One in Every Five Mac Computers Harbors Malware, Sophos Research Reveals

24 Apr 2012
One in Every Five Mac Computers Harbors Malware, Sophos Research Reveals Image
New research released by
Sophos
has revealed a disturbingly high level of
malware
on Mac computers—with both Windows and Mac threats being discovered.
Sophos experts analyzed a snapshot of 100,000 Mac computers running its free anti-virus
software, and discovered that one in five machines was found to be carrying one or more instances of Windows malware.
Although Windows malware on Macs will not cause symptoms (unless users also run Windows on their computer), it can still be spread to other computers.
Additionally, Sophos’s analysis shows that 2.7 percent (one in thirty six) of Macs were found to be carrying Mac OS X malware.
“Some Mac users may be relieved that they are seven times more likely to have Windows
viruses, spyware and Trojans on their Macs than Mac OS X-specific malware, but Mac
malware is surprisingly commonly encountered,” said Graham Cluley, senior technology
consultant at Sophos. “Mac users need a wake-up call about the growing malware problem.”
The recent Flashback botnet, which inflicted more than 600,000 users, and fake anti-virus attacks, which scare users into handing over their credit card details, dominate the chart of Mac-based threats.
Top Mac OS X malware found on Mac computers (7-day snapshot of 100,000 Macs): 1. OSX/Flshplyr 75.1%
2. OSX/FakeAV 17.8%
3. OSX/RSPlug 5.5%
4. OSX/Jahlav 1.2%
5. Other 0.4%
“Mac malware can spread via USB stick, email attachments, website download, or even
a silent drive-by installation where the user doesn’t realize their Mac’s security
has been subverted,” continued Cluley. “Cybercriminals view Macs as a soft target,
because their owners don’t typically run anti-virus software and are thought to have
a higher level of disposable income than the typical Windows user. Mac users must protect their computers now or risk making the malware problem on Macs as big as the problem on PCs.”
One in five Macs users who downloaded and scanned their system found Windows malware on Mac computers:
Top Windows malware found on Mac computers (7-day snapshot of 100,000 Macs): 1. Mal/Bredo 12.2%
2. Mal/Phish 7.4%
3. Mal/FakeAV 3.8%
4. Troj/ObfJS 3.6%
5. Mal/ASFDldr 3.3%
6. Troj/Invo 3.0%
7. Troj/Wimad 2.6%
8. Mal/Iframe 1.5%
9. Mal/JavaGen 1.4%
10.Other 61.2%
Some of the malware discovered by Sophos on the 100,000 Mac computers sampled dates
back to 2007, and would have been easily detected if the users had run an anti-virus
product sooner. Bredo, a family of malicious programs sent out via spam, accounts
for 12.2 percent of malware detected on Mac computers. The first Bredo variant was
detected in 2009, and since then, countless variants have been released. Only last
week, it was used in a malicious email campaign that purported to have attached a compromising picture of the recipient.
“The simple fact is that you can scan your Mac for infection from your armchair. The test is painless and free; you just download an anti-virus product and allow
it to check your computer and protect it against infections in future,” explained Cluley.
Home users can join the millions of others who protect their computers by downloading a free version of Sophos Anti-Virus for Mac from:
http://www.sophos.com/freemacav
.
Further information about these malware findings on Macs can be found on Sophos’s Naked Security site at:
http://nakedsecurity.sophos.com
.
About Sophos
More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that
deliver the industry’s lowest total cost of ownership. Sophos offers award-winning
encryption, endpoint security, web, email, and network access control solutions backed
by SophosLabs – a global network of threat intelligence centers. With more than two
decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at
http://www.sophos.com

DON’T LET THE NEWS MEDIA SCARE YOU – SETUP GOOGLE DNS

Here is a page from google on how to change the dns settings on your computer to use google dns.

There are some great security benefits to using google’s dns servers. Google is constantly searching for malware and when it finds an infected site, it is flagged and if you have your dns settings set to use google’s dns server, google will prevent your computer from going to a site it has flagged. Since google is constantly searching, once it detects the threat no longer exists, it will allow you to go to that site again. https://developers.google.com/speed/public-dns/docs/using
One note: you can ignore the IP V6 settings on the page, as they really don’t apply for now.

