Jeroen Frijters称自己是“无意之中”的黑客，一个被安全漏洞偶然击中的人，就像正常的行人走在大街上，被路上的东西绊到了一样。7月，Dutch软件的工程师就发现了Grand Canyon有这样的漏洞：这个漏洞存在于Java当中，这是一个普遍应用的程序语言之一，也是许多网站都在用的 。他将这个漏洞报告给了甲骨文，甲骨文一直在监视着Java。
大约过了9个月，这个bug就能够让最大的恶意攻击者，攻击苹果电脑。自从3月底，至少有60000台苹果电脑被一个叫Flashback的病毒攻击。这次病毒攻击是在4月4日，被俄罗斯的一家不知名的反病毒攻击的Doctor Web公司发现的，当时这种病毒主要是攻击美国境内的电脑。这其中也包括苹果总部加利福尼亚州库比蒂诺的电脑，这表明，在世界上市值最高的公司的员工可能引起了这场病毒攻击。这场风波削弱了人们对苹果产品可靠性的认可，一般来讲，苹果系统比Windows的安全性要高一些。
对果粉来说，更打击的是：苹果本可以采取更多的措施来避免这场攻击的发生。甲骨文与微软在安全问题上，一直都有紧密的合作，甲骨文在成功找到解决14个安全漏洞的方法之后，包括Frijters发现的。甲骨文在2月中旬向所有的Windows用户直接发送了一个软件修补。这些修补软件之于Windows用户就像是烤肉对于罪犯一样，这些人，将安装前后的编码对比，先是修补这些潜在的漏洞，然后在没有安装软件的电脑上试用。。苹果，坚持发送自己的修补软件，但是在发布之前，整整等了两个月。苹果已经表示正在研究一种软件，能够检测并且清理受攻击电脑上的恶意软件。
McAfee前首席杀毒软件负责人George Kurtz和现任CEOCrowdStrike表示，考虑到系统的安全性，等待如此长的时间是不能接受的。至于苹果为何不与甲骨文合作，早一点发送杀毒软件的原因还不知道，但是Kurtz表示，这和苹果一向的控制欲有关。他说，苹果总是想独树一帜。苹果有强大的软件，强大的硬件，从始至终都严格的控制一切。我不认为苹果会做不在它自己计划范围内的事情。就此苹果和甲骨文都未作出任何评论。
Symantec的营运经理Liam O Murchu称，这种恶意代码源起于去年发现盗取密码的一组程序。被攻击的用户可能会被盗窃身份或者诈骗。Doctor Web报告说，这种病毒也会更改Google的搜索结果，出现一些垃圾邮件的链接而不是真正的链接。
Doctor Web的CEO Boris Sharov表示，受攻击的数量在苹果软件升级后，就大大的减少了。正常情况下，新的修补软件短时间内会引发大量的攻击事件，因为他们会将潜在的漏洞都查找出来，但是并不是所有的用户都会立刻更新软件。苹果本可以通过给所有用户发送修补软件来避免这个事件，即使是那些使用盗版软件的用户，都会经常提醒用户有等待更新的软件。
苹果因为弃权在去年就不再使用Java，这样一来，受攻击的电脑数量减少了。
Sharov表示，至于这次病毒袭击为什么突然就停止了，最后可能的解释就是这些黑客们自动放弃了攻击。要想使病毒发挥作用，这种病毒必须能够发送和接收一个由黑客远程控制的服务器。但是Flashzback被发现时，网络安全人员和苹果公司就开始识别这种病毒，并且将它们杀死。在尝试阻止病毒进一步传播时，苹果公司无意之中下载了Doctor Web的一个服务项目，这个项目是在模仿黑客控制病毒的命令模式，进而来研究这些恶意软件。Frijters表示，这次网络崩溃对苹果来说应该算是个警醒。他补充道，苹果认为没有赶上能够与甲骨文合作发布抗病毒软件，这种说法站不住脚。苹果只相信他们自己的市场信息，也就是Macs是不会感染上病毒的。
Jeroen Frijters describes himself as an “accidental” hacker, a guy who trips over security holes the way a pedestrian stumbles over a sidewalk crack. In July the Dutch software engineer discovered the Grand Canyon of sidewalk cracks: a serious vulnerability in Java, one of the most widely used programming languages and a building block of many websites. He reported the flaw to Oracle (ORCL), which oversees Java.
About nine months later, that bug has enabled the largest malware attack ever to target Apple (AAPL) computers. Since the end of March, more than 600,000 Macs have been infected by a virus known as Flashback. The attack, disclosed on April 4 by a little-known Russian antivirus company called Doctor Web, has mainly affected computers in the U.S. That includes a few hundred Macs in Apple’s hometown of Cupertino, Calif., suggesting some employees at the world’s most valuable company may have caught the virus. The incident has shattered the sense of invulnerability felt by many users of Apple products, which generally face fewer security risks than those running Windows.
Even more dismaying to Apple fans: The company may have been able to do a lot more to prevent the outbreak. Oracle works closely with Microsoft (MSFT) on security issues, and after the company developed a fix for 14 security holes, including the one Frijters discovered, it released a software patch directly to Windows users in mid-February. Those patches are like beacons for criminals, who compare the code before and after the fix to home in on the underlying flaw and then develop ways to exploit it on unpatched computers. Apple, which insists on issuing its own Java patches, waited nearly two months before distributing a fix. The company has announced it’s working on software to detect and remove the malware from infected machines.
“Waiting that long was unacceptable given the severity of the vulnerabilities,” says George Kurtz, former chief technology officer of antivirus software maker McAfee (INTC) and now chief executive officer of CrowdStrike, a security startup. It’s not clear why Apple didn’t work with Oracle to release a patch earlier, but Kurtz says it’s in line with the tech giant’s famed desire for control. “Apple marches to the beat of its own drummer,” he says. “It makes great hardware, it makes great software, and it controls everything from start to finish. I don’t think it likes doing anything that’s not on its own timeline.” Apple and Oracle declined to comment.
The malicious code is from a family of password-stealing programs originally spotted last year, says Liam O Murchu, manager of operations for Symantec’s (SYMC) security response unit. The owners of infected computers could be exposed to identity theft and fraud. Doctