topic Singnature to detect Flashback trojon in General Topics

Singnature to detect Flashback trojon

MJRuotolo — Tue, 10 Apr 2012 19:42:09 GMT

Does PA have a Singnature to detect Flashback trojon?

Thanks

Mike

Re: Singnature to detect Flashback trojon

Ryan_Firth — Thu, 12 Apr 2012 03:20:36 GMT

I'd like to know as well. Haven't been able to find anything yet. PA needs to release a signature ASAP due to the fact that most Macs don't run antivirus.

Re: Singnature to detect Flashback trojon

elecnoradmin — Thu, 12 Apr 2012 13:27:49 GMT

I hope is realeased soon as you said there are only few macs with AV

By the way Fsecure guys released a free app to check and remove Flashback

Best regards

Re: Singnature to detect Flashback trojon

tettema — Thu, 12 Apr 2012 18:52:08 GMT

We have coverage on two fronts for this malware. First, we have coverage for the 2 CVEs this has been known to use (CVE-2011-3544 and more recently CVE-2012-0507). Coverage for these exploits have been included in content 300 and updated in 302. These have also been patched by Apple Software Update for clients that are up-to-date. Second, we will be releasing a command-and-control signature (13157) for the Flashback C&C network traffic in this Tuesday's content update, to detect already infected hosts on the network.

Re: Singnature to detect Flashback trojon

juebele — Fri, 31 Aug 2012 12:45:15 GMT

> we will be releasing a command-and-control signature (13157) for the Flashback C&C network traffic in this Tuesday's content update . . .

I cannot find this signature in my Vulnerability Protection Profile. Does any have a search term that shows this signature?

Re: Singnature to detect Flashback trojon

jvalentine — Fri, 31 Aug 2012 14:44:41 GMT

It's there. Go to Objects / Security Profiles / Vulnerability Profiles, Create your own profile, go to the Exceptions Tab, click "show all signatures", and search for flash...

Re: Singnature to detect Flashback trojon

juebele — Fri, 31 Aug 2012 15:45:32 GMT

Hmm. That's what I did. But I'm not seeing any results. . .

Re: Singnature to detect Flashback trojon

mikand — Sat, 01 Sep 2012 08:52:28 GMT

You are in the vuln profile instead of the antispyware profile - dunno if that should matter (but it does when you search at threatvault where there are virus, vuln and spyware as three different databases for some reason).

Re: Singnature to detect Flashback trojon

jvalentine — Sun, 02 Sep 2012 21:18:08 GMT

It does matter. Spyware signatures detect the network traffic for nasty things like Trojans, Botnets, etc. The Vulnerability signatures are for vulnerabilities that exist within legitimate business applications.