Below is text from the page about google dns.
Using Google Public DNS
Download this page in PDF
Configuring your network settings to use Google Public DNS
Testing your new settings
Diagnosing resolution problems
Switching back to your old DNS settings
Configuring your network settings to use Google Public DNS
When you use Google Public DNS, you are changing your DNS “switchboard” operator from your ISP to Google Public DNS.
In most cases, the IP addresses used by your ISP’s domain name servers are automatically
set by your ISP via the Dynamic Host Configuration Protocol (DHCP). To use Google
Public DNS, you need to explicitly change the DNS settings in your operating system
or device to use the Google Public DNS IP addresses. The procedure for changing your
DNS settings varies according to operating system and version (Windows, Mac or Linux) or the device (computer, phone, or router). We give general procedures here that
might not apply for your OS or device; please consult your vendor documentation for authoritative information.
Note: We recommend that only users who are proficient with configuring operating system settings make these changes.
Important: Before you start
Before you change your DNS settings to use Google Public DNS, be sure to write down
the current server addresses or settings on a piece of paper. It is very important
that you keep these numbers for backup purposes, in case you need to revert to them at any time.
After changing your settings, if you encounter a problem and cannot connect to the Internet, please call our
support numbers
for troubleshooting instructions.
We also recommend that you
download this page
and print it, in the event that you encounter a problem and need to refer to these instructions.
Google Public DNS telephone support
877-590-4367 in the U.S.
770-200-1201 outside the U.S.
Google Public DNS IP addresses
The Google Public DNS IP addresses (IPv4) are as follows:
8.8.8.8
8.8.4.4
The Google Public DNS IPv6 addresses are as follows:
2001:4860:4860::8888
2001:4860:4860::8844
You can use either number as your primary or secondary DNS server. You can specify both numbers, but do not specify one number as both primary and secondary.
You can configure Google Public DNS addresses for either IPv4 or IPv6 connections, or both.
Changing your DNS servers settings
Because the instructions differ between different versions/releases of each operating
system, we only give one version as an example. If you need specific instructions
for your operating system/version, please consult your vendor’s documentation. You may also find answers on our
user group
.
Many systems allow you to specify multiple DNS servers, to be contacted in a priority
order. In the following instructions, we provide steps to specify only the Google
Public DNS servers as the primary and secondary servers, to ensure that your setup will correctly use Google Public DNS in all cases.
Note: Depending on your network setup, you may need administrator/root privileges to change these settings.
Microsoft Windows
DNS settings are specified in the TCP/IP Properties window for the selected network connection.
Example: Changing DNS server settings on Microsoft Windows 7 1. Go the Control Panel.
2. Click Network and Internet, then Network and Sharing Center, and click Change adapter settings.
3. Select the connection for which you want to configure Google Public DNS. For example:
To change the settings for an Ethernet connection, right-click Local Area Connection, and click Properties.
To change the settings for a wireless connection, right-click Wireless Network Connection, and click Properties.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
4. Select the Networking tab. Under This connection uses the following items, select Internet Protocol Version 4 (TCP/IPv4) or Internet Protocol Version 6 (TCP/IPv6) and then click
Properties.
5. Click Advanced and select the DNS tab. If there are any DNS server IP addresses
listed there, write them down for future reference, and remove them from this window. 6. Click OK.
7. Select Use the following DNS server addresses. If there are any IP addresses listed in the Preferred DNS server or Alternate DNS server
, write them down for future reference.
8. Replace those addresses with the IP addresses of the Google DNS servers: For IPv4: 8.8.8.8 and/or 8.8.4.4.
For IPv6: 2001:4860:4860::8888 and/or 2001:4860:4860::8844
9. Restart the connection you selected in step 3.
10. Test that your setup is working correctly; see
Testing your new settings
below.
11. Repeat the procedure for additional network connections you want to change. Mac OS X
DNS settings are specified in the Network window.
Example: Changing DNS server settings on Mac OS 10.5
1. From the Apple menu, click System Preferences, then click Network.
2. If the lock icon in the lower left-hand corner of the window is locked, click the icon to make changes, and when prompted to authenticate, enter your password.
