The news of the outbreak of BackDoor.Flashback.39 that has infected over 650 000 computers running Mac OS X quickly spread throughout the world, causing a strong public response. The Russian anti-virus company Doctor Web that was the first to issue a warning concerning this threat presents the brief BackDoor.Flashback.39 outbreak chronology.
- February 2012 Oracle released an update for the Java Virtual Machine closing vulnerabilities exploited by BackDoor.Flashback.39.
- March 25, 2012 First Flashback botnet domains registered
- March 27, 2012 Doctor Web added the BackDoor.Flashback.39 signature into the virus database used by its Dr.Web for Mac OS X.
- April 3, 2012 Doctor Web analysts reverse-engineered the routine employed by BackDoor.Flashback.39 to generate control server domain names, registered several domain names and began gathering statistics by analysing requests received from bots. More than 130000 bot replies were received in the very first hours.
- April 4, 2012 According to data collected by Doctor Web virus laboratory, the number of infected hosts in the BackDoor.Flashback.39 botnet reached 550,000. Doctor Web issued a press-release concerning the BackDoor.Flashback.39 epidemic.
- April 4, 2012 (April 3 for North America). Apple has released an update for Apple Java closing the vulnerabilities exploited by the Trojan BackDoor.Flashback.39. Due to the difference in time zones, many Mac OS X users got the update after a significant delay.
- April 4, 2012 The number of hosts in the botnet exceeded 600 thousand infected Macs.
- April 6, 2012 Apple released a second update that closed the vulnerabilities exploited by the Trojan BackDoor.Flashback.39.
- April 9, 10 A corporation made unsuccessful attempts to block domains used by Doctor Web to study the BackDoor.Flashback.39 botnet.
- April 10 The total number of computers infected by the Trojan has exceeded 650,000.
The current number of machines infected by BackDoor.Flashback.39 is 655 700. Mac users can use the free service from Doctor Web at www.drweb.com/flashback/ to check if their computers are infected.
Leave a reply
