<http://schema.org/articleBody>
"Two weeks ago, Mac security software company Intego discovered malware which it classified as &amp;quot;a new Java backdoor trojan called Java/Jacksbot.A.&amp;quot; New threats are discovered all the time, but Intego later concluded that even though Jacksbot is a variant of the Java remote access tool (RAT) created by the jailbreaking group Redpois0n, it can target multiple platforms.\r\n\r\nIntego first reported that the malware version it found is fully functional on Windows, and &amp;quot;partially functional&amp;quot; on OS X and Linux. Since at the time it was not known to have infected users and did not run without root permissions, the security firm classified it as &amp;quot;low risk.&amp;quot;\r\n\r\nYet new information this week from Trend Micro says that this threat has now been spotted in the wild: the company's software has successfully cleaned two infection counts (one in Australia and one in Malaysia). \r\n\r\n\r\n\r\nAs you can see in the screenshot above, the malware checks the OS before continuing its rampage. Both companies agree, however, that Windows is the targeted platform, despite the fact the malware also works on OS X and Linux. Trend Micro has a theory as to why this is:\r\n\r\n\r\nThe malware writers behind JACKSBOT may just be testing the waters for a successful multiplatform malware; however for now they appear to be unwilling to invest the time and resources to develop the code more completely. It's likely that the authors will continue to improve the code to fully support infection for OS X and Linux.\r\n\r\n\r\nIntego first revealed that Jacksbot has the following capabilities:\r\n\r\nGathering system information.\r\nTaking screenshots.\r\nPerforming denial of service attacks.\r\nDeleting files.\r\nStealing passwords (including specifically Minecraft passwords).\r\nVisiting remote URLs, likely to perform Clickfraud.\r\n\r\n\r\nThe malware is capable of visiting URLs, creating files and/or folders, running shell commands, as well as executing and ending programs. It can also steal information by logging keystrokes and mouse events. \r\n\r\nGiven the Minecraft password part, Trend Micro believes it is possible the malware presents itself as a Minecraft modification tool to unsuspecting users. The RAT can take control of the compromised system with some of the following backdoor commands: Chat, Corrupt, DeleteFile, GetFile, GetScreen, KillProcess, ListFiles, ListProcess, Restart, Shutdown, TakeFile, and VisitURL.\r\n\r\nWhile Trend Micro has only detected two infections so far, the fact that malware authors have chosen the multiplatform route shows that they are in it for the long haul. Malware writers love exploiting Java because it's simply more efficient: it allows them to target more than one operating system, more than one browser, and thus more than one type of user.\r\n\r\nSee also - Security companies are recommending you disable Java, or just uninstall it\r\n\r\nImage credit: Musuvathi J Ubendran"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/apple/2012/10/31/jacksbot-java-malware-can-take-control-of-windows-mac-and-linux-systems/>