New Mac OS X backdoor Trojan, Sabpab, discovered


Recommended Posts

Hot off the heels of the Flashback malware, Sophos has announced the discovery of a new Mac OSX Trojan, Sabpab, which uses the same Java vulnerability Flashback used, and just like Flashback, doesn't need or require any user interaction to be installed.

The newly discovered Sabpab malware is in many ways a basic backdoor Trojan horse. It connects to a control server using HTTP, receiving commands from remote hackers as to what it should do. The criminals behind the attack can grab screenshots from infected Macs, upload and download files, and execute commands remotely.

The Trojan creates the files

/Users/<user>/Library/Preferences/com.apple.PubSabAgent.pfile

/Users/<user>/Library/LaunchAgents/com.apple.PubSabAGent.plist

Encrypted logs are sent back to the control server, so the hackers can monitor activity.

The potential for abuse of compromised Macs should be obvious, given the Trojan's functionality.

Source: SOPHOS

Apple needs to hand over the maintenance of Java over to its main company. Days of Macs being virus proof are over.

seriously, I can't understand why Apple wants to be in control of when java updates get pushed (aka almost never)

The coffee is opening holes in the apple :p

Anyway since they already fixed that Java issue, this trojan won't affect patched systems, right?

Maybe Apple can buy an anti-virus company and create Apple Security Essentials :p

Apples approach to security is light years ahead of Microsoft, Mac OS can require apps to be signed, each app is broken up into separate parts with each part only able to do one thing, like with QuickTime, the Video Decoder, is ONLY allowed read from teh disk and decry pt the content of a video stream. I could go on, but Ars had a great line up in their OS X Lion review.

Apples approach to security is light years ahead of Microsoft

Don't think I've laughed so hard in a long time, my chest hurts! When it comes to security, the only thing Apple is light years ahead of Microsoft on is denial.

  • Like 3

Part of me wishes Steve was still alive to declare war on Java just like he did Flash. :/

Java needs to go away. I'm sorry to all the Minecraft players out there, but Java needs to die a quick death.

Java needs to go away. I'm sorry to all the Minecraft players out there, but Java needs to die a quick death.

Agreed. I hate the fact I get a prompt to install Java when I'm launching Adobe Photoshop the first time. :pinch:

Java needs to go away. I'm sorry to all the Minecraft players out there, but Java needs to die a quick death.

I'm a Minecraft player and even I think Java needs to die
  • Like 3

Best advice I can give is to just keep Java disabled in your browser of choice. It's already disabled by default in Safari on Lion (even if you have Java installed like Adobe has forced me to do).

Apples approach to security is light years ahead of Microsoft, Mac OS can require apps to be signed, each app is broken up into separate parts with each part only able to do one thing, like with QuickTime, the Video Decoder, is ONLY allowed read from teh disk and decry pt the content of a video stream. I could go on, but Ars had a great line up in their OS X Lion review.

I assume you mean the other way around. Microsoft has always had a huge head start on the security front and they've had the infrastructure and teams established within the company to deal with threats for considerably longer. Your example is great, but IE has had protected mode since Vista AND that can be used by any other apps to switch threads or processes to low IL.

Haven't even touched on ASLR, DEP, and other technologies (I have a larger list in a notebook at home).

Windows 8 will bring even more improvements for intra process security and doing the same application signing requirements for Metro apps.

Apple just released two updates to address this issue and a removal tool for Macs without Java installed.

That's the point I don't understand. Flashback and this new supposed one are Java exploits....so if my Mac doesn't have Java installed how can my machine get infected and thus need this removal tool? Isn't the best defense on this just not to have Java installed along with a good a/v scanner?

That's the point I don't understand. Flashback and this new supposed one are Java exploits....so if my Mac doesn't have Java installed how can my machine get infected and thus need this removal tool? Isn't the best defense on this just not to have Java installed along with a good a/v scanner?

Yes.

I'm glad I upgraded all my Macs to Windows 7 in time.

Yupp.

Zero vulnerabilities. :rolleyes: :laugh:

Glassed Silver:mac

  • Like 3

And did you ditch OS X completely ? If so, I don?t understand your point. If anything, your Macs are a couple of times more vulnerable than ever before. It?s your call, man.

