Given the concern that the Flashback Trojan is generating, I’m sharing a script which detects and reports infection of the Trojan. Using this script as an extension attribute you can report on whether each of the three major browsers is infected and if the latest java update has been applied. Finally, leveraging smart groups you can detect if one or more of the conditions is true and take action on a given box.
Example Return Value:
Safari:1,Chrome:0,FireFox:0,DyldLibraries:0,JavaPatched:0 = Safari Browser is infected and Java needs to be patched.
#!/bin/bash
SafariInfected=0
if [[ -z `defaults read /Applications/Safari.app/Contents/Info LSEnvironment 2>&1 | grep "does not exist"` ]]; then
SafariInfected=1
fi
ChromeInfected=0
if [[ -z `defaults read /Applications/Google Chrome.app/Contents/Info LSEnvironment 2>&1 | grep "does not exist"` ]]; then
ChromeInfected=1
fi
FirefoxInfected=0
if [[ -z `defaults read /Applications/Firefox.app/Contents/Info LSEnvironment 2>&1 | grep "does not exist"` ]]; then
FirefoxInfected=1
fi
DyldInsertLibrariesInfected=0
if [[ -z `defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES 2>&1 | grep "does not exist"` ]]; then
DyldInsertLibrariesInfected=1
fi
JavaPatched=0
if [[ -n `which java` ]]; then
JavaVersion=`java -version 2>&1 | grep "java version" | awk '{print $3}'`
JavaVersionNumber=`echo $JavaVersion | sed -e "s/["._]//g"`
if [[ $JavaVersionNumber -lt 16031 ]]; then
JavaPatched=0
else
JavaPatched=1
fi
else
JavaPatched=1
fi
echo "<result>Safari:$SafariInfected,Chrome:$ChromeInfected,FireFox:$FirefoxInfected,DyldLibraries:$DyldInsertLibrariesInfected,JavaPatched:$JavaPatched</result>"
