Dockster Mac malware found on Dalai Lama-related website

Our friends at F-Secure have blogged today about a website connected to the Dalai Lama being infected with some Mac malware via a Java exploit.

The Mac malware, which some vendors are calling Dockster, is detected by Sophos's anti-virus software (including our free anti-virus for Mac home users) as OSX/Bckdr-RNW.

Sophos intercepts various elements of the malware as Exp/20124681-A, Mal/JavaGen-J, Exp/20120507-A, and Mal/JavaGen-G.

Exp/201020507 should be familiar with those who follow Mac security news, as it's the same drive-by Java exploit that was abused in the hard-hitting Flashback attack against Mac computers earlier this year.

The good news is that Sophos products have actually been protecting users from visiting the affected website (gyalwarinpoche.com) since October 5th, when our monitoring systems first detected a security problem.

If you take a look at the screenshot above, you will see two white rectangles in the header above the Dalai Lama's head. These are the malicious Java applets that have been embedded by hackers into the website's home page.

A glance at the HTML code for the webpage confirms the dimensions of the boobytrapped Java archives (.JAR) that have been embedded (destmac.jar: 10x10, install.jar: 200x100):

If your Mac is infected by OSX/Bckdr-RNW, remote hackers will be able to steal information from your computer and capture any keypresses you make. The attack was presumably designed to infect computers visiting the Dalai Lama-related website, which - one would imagine - would belong to sympathisers with the exiled Tibetan government.

Running a Mac without anti-virus software is a little like running naked through a field of thistles. Sooner or later, something bad is going to happen.

There's really no excuse for not giving our free Mac anti-virus a go. No strings attached.

(By the way, the exploit on the Dalai Lama website also attempts to download some Windows-based malware - Troj/Agent-ZCT. However, in our tests we were unable to get the code to run properly.)

Computer attacks seeming directed against the Dalai Lama and his sympathisers are nothing new. Just last month, for instance, we saw a new variant of the Imuler Mac Trojan horse spread alongside images of Tibetan organisations.

Thanks to SophosLabs expert Paul Baccas for his assistance with this article.

_{Dalai Lama image from Shutterstock.}