A new piece of backdoor malware originally discovered on Windows has found a new home in macOS. Disguising itself as a legitimate Adobe Flash Player installer, the malware burrows into pre-existing macOS folders making it harder to spot. Having used a valid developer’s certificate, the malware was set to run free on macOS even with Gatekeeper enabled.
These certificates were created to help validate applications with Gatekeeper, but lately have been used to spread malicious software. This is the second reported malware incident in the past week using a valid certificate.
The Snake malware, and the variants it derives from, has been around for nearly a decade now. Malwarebytes reports Snake has been infecting Windows systems as far back as 2008 and even having a Linux variant discovered back in 2014. Fox-ITdescribes it as a “relatively complex malware framework” citing a research paper from the Swiss government’s Computer Emergency Response Team.
Adobe
Fox-IT makes it clear that attacks involving Snake are highly targeted.
If you search ' adobe flash player' or 'adobe flash projector' brings to a page which installs it as a plugin for your browser. If you want to actual flash player like on pc which u can do 'open' --> 'browse' then choose my file and click 'okay' download it here Adobe Flash Player - Debug Downloads.
Researchers who have previously analyzed compromises where Snake was used have attributed the attacks to Russia. Compared to other prolific attackers with alleged ties to Russia…Snake’s code is significantly more sophisticated, it’s infrastructure more complex and targets more carefully selected.
Today’s macOS variant isn’t one you’ll randomly receive, but the manner in which it hides itself is important.
Snake’s Adobe Flash malware
On macOS, Snake is distributed through a .zip file titled Adobe Flash Player.app.zip. This file contains a legitimate, but backdoored, version of the Adobe’s Flash Player. The application contained within the .zip file initially appears legitimate because of its valid signed certificate issued through Apple. Upon closer inspection, the signature comes from a developer named Addy Symonds, and not the expected Adobe. Even the application’s bundle structures looks odd when compared to a normal one.
Most users wouldn’t think to check an application’s bundle before installing the app.
If a user had proceeded with the installation regardless, handily enough the malware would install a legitimate copy of Adobe Flash Player on the system. During this install, it would also add the backdoor malicious files to the macOS system folders and keep them persistent. By using Apple’s LaunchDaemon service, it could ensure that the backdoor would quickly relaunch if ever closed.
How to check if you’re infected with Snake’s backdoor malware
The Snake malware version currently out in the wild contains debug code and its certificate was signed in February of this year. This leads Fox-IT to believe it may not have even been operational yet, but would soon be used on targets.
Luckily, if anyone does have the Adobe Flash Player.app.zip fileon their system, macOS’ Gatekeeper will no longer show the developer certificate as valid. Apple has revoked that developer’s certificate to help subdue further damage.
To easily check if a system has been infected by the Snake backdoor malware, run a scan with Malwarebytes for Mac. The free software will detect Snake as OSX.Snake and remove it.
If you’d like to manually check for infection, the backdoor malware installs the following various components:
- /Library/Scripts/queue
- /Library/Scripts/installdp
- /Library/Scripts/installd.sh
- /Library/LaunchDaemons/com.adobe.update.plist
- /var/tmp/.ur-*
- /tmp/.gdm-socket
- /tmp/.gdm-selinux
Malwarebytes recommends changing passwords and contacting your business IT department if you were infected. The former is to secure yourself and online accounts, and the latter to mitigate any potential company damage.
Attacks like these are easily spread through spear phishing emails, so be vigilant in your online behaviors.
Images Credit: Malwarebytes
Whether it comes bundled with your computer, bundled with other software, or is just the go-to program for a specific task, the Windows ecosystem is rife with oft-used, yet craptastic software. We asked you what your most hated Windows apps are, and you gave us tons of shudder-inducing examples. We've compiled your answers into a list of our least favorite crapware, and the better programs you can use in their place.
What Are Your Most Hated Default Windows Apps?
Whether you install it accidentally or it's something you're told you 'need',…
Read more ReadAdvertisement
Application to Avoid: Adobe Reader
Indictment: Slow as molasses, insecure, and runs annoying helper app at startup
Superior Alternative(s): We prefer SumatraPDF, though Foxit Reader and PDF-XChange Viewer are also popular alternatives
Notes: Adobe Reader isn't great, but you may find that some PDFs—particularly those with watermarks, editable form fields, or other special features—work better in Adobe Reader than in other PDF readers. If you have to work with PDFs often, Adobe Reader might be unavoidable, but it's a good idea to try something like Sumatra first just to make sure.
