Dockster Mac malware found on Dalai Lama-related website

Filed Under: Celebrities, Java, Malware, OS X, Vulnerability

Dalai Lama. Image from Shutterstock
Our friends at F-Secure have blogged today about a website connected to the Dalai Lama being infected with some Mac malware via a Java exploit.

The Mac malware, which some vendors are calling Dockster, is detected by Sophos's anti-virus software (including our free anti-virus for Mac home users) as OSX/Bckdr-RNW.

Sophos intercepts various elements of the malware as Exp/20124681-A, Mal/JavaGen-J, Exp/20120507-A, and Mal/JavaGen-G.

Exp/201020507 should be familiar with those who follow Mac security news, as it's the same drive-by Java exploit that was abused in the hard-hitting Flashback attack against Mac computers earlier this year.

The good news is that Sophos products have actually been protecting users from visiting the affected website ( since October 5th, when our monitoring systems first detected a security problem.

Compromised website

If you take a look at the screenshot above, you will see two white rectangles in the header above the Dalai Lama's head. These are the malicious Java applets that have been embedded by hackers into the website's home page.

A glance at the HTML code for the webpage confirms the dimensions of the boobytrapped Java archives (.JAR) that have been embedded (destmac.jar: 10x10, install.jar: 200x100):

Compromised HTML code, containing links to malicious JARs

If your Mac is infected by OSX/Bckdr-RNW, remote hackers will be able to steal information from your computer and capture any keypresses you make. The attack was presumably designed to infect computers visiting the Dalai Lama-related website, which - one would imagine - would belong to sympathisers with the exiled Tibetan government.

Running a Mac without anti-virus software is a little like running naked through a field of thistles. Sooner or later, something bad is going to happen.

There's really no excuse for not giving our free Mac anti-virus a go. No strings attached.

(By the way, the exploit on the Dalai Lama website also attempts to download some Windows-based malware - Troj/Agent-ZCT. However, in our tests we were unable to get the code to run properly.)

Computer attacks seeming directed against the Dalai Lama and his sympathisers are nothing new. Just last month, for instance, we saw a new variant of the Imuler Mac Trojan horse spread alongside images of Tibetan organisations.

Thanks to SophosLabs expert Paul Baccas for his assistance with this article.

Dalai Lama image from Shutterstock.

, , , , , ,

You might like

4 Responses to Dockster Mac malware found on Dalai Lama-related website

  1. Richard · 1037 days ago

    Wait, where's the long list of comments claiming that "there's no malware on Macs", or that you're making this stuff up to "sell" your free Mac anti-virus? :o)

  2. Connie · 1037 days ago

    I am protected by Sophos free anti-virus for mac *she says proudly*.

  3. MikeP_UK · 1036 days ago

    Macs are as vulnerable as any system running a UNIX-based OS. Macs use their own version of UNIX, so are potentially vulnerable and need decent protection systems installed and running.
    Likewise Linux flavours. They are related to UNIX as well, so need the same protection.
    It's just that Windows is 'more popular' with attackers but Mac and Linux users are not immune.

  4. daniel-san · 1024 days ago

    Why are the chinese hackers spreading more hatred against the Dalai Lama? It's incorrigible! Don't they have any decency?

    Thank goodness for companies like Sophos, alerting us AND offering antivirus/security tools against these miscreants. THANK YOU FOLKS!!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley