A year ago today,
Apple released a software update to halt the spread of the
Flashback worm, a malware strain that infected more than 650,000
Mac OS X systems using a vulnerability in Apple’s version of
Java. This somewhat dismal anniversary is probably as good a time as any to publish some clues I’ve gathered over the past year that point to the real-life identity of the Flashback worm’s creator.
Before I delve into the gritty details, a little background on this insidious contagion is in order. A keenly detailed
research paper (PDF) published last year by Finnish security firm
F-Secure puts the impact and threat from Flashback in perspective, noting that the malware boasted a series of “firsts” for its kind. For starters, Flashback was the first OS X malware to be “VMware aware” — or to know when it was being run in a virtual environment (a trick designed to frustrate security researchers). It also was the first to disable
XProtect, OS X’s built-in malware protection program. These features, combined with its ability to spread through a then-unpatched vulnerability in Java made Flashback roughly as common for Macs as the
Conficker Worm was for
Windows PCs.