I still have OS X but I have no real reason to use it anymore. The question then becomes, why did I get a Mac in the first place? I didn't know Windows 7 was so good. If I did at the time, I would have saved myself some money and built my own PC.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware by Sayan Sen When Windows 11 was first released, one of the most complained-about issues with the new desktop Microsoft OS was its higher system requirements, which pushed many relatively modern and powerful processors and devices onto the officially unsupported list. Thankfully, they have not been updated again for the base OS, though systems require four times the memory and storage if they want to run AI-powered apps and features. As such, Windows 11 technically runs on 4GB of memory, and there is no imposed restriction on the generation of memory it supports. Speaking of memory, prices are extremely high nowadays for hardware, especially DDR5 and DDR4 kits due to the current silicon shortage, and there are also reports of it affecting DDR2 as well, and it might only be a matter of time before even DDR1 gets affected. Before that could happen, an enthusiast took an ancient DDR1-based system and decided to try out Windows 11 on it to see how well the modern OS would fare on such hardware. The system runs an outdated graphics card interface standard based on AGP, or Advanced Graphics Port, called AGP 3.0 or AGP8x. AGP was essentially succeeded by the modern PCI Express (PCIe) bus standard. The user behind the experiment is retro hardware enthusiast Omores, who built the system around an ASRock ConRoe865PE motherboard based on Intel's i865PE chipset from way back in 2003, around the time when AGP was still in fashion. What made this board special back in the day was its unusual support for newer Core 2 Duo and even Core 2 Quad processors while still retaining older DDR1 memory support and an AGP8X graphics slot, making it an ideal bridge or link between two vastly different generations. Powering the machine was Intel's Core 2 Quad Q6600 alongside 3GB of DDR1 RAM and an ATI Radeon HD 4650 AGP graphics card, one of the final and most capable GPUs released for the aging AGP interface. While installing Windows 11 itself was relatively easy by bypassing Microsoft's hardware checks, getting the graphics card fully functional proved to be some challenge. Microsoft had quietly dropped native AGP support after the earliest releases of Windows 10, meaning newer versions of Windows no longer include the necessary Graphics Address Remapping Table (GART) drivers required for proper AGP acceleration. Without them, AGP graphics cards typically boot up, though with limited functionality, and can often throw a Code 43 error in Device Manager. To work around the limitation, Omores extracted Intel's legacy AGP440 SYS driver from an early Windows 10 release and paired it with a modified INF file so Windows 11 would correctly recognize the chipset. Following this and combined with AMD's final 64-bit Catalyst AGP drivers from 2012, the Radeon HD 4650 was able to operate with full AGP 8X acceleration intact. The result was said to be surprisingly usable for hardware that is over two decades old. Hardware-accelerated H.264 video playback worked correctly and benefited apps like Firefox, while legacy applications and games ran without major graphical issues. The system also successfully completed the 3DMark 2001 benchmark, although performance naturally lagged behind what the same hardware achieves under Windows 7, which is significantly lighter than Windows 11. There was, however, one unavoidable limitation as Microsoft's Windows 11 version 24H2 introduces a mandatory SSE4.2 CPU instruction requirement that cannot be bypassed through installer modifications or registry tweaks. Since no AGP-era processor supports SSE4.2, Windows 11 version 23H2 effectively becomes the final release capable of running on such systems. Regardless, it is still a very cool feat and quite fascinating to see just how stable Windows 11 turned out to be on such unfamiliar hardware. Source: Omores (Patreon) via O_MORES (Reddit)
    • That will only really help other players that are also responsible for creating the problem.
    • Well, it's good to know that they have found a workaround to a problem that they helped create, I guess...
