Apple’s response to the Flashback botnet – Fail

Apple, it keeps telling us, is on top of security. Well, I used to give it the benefit of the doubt on that; but now I’m not so sure. What worries me is not the existence of a massive Mac botnet (Windows suffers from far more), nor even Apple’s response to the finder of the botnet, Russian firm Dr Web. “We’ve given them all the data we have,” said Dr Web’s chief executive Boris Sharov. Apple’s reply? Zilch – but that’s just arrogance, not really anything to worry about, just something we have to accommodate.

It’s the one thing that Apple actually did do that worries me.

The botnet was discovered by Russian firm Dr Web. Not exactly a big name in security, but a good one nevertheless. The company set up three sinkhole servers to help monitor the botnet, estimate its size – and perhaps take it down. Apple’s one actual response? It contacted Russian Web registrar Reggi.ru and asked for one of the servers to be shut down since it was engaged in malicious activity. It wasn’t – it was one of Dr Web’s sinkholes.

Dr Web’s CEO, Boris Sharov, thinks this was an honest mistake by Apple. I suspect it was a dishonest mistake. I suspect it was more to do with Apple attempting to maintain its carefully constructed facade of invulnerability. I suspect that if it had been one of the better known anti-malware companies that had discovered this 600,000 strong Mac botnet Apple would have reacted differently. Instead they thought they could keep quiet, try to shut down the botnet by taking down a C&C server and nobody would be any the wiser.

Instead the company has simply shown itself to be a child in an adult’s playground. Poor show, Apple.

Infosecurity Magazine news stories for 2 March

My news stories on Infosecurity Magazine, Friday 2 March:

“ACTA’s harm greatly exceeds its potential benefits…”
Yesterday the Directorate General for External Policies at the European Parliament held a workshop on the The Anti-Counterfeiting Trade Agreement (ACTA).
02 March 2012

Compromised websites leading to banking malware
M86 Security is warning that recent spam campaigns are luring victims to compromised websites that redirect to malicious Phoenix-hosting sites, which in turn seek to infect the visitor with the Cridex trojan.
02 March 2012

The ten most important security events and issues from 2011, and what they presage for the future
Kaspersky Lab’s analysis of the ‘evolution of malware’ during 2011, from the rise of hacktivism to the emergence of Mac malware; and the consequent lessons for the future.
02 March 2012

Infosecurity Magazine news stories for 28 February

My news stories on Infosecurity Magazine yesterday:

2012 : Expect DDoS botnets to be smaller, more effective and more of them!
A new analysis of DDoS attacks in the second half of 2011 predicts smaller-sized but increased numbers of specialist DDoS botnets.
28 February 2012

M2M presents new security risks that require new security solutions
We are entering a brave new world of machine to machine (M2M) technology. We know it. We have concerns about it. But are we ready for it?
28 February 2012

Gatekeeper – a new security feature or a walled garden for OSX?
Apple’s OSX 10.8 Mountain Lion due this summer will contain a new feature called Gatekeeper. Opinions vary on whether it is a genuine security feature or the cornerstone of a new walled garden.
28 February 2012