{"id":57391,"date":"2016-09-20T11:31:25","date_gmt":"2016-09-20T18:31:25","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=57391"},"modified":"2022-09-27T12:05:08","modified_gmt":"2022-09-27T19:05:08","slug":"apple-updates-xprotect-malware-definitions-for-netweirdrc","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-updates-xprotect-malware-definitions-for-netweirdrc\/","title":{"rendered":"Apple Updates XProtect Malware Definitions for NetWeirdRC"},"content":{"rendered":"

Apple has updated its XProtect malware definitions file to version 2082 to provide rudimentary protection against certain Mac threats. This update detects two malware variants, which XProtect identifies as OSX.Netwire.A and OSX.Bundlore.B. Additionally, Apple updated the Plugin Black List to essentially ban out-of-date Flash Player versions prior to Adobe Flash Player 23.0.0.162.<\/p>\n

A backdoor called OSX\/NetWeirdRC<\/a>, which\u00a0XProtect\u00a0detects as\u00a0OSX.Netwire.A<\/strong>, is a remote access tool\u00a0that affects OS X (versions 10.6 and higher), Windows, Linux and Solaris. The backdoor offers a number of different functions to perform actions and spy on the user of the infected machine.<\/p>\n

\"XProtect<\/p>\n

Intego VirusBarrier<\/a> with current virus definitions protects Mac users against this malware, detected as OSX\/NetWeirdRC. In addition, VirusBarrier can detect malware downloaded via any application, while Apple’s XProtect system only functions with files downloaded by certain programs, notably Apple software such as Safari, Mail and iChat.<\/p>\n

Apple also added a new code to XProtect for OSX.Bundlore.B<\/strong>, based on Yara rules.<\/p>\n

\"XProtect<\/p>\n

It’s interesting to note that it appears Apple is now using the Yara engine with XProtect. Yara\u00a0is a text based tool<\/a>, developed by Google,\u00a0used by\u00a0malware researchers to identify and classify malware samples. The benefit of Yara is to provide complex and powerful rules based on conditions.<\/p>\n

Apple’s XProtect offers\u00a0basic protection against some Mac threats downloaded by certain programs, and as of\u00a0this latest update appears to only detect new threats on OS X El Capitan and macOS Sierra. Furthermore, XProtect does not offer real-time malware\u00a0scanning, protection against Windows threats or phishing sites, or other protection that full-featured antivirus software can provide. Intego VirusBarrier<\/a> users with up-to-date virus definitions are protected from these threats, and more.<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple has updated its XProtect malware definitions file to version 2082 to provide rudimentary protection against certain Mac threats. This update detects two malware variants, which XProtect identifies as OSX.Netwire.A and OSX.Bundlore.B. Additionally, Apple updated the Plugin Black List to essentially ban out-of-date Flash Player versions prior to Adobe Flash Player 23.0.0.162. A backdoor called […]<\/p>\n","protected":false},"author":4,"featured_media":55957,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190,5],"tags":[86,2764,3124,3121,4096,303],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n