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware by Ivan Jenic Image: Meta The global hardware shortage isn’t exactly news, as the entire world has been struggling with rising component prices for quite some time now. And while big companies certainly aren’t as affected as the average consumer, even they aren’t opposed to the idea of saving a few (million) bucks. Meta appears to have found a way to spend less on new hardware while also putting its outdated infrastructure to use, essentially killing two birds with one stone. The company has built a custom chip that lets it reuse memory from retired servers rather than buying new hardware. The chip is called Vistara and allows for connecting old DDR4 RAM from obsolete servers into new servers that rely on DDR5. The problem Vistara solves goes back to a basic mismatch in how long hardware lasts. Meta replaces its servers every three to five years, but the memory modules inside them are good for seven to ten. When a server gets decommissioned, perfectly usable DDR4 RAM goes with it. Meta is presenting the new method at today’s ISCA symposium, but The Register has got hold of a paper that explains how Vistara works. It's a custom ASIC that bridges DDR4 memory to newer processors via aCXL 2.0/1.1 interface over PCIe Gen5 x16. Meta pulls DDR4 sticks from old machines and installs them in dedicated units it calls MemServers, each of which pairs 768GB of DDR5 with 256GB of recovered DDR4. The operating system sees the DDR4 as an additional memory node and draws from it when the primary DDR5 is running low. Off-the-shelf CXL hardware couldn't do this, so Meta built its own. Existing interfaces bundle their own memory with the controller, which makes reusing old RAM sticks impossible. But Vistara separates the controller from the memory entirely, so Meta can plug in whatever DDR4 sticks it has on hand. Meta plans to deploy the new architecture in hyperscale infrastructure with millions of servers, which should mean that Meta’s AI datacenters will now be more efficient. The company is investing heavily in AI infrastructure, especially with its new AI model, Muse Spark, now widely available. All of this doesn't mean that Meta will exclusively rely on "recycled" RAM, but the company is still looking at considerable savings at scale.
    • Save up to 87% on ChatPlayground AI lifetime subscriptions by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where for only a limited time, you can save up to 87% on ChatPlayground AI: lifetime subscriptions. ChatPlayground AI puts the world’s top AI models in one powerful interface, letting you enter a single prompt and instantly compare outputs from multiple models to choose the perfect response for your needs. Boost productivity and creativity with access to the latest AI giants like GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, and dozens more — all in one window. Whether you’re chatting, coding, generating images, or refining prompts, ChatPlayground AI equips you with advanced tools like prompt engineering, image/PDF chat, saved conversations, and AI image creation, plus priority support to keep your workflow seamless. Access the world’s best AI models Side-by-Side Comparisons: Enter one prompt & instantly view results from multiple AI models to find the best output for your needs 40+ AI Models: Includes GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, Llama, Perplexity, and many more Multi-Function Platform: Access AI for chat, image generation & coding all within a single interface Web Browser Extension: Offers a Chrome extension to seamlessly integrate the platform into your browsing workflow Boost productivity with powerful features ChatPlayground Interface: Designed for seamless AI model comparison in one window Prompt Engineering: Refine & optimize your prompts for better, more accurate responses Chat with Images & PDFs: Upload visuals and documents to get context-aware answers Saved Chat History: Keep track of past conversations for reference & ongoing projects AI Image Generation: Create high-quality visuals powered by top AI image models Priority Customer Support: Get faster assistance whenever you need it What you'll get with the Unlimited Plan Includes unlimited messages/month Built for prompt engineers, startups, and teams who run experiments nonstop Includes priority access to new features and future models Good to know Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: Desktop Max number of device(s): Unlimited Available to both NEW & Existing users Updates included A lifetime subscription to ChatPlayground AI (Unlimited Plan) normally costs $619, but you can pick it up for just $79 for a limited time - that represents a saving of $530 (87% off). Click the link below for more details, always check terms and specifications before making a purchase. Get this ChatPlayground AI (Unlimited) for $79 (was $619) There are also two other discounted plans to choose from. Although priced in U.S. dollars, this deal is available for digital purchase worldwide. Support queries If you have queries or need support for any of the Neowin Deals, please use the contact form here. Neowin Deals are managed and sold by StackCommerce who represent Neowin on an affiliate basis. Why we post these deals We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. So for those that keep moaning and complaining, be thankful we're still online for you to even do that. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      539
    2. 2
      +Edouard
      266
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
  • Tell a friend

    Love Neowin? Tell a friend!