Advertisement
Application to Avoid: Adobe Flash
Indictment: Slows your computer, causes frequent browser crashes, hogs resources, drains battery, makes laptops heat up, and much more.
Superior Alternative(s): None, sadly.
Notes: It's pretty hard to go without Flash these days. HTML5 is slowly replacing it in some cases, but a lot of sites still require Flash. The best solution is to install something like Flashblock, available for both Chrome and Firefox, which will let you load Flash only when you need it. Alternatively, you can uninstall the Flash plugin entirely and use Chrome's self-contained version when you need it. This has the added advantage of loading HTML5 on some sites, like YouTube, when using Flashblock would just block the original Flash instead of serving the new HTML5 content.
Go Nearly Flash-Free on a Mac with Safari and Chrome
On some Macs, Flash isn't just a necessary plug-in that's occasionally crash-y. It can be …

Advertisement
Application to Avoid: Norton, McAfee, and other premium Antivirus suites
Indictment: Pricey, Slow, Bloated
Superior Alternative(s): Microsoft Security Essentials
Notes: Ever since Microsoft Security Essentials came out, you haven't had much of a reason to use anything else. MSE is lightweight, good at catching viruses, and does all of its work in the background without bugging you. If you really don't like MSE, though, you have a few other solid options.
Stop Paying for Windows Security; Microsoft's Security Tools Are Good Enough
When it comes to keeping your Windows PC secure, all of the scare tactics and overblown virus…
Read more ReadAdvertisement
Application to Avoid: Internet Explorer
Indictment: Always stuck in the past
Superior Alternative(s): Google ChromeFirefox, Opera
Notes: IE isn't horrible (in fact, version 9 has made a few improvements), but it always seems behind the times compared to every other browser in existence. Unless it's the only browser that can load a specific webapp, it's not worth your time. Use IE to download a more extensible, feature-filled browser and forget about it.
Internet Explorer 9 Screenshot Tour: The Best New Features in IE9
Internet Explorer 9 has officially launched as the latest and greatest browser from Microsoft. IE9…
Read more ReadAdvertisement
Adobe Flash Mac Free
Application(s) to Avoid: Browser Toolbars
Indictment: I don't even know where to start. They'll change your home page, track your browsing habits, take up space, and offer you features you don't want in return.
Superior Alternative(s): Not installing toolbars.
Notes: There are a few exceptions to this rule, but in general, you want to avoid browser toolbars at all costs. Toolbars often come packaged with other software and hijack the crap out of your browser, so any time you see a checkbox with the words 'Ask Toolbar' next to it, do whatever it takes to keep that thing off your system.
Advertisement
Application to Avoid: Windows Media Player
Indictment: Lack of format support, crappy interface
Superior Alternative(s): VLC, KMPlayer, Media Player Classic
Notes: Windows Media Player isn't all bad, but rarely is it preferable over simpler video players like VLC and KMPlayer.
How I Learned to Love Windows Media Player
I've used a lot of media players over the years, but I've always avoided Windows Media…
Read more ReadAdvertisement
Application to Avoid: iTunes
Indictment: Slower than a turtle with dumbbells on its feet, comes with the annoying Apple Software Update and the unnecessary QuickTime
Superior Alternative(s): Winamp, Foobar2000, MediaMonkey, Spotify, and tons of others
Notes: If you have to sync an iOS device, you might be stuck with iTunes. However, you can always use iTunes solely for syncing and use something different for actually listening to your music, which'll help you escape iTunes' bloat for most of the day.
The Best Music Player Application for Windows
There are a lot of great music players for Windows, and it's next to impossible to make a…
Read more ReadAdvertisement
Application to Avoid: QuickTime
Indictment: Unnecessary, comes with the annoying Apple Software Update
Superior Alternative(s): QT Lite, VLC, KMPlayer, Media Player Classic
Notes: If you use iTunes, you need QuickTime on your system, but QuickTime has some annoying habits (like taking over some of your file types). QT Lite is a great QuickTime replacement that'll work with iTunes. If you're not going to use iTunes, though, you can play QuickTime videos in VLC without a problem. VLC and Media Player Classic even come with a browser plugin on the off chance you come across a QuickTime-only format video embedded in a web page.