3. Select the connection for which you want to configure Google Public DNS. For example: To change the settings for an Ethernet connection, select Built-In Ethernet, and click Advanced.
To change the settings for a wireless connection, select Airport, and click Advanced. 4. Select the DNS tab.
5. Click + to replace any listed addresses with, or add, the Google IP addresses at the top of the list:
For IPv4: 8.8.8.8 and/or 8.8.4.4.
For IPv6: 2001:4860:4860::8888 and/or 2001:4860:4860::8844
6. Click Apply and OK.
7. Test that your setup is working correctly; see
Testing your new settings
below.
8. Repeat the procedure for additional network connections you want to change. Linux
In most modern Linux distributions, DNS settings are configured through Network Manager. Example: Changing DNS server settings on Ubuntu
1. In the System menu, click Preferences, then click Network Connections.
2. Select the connection for which you want to configure Google Public DNS. For example:
To change the settings for an Ethernet connection, select the Wired tab, then select your network interface in the list. It is usually called eth0.
To change the settings for a wireless connection, select the Wireless tab, then select the appropriate wireless network.
3. Click Edit, and in the window that appears, select the IPv4 Settings or IPv6 Settings tab.
4. If the selected method is Automatic (DHCP), open the dropdown and select Automatic (DHCP) addresses only
instead. If the method is set to something else, do not change it.
5. In the DNS servers field, enter the Google Public DNS IP addresses, separated by a space:
For IPv4: 8.8.8.8 and/or 8.8.4.4.
For IPv6: 2001:4860:4860::8888 and/or 2001:4860:4860::8844
6. Click Apply to save the change. If you are prompted for a password or confirmation, type the password or provide confirmation.
7. Test that your setup is working correctly; see
Testing your new settings
below.
8. Repeat the procedure for additional network connections you want to change.
If your distribution doesn’t use Network Manager, your DNS settings are specified in /etc/resolv.conf.
Example: Changing DNS server settings on a Debian server
1. Edit /etc/resolv.conf:
sudo vi /etc/resolv.conf
2. If any nameserver lines appear, write down the IP addresses for future reference. 3. Replace the nameserver lines with, or add, the following lines: For IPv4:
nameserver 8.8.8.8
nameserver 8.8.4.4
For IPv6:
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
4. Save and exit.
5. Restart any Internet clients you are using.
6. Test that your setup is working correctly; see
Testing your new settings
below.
Additionally, if you are using DHCP client software that overwrites the settings
in /etc/resolv.conf, you will need to set up the client accordingly by editing the client’s configuration file.
Example: Configuring DHCP client sofware on a Debian server
1. Back up /etc/resolv.conf:
sudo cp /etc/resolv.conf /etc/resolv.conf.auto
2. Edit /etc/dhcp3/dhclient.conf:
sudo vi /etc/dhcp3/dhclient.conf
3. If there is a line containing domain-name-servers, write down the IP addresses for future reference.
4. Replace that line with, or add, the following line:
For IPv4:
prepend domain-name-servers 8.8.8.8, 8.8.4.4;
For IPv6:
prepend domain-name-servers 2001:4860:4860::8888, 2001:4860:4860::8844; 5. Save and exit.
6. Restart any Internet clients you are using.
7. Test that your setup is working correctly; see
Testing your new settings
below.
Routers
Every router uses a different user interface for configuring DNS server settings;
we provide only a generic procedure below. For more information, please consult your router documentation.
Note:
Some ISPs hard-code their DNS servers into the equipment they provide; if you are
using such a device, you will not be able to configure it to use Google Public DNS.
Instead, you can configure each of the computers connected to the router, as described above.
To change your settings on a router:
1. In your browser, enter the IP address to access the router’s administration console. 2. When prompted, enter the password to access network settings. 3. Find the screen in which DNS server settings are specified.
4. If there are IP addresses specified in the fields for the primary and seconday DNS servers, write them down for future reference.
5. Replace those addresses with the Google IP addresses:
For IPv4: 8.8.8.8 and/or 8.8.4.4.
