theft of data as a result of visiting these web sites.

Solution:

a. Don't employ Mac pervs.

2. Limit Internet access to Mac pervs, to sites that are pertinent to their work and if non are, don't give them Internet access at their desk.

iii. Isolate Internet access to an in-house Cyber Cafe. Mac perv's can browse their tiny-brains out during their lunch hour, on a separate network that is separate from the company Intranet.

1
10
Gimp

Re: Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

You sir are playing a dangerous game!

One fanatic in his/her office getting their kicks is one thing. Getting them all together in an "in-house Cyber Cafe" will inevitably lead to one almighty macgasm that could have effects tantamount to "crossing the streams".

Do you want to cause the end of the universe? Or worse, live in one where every corner is rounded?

Keep them away from each other, its the only safe way forward.

4
1
Meh

Re: Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

iPervs

1
1
Silver badge

Re: Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

Except this attack came via an iPhone developer website.

3
1
Bronze badge

Re: Mac perv's visit porn and gambling sites at work, this is why they are getting 'attacked'.

Given the numebr of times infections have come from banner ads served through legitimate sites is there any reason to believe that the mac users have been up to something they shouldn't?

1
1
WTF?

Eh?

They're advertising the fact that the "Microsoft Campus" runs Apple Macs to deflect attention from their PCs being pwned?

EPIC FAIL

...as Eadon might say.

Methinks one of their propaganda droids might need rewiring.

6
6
Silver badge

Re: Eh?

Uh.. how do you think they write Office for Mac?

And in order to do so, they almost certainly follow the exact Apple guidelines on what to switch off and on and how to run a "standard" OS X install because otherwise they'd be introducing variables to the development environment.

Son, you crazy. Go sit in a dark room for a few hours.

3
1
Silver badge
Meh

Re: Uh.. how do you think they write Office for Mac?

Half-heartedly.

10
0
Gimp

Re: Eh?

...or were they trying to discretely let slip that they use Macs all over the place - not just the "Mac business centre" where they have to? Just can't get on with that hideous TIFKAM?

...and what the hell is "Microsoft’s GM of Trustworthy Computing Security"? A joke?

2
2
Silver badge

Re: Eh? @dogged

Heh. At first, I also read that as "wait, Macs in a MS campus?" but then remembered Office for Mac.

That said, it still reads as funny.

2
0

@ dogged

Yes, I got that. The quotation from the release said:

"...number of computers, including some in our Mac business unit, that were infected..."

Hmmmmm...

3
0
Silver badge
Meh

Re: @ dogged

Well, think it through.

There's going to be some in the Mac business unit. There will be others in the MSN business unit making certain that MSN displays properly on Safari and in fact that all of microoft.com - even msdn - functions correctly. You could expect there to be more in WP business unit because.. connector for Mac and other functionality.

Headline - software company writes software for more than one platform. Film at 11.

1
2
Facepalm

Gotta love how the Register is persisting in writing up a Java exploit as being a Mac specific attack.

Any unpatched computer would be vulnerable, Macs, Windows, even Linux. If you can actuslly read you'll see that Microsoft is not saying only Macs were attacked.

2
1
Anonymous Coward

It depends on what sort of attack it is and what the root cause is.

If it is a problem in the language itself, in the APIs which causes the VM to die then that's just a DOS style attack. Inconvenient but not something that would be used to hack (unless it spilled out some useful information in the process).

There may be some common code in the VM which is vulnerable on all platforms.

But there will be platform specific code too, since the VM is a link between the Java APIs like Swing and the native APIs. The GUI in Windows is different to the GUI in OSX for example.

Of course, this could just be a bug in the security configuration or the policy code in the VM too. Java has policy files which are used to restrict its functionality and ability to read, write and delete files.

1
0
Silver badge
FAIL

Except that you COULDN'T patch it if you where on a Mac, because Apple (who what the only one who could) did not release the patch in a timely fashion. So hitting a fully up-to-date system WAS a Mac specific attack.

0
0
Silver badge
Facepalm

>"Gotta love how the Register is persisting in writing up a Java exploit as being a Mac specific attack."

RTFA. El Reg is continuing to report on a specific Apple problem that is causing massive worldwide zombie-Mac botnets to form.

Here's data from an El Reg article on this same problem just 6 days ago: "The fact that Java security releases from Apple arrived weeks after Oracle's updates were a massive factor in the spread of the Flashback botnet last year. The malware infected over 500,000 Macs, forming a zombie network that included 274 bots traced back to Cupertino, California, home of Apple's HQ. This time around the window of Java vulnerability extended for less than three weeks instead of two months but the overall fallout from the delay in pushing out a patch quickly is arguably even more toxic." (http://www.theregister.co.uk/2013/02/20/apple_java_omnishambles/)

0
0
g e
Silver badge
Facepalm

Stop using bloody Java

Oh, what's that? You bet the farm, on it?

Sucks to be you....

1
4
Silver badge
FAIL

Re: Stop using bloody Java

I'd be out of a job, then. It isn't like PHP, which can be replaced by other stuff, or Ruby on Rails (which has much more exploits every day, and of the serious, "server pwned" kind of exploits.) Lots of "enterprisey" stuff is built on top of Java, so it isn't something you can rip out. And even if you could, the only alternative to it is .NET, which is probably worse as you'd end up tied to the MS ecosystem. yeech!

2
0
Trollface

I'm surprised Mac fanbois aren't proud of this moment

I mean, it's almost as if Somebody out there now considers a Mac to nearly be a real computer!

I mean, somebody's actually sat down, and made the effort to write a virus for it. Why? That's the real question. I mean, what are they going to gain? A huge collection of sepia toned pictures of hipsters drinking latte?

No, this is a sign. It's a sign that there's finally something of worth contained within them! Perhaps...

3
1
Anonymous Coward

Oxymoron Alert!

"...Microsoft’s GM of Trustworthy Computing Security..."

1
0
Stop

in a move which will do nothing to reassure enterprise Mac users of the security of their platform

All two of them?

Apple are hardly renowned for their enterprise offerings...they even killed off the proper rack-based X servers not long ago, ffs.

1
0
Anonymous Coward

I'm sure Eadon will be along soon.

But the reason Linux hasn't been named as a platform that has been hacked is because nobody is using it commercially on the desktop, less than 1% probably.

1
4
Mushroom

Given this is an MS article with an Apple theme...It'll be *both* Eadon and Obviously! trolling each other to critical mass.

<-- And then this will happen.

2
0
Silver badge
Devil

@Silverburn

*both* Eadon and Obviously! trolling each other to critical mass.

<-- And then this will happen."

Not so. Both E & O have such little intellectual depth that the combination of them as polar opposites would release no measurable energy. Mind you, if they just plipped out of existence then the Reg forums would be a better place.

Oi! Reg! Isn't is about time that a sufficient proportion of down votes got a user account deleted (or rather delayed their posts by twenty four hours)?

4
0
Anonymous Coward

Re: @Silverburn

Kind of you to provide the RICHTO Vogon with its icon Silverburn.

@ Ledswinger. Nice idea.... perhaps downvotes > upvotes = moderation... with anything vaguely flamewarish, shilly, O/T or inane summarily dismissed.

0
0
Anonymous Coward

@AC 10:56GMT - What do you mean by non commercial use ?

I'm using my Windows7 on a desktop at home for non commercial purposes exclusively. So what is your point ?

0
0
Anonymous Coward

Hmm, related to XBox Live account hackings

Many gaming sites are reporting a rise in the already prevalent Xbox Live account emptying problem.

Have Microsoft said if this hack was related??? I'm guessing they are keen to keep any XBox Live hacking stories as low key and hidden as possible, but it sounds suspicious...

0
0
FAIL

Java

Just

Another

Vulnerability

Announcement

1
0
Anonymous Coward

Re: Java

Jesus!

Another

Vulnerability

Appears

...or a "recursive" one for the neckbeards...

JAVA

Attack

Vector

Available

0
0
Anonymous Coward

This is what happens

when an important piece of software is open but not free. Not to mention about big corporations like IBM insisting on hilariously old versions of JRE on PCs in order to allow you to use horrible UI for critical applications ?

1
0
This topic is closed for new posts.

Forums