Advertisement
Application to Avoid: WinZip and WinRAR
Indictment: Pricey, Unnecessary
Superior Alternative(s): 7-Zip, among others
Notes: WinZip is completely unnecessary on modern Windows machines, since it has ZIP support built-in. On the rare occasion ZIP isn't good enough, RARs provide great compression, but WinRAR is shareware, and RAR isn't that much better than 7-Zip's 7z format. For more information on file compression, check out our rundown of the best way to compress your files.
The Best File Archive Utility for Windows
Windows has a number of good file archiving and unarchiving utilities, and which one you use…
Read more ReadAdvertisement
Application to Avoid: Nero Burning ROM, Roxio Creator, and other bloated CD/DVD burners
Indictment: Pricey, bloated
Superior Alternative(s): ImgBurn
Notes: Suites like Nero and Roxio are certainly more advanced than their freeware counterparts, but the majority of users will never need their more advanced features—especially considering their cost (both in dollars and in bloat). Plus, between smartphones and thumb drives, how often do you burn optical media, anyway?
Application to Avoid: Paint
Indictment: Is it still 1995?
Superior Alternative(s): Paint.NET, GIMP
Notes: If you ever have to do any basic image editing, you've probably realized Microsoft Paint is an incredibly primitive (almost childish) program. Paint.NET will serve your basic image editing needs, while GIMP provides more advanced features.
Advertisement
Application to Avoid: AIM, Windows Live Messenger
Indictment: Only support one network at a time, filled with ads
Superior Alternative(s): Pidgin,Miranda, Trillian, Digsby
Notes: We can't recommend Pidgin enough, though if you don't like it, Trillian and Digsby are also feature-filled, multi-protocol options. However, both contain either ads or bundled crapware, which is the exact problem we're trying to solve today. They're certainly better than AIM and Live Messenger, just be aware they're still dangerously close to being adware and crapware.
Application to Avoid: Windows Picture Viewer
Indictment: Doesn't support every format, very basic
Superior Alternative(s): IrfanView, XnView
Notes: Windows Picture Viewer is okay, but if you want support for other formats and extra features like keyboard shortcuts, IrfanView is a great replacement.
Advertisement
Application to Avoid: Skype
Indictment: Difficult to quit, runs at startup, horrible interface
Superior Alternative(s): Google Video Chat
Notes: This one's a little harder to escape, since everyone else you know probably uses Skype. But it's such a pain in the butt, it's worth trying to get all your friends to convert, since Skype probably annoys them just as much as it does you.
Advertisement
Application to Avoid: Microsoft Office
Indictment: Pricey, painfully slow, difficult to use
Superior Alternative(s): LibreOffice, Google Docs
Notes: Office suites have never been the poster children for blinding speed, but Microsoft Office is one of the worst offenders. It feels like you stare at that splash screen for hours before you actually get to start working. If you don't absolutely need Microsoft Office, LibreOffice is a great, free replacement that can handle most users' needs, though Google Docs'll also get the job done for more adventurous users.
Application to Avoid: Notepad
Indictment: Severely lacking in features
Superior Alternative(s): Notepad++, Notepad2
Notes: It's fine for one-off text edits, but if you ever spend any time in text editors, you know how painfully basic Windows' Notepad is. Notepad++ is is packed with useful features that make it stand out over Notepad. If you really want to complete the transition away from Notepad, a few system tweaks can make sure you never have to deal with it again.
Advertisement
The Best Programming Text Editor for Windows
Sure you can turn to a heavy IDE when you want to edit your code, but if you prefer a simple,…
Read more ReadApplication to Avoid: Windows Command Prompt
Indictment: Annoying interface quirks, lacks real power
Superior Alternative(s): Cygwin + Console2, PowerShell
Notes: If you rarely visit the command prompt, Windows' built-in offering is probably fine. But if you're a heavy command line user, you'll want something a bit more advanced. Users familiar with Windows commands will love PowerShell, which is bundled with Windows 7, while UNIX veterans will love the Cygwin shell coupled with a better terminal program like Console2.
Advertisement
How Can I Make the Windows Command Prompt Better?
Dear Lifehacker,I'm familiar with the Unix command line on Linux and OS X, but I've…
Read more ReadIt's hardly an exhaustive list, but these are certainly the most annoying pieces of crapware you'll find on a given machine. Got another program that we didn't mention? Tell us about it (and its superior alternative) in the comments.
Advertisement