For IPv6: 2001:4860:4860::8888 and/or 2001:4860:4860::8844
6. Save and exit.
7. Restart your browser.
8. Test that your setup is working correctly; see
Testing your new settings
below.
Mobile or other devices
DNS servers are typically specified under advanced wi-fi settings. However, as every
mobile device uses a different user interface for configuring DNS server settings,
we provide only a generic procedure below. For more information, please consult your mobile provider’s documentation.
To change your settings on a mobile device:
1. Go to the screen in which wi-fi settings are specified.
2. Find the screen in which DNS server settings are specified.
3. If there are IP addresses specified in the fields for the primary and seconday DNS servers, write them down for future reference.
4. Replace those addresses with the Google IP addresses:
For IPv4: 8.8.8.8 and/or 8.8.4.4.
For IPv6: 2001:4860:4860::8888 and/or 2001:4860:4860::8844
5. Save and exit.
6. Test that your setup is working correctly; see
Testing your new settings
below.
Testing your new settings
To test that the Google DNS resolver is working:
1. From your browser, type in a hostname (such as http://www.google.com/
). If it resolves correctly, bookmark the page, and try accessing the page from the
bookmark. If both of these tests work, everything is working correctly. If not, go to step 2.
2. From your browser, type in a fixed IP address. You can use http://18.62.0.96/ (which points to the website http://www.eecs.mit.edu/
) as the URL*. If this works correctly, bookmark the page, and try accessing the
page from the bookmark. If these tests work (but step 1 fails), then there is a problem
with your DNS configuration; check the steps above to make sure you have configured everything correctly. If these tests do not work, go to step 3.
3. Roll back the DNS changes you made and run the tests again. If the tests still do
not work, then there is a problem with your network settings; contact your ISP or network administrator for assistance.
* Google thanks MIT for granting permission to use this URL for the purposes of testing web connectivity.
Diagnosing resolution problems
If you are encountering problems when resolving particular names, and want to verify
whether the problem is with Google Public DNS, please try running the following diagnostic procedures. If you want to report a problem to the
Google Public DNS user group
, please copy and paste the results of the commands in your email. This information is vital to help us to identify the cause of the problem.
Step 1: Verify that your client can communicate with the Google Public DNS servers IPv4
Open a command prompt, and run the following command:
On Windows:
tracert -d 8.8.8.8
On Mac OS X:
/usr/sbin/traceroute -n -w 2 -q 2 -m 30 8.8.8.8
On Linux:
sudo traceroute -n -w 2 -q 2 -m 30 8.8.8.8
If the last line of the output does not list 8.8.8.8 as the final hop, or if there
are significant timeouts, there may be a network problem preventing you from contacting
our servers. Please include the output of the command in any communication with the Google Public DNS team.
If the last line of the output does list 8.8.8.8 as the final hop, continue to step 2
.
IPv6
Open a command prompt, and run the following command:
On Windows:
tracert -d 2001:4860:4860::8888
On Mac OS X:
/usr/sbin/traceroute -n -w 2 -q 2 -m 30 2001:4860:4860::8888 On Linux:
sudo traceroute -n -w 2 -q 2 -m 30 2001:4860:4860::8888
If the last line of the output does not list 2001:4860:4860::8888 as the final hop,
or if there are significant timeouts, there may be a network problem preventing you
from contacting our servers. Try configuring Google Public DNS for IPv4 to diagnose
whether the problem is due to IPv6 connectivity on your network. If IPv4 works for
you, you may want to revert your IPv6 configuration and use Google Public DNS with
IPv4 exclusively. Otherwise, please include the output of the command in any communication with the Google Public DNS team.
If the last line of the output does list 2001:4860:4860::8888 as the final hop, continue to
step 2
.
Step 2: Verify that Google Public DNS can resolve the selected hostname IPv4
At the command prompt, run the following command, replacing http://www.google.com.
with the name that you were having difficulty resolving (putting a period at the end of the name to avoid problems with domain suffixes and search lists): On Windows:
nslookup -debug http://www.google.com. 8.8.8.8
On Mac and Linux:
dig @8.8.8.8 http://www.google.com.
If the output shows an answer section with an A record for the hostname, then Google
Public DNS is able to resolve the name. Check your settings to make sure your system
is correctly configured to use Google Public DNS. If you are still unable to solve
the problem, please include the output of the command in any communication with the Google Public DNS team.
If the output does not show an answer for the hostname, continue to step 3
.
IPv6
Windows
At the command prompt, run the following command, replacing http://www.google.com.
with the name that you were having difficulty resolving* (putting a period at the end of the name to avoid problems with domain suffixes and search lists): nslookup -debug -type=AAAA http://www.google.com. 2001:4860:4860::8888 If the output shows an answer section with an AAAA record for the hostname, then
Google Public DNS is able to resolve the name. Check your settings to make sure your system is correctly configured to use Google Public DNS. If you are still unable
to solve the problem, please include the output of the command in any communication with the Google Public DNS team.
If the output shows an answer section with an A (IPv4) record for the hostname, then
Google Public DNS is able to resolve the name, but the host and/or its nameserver
are not configured to return IPv6 results. If you want to verify that you are correctly receiving AAAA records, you can use the hostname
ipv6.google.com as a generic test.
If the output for ipv6.google.com, or another host for which you are certain IPv6 records exist, does not show an answer, continue to
step 3
.
On Mac and Linux
At the command prompt, run the following command, replacing http://www.google.com.
with the name that you were having difficulty resolving*. (putting a period at the end of the name to avoid problems with domain suffixes and search lists): dig @2001:4860:4860::8888 http://www.google.com. AAAA
If the output shows an answer section with an AAAA record for the hostname, then
Google Public DNS is able to resolve the name. Check your settings to make sure your system is correctly configured to use Google Public DNS. If you are still unable
to solve the problem, please include the output of the command in any communication with the Google Public DNS team.
If the output does not show an AAAA record for the hostname, this may be because the the host and/or its nameserver are not configured to return IPv6 results. If
you want to verify that you are correctly receiving AAAA records, you can use the hostname
ipv6.google.com as a generic test.
If the output for ipv6.google.com, or another host for which you are certain IPv6 records exist, does not show an answer, continue to
step 3
.
*Note: Google properties will not return AAAA records for all users. Please see the Google over IPv6
page for more information about whether your system qualifies. Step 3: Verify that another open resolver can resolve the selected hostname
At the command prompt, run any one of the following commands, replacing http://www.google.com. with the name that you were having difficulty resolving (still putting a period at the end of the name to avoid problems with domain suffixes and search lists): nslookup http://www.google.com. 4.2.2.1
nslookup http://www.google.com. 4.2.2.2
nslookup http://www.google.com. 208.67.222.222
nslookup http://www.google.com. 208.67.220.220
(The first two commands test Level 3’s DNS servers. The last two commands test OpenDNS’ DNS servers.)
If you are not able to get a successful result, this means that there is most likely
a problem with the server you are trying to contact. Wait some time and try running
the tests again. This may be a temporary problem on the server’s side that will likely
resolve itself eventually. If it does not, you should contact the owner of the server.
If you do get a successful result, there may be a problem with Google Public DNS.
Please include the output of this command and the one from step 2 in any communication with the Google Public DNS team.
Step 4: Check to see if the authoritative nameservers are correct
If Google Public DNS (or any open resolver) has trouble resolving a site, or returns
inconsistent answers, sometimes it’s because the authoritative nameservers are having
trouble. There are various tools and sites to help you check this. Some users (and some Google Public DNS engineers) have found
intoDNS
to be very helpful. For example, if you’re trying to resolve http://www.example.com, visit
intodns.com
and enter example.com (the domain for http://www.example.com), or visit http://intodns.com/example.com
directly.
Google thanks the intoDNS staff for letting us link to them. Switching back to your old DNS settings
If you had not previously configured any customized DNS servers, to switch back to your old settings, in the window in which you specified the Google IP addresses, select the option to enable obtaining DNS server addresses automatically, and/or
delete the Google IP addresses. This will revert your settings to using your ISP’s default servers.
If you need to manually specify any addresses, use the procedures above to specify the old IP addresses.
If necessary, restart your system.
Google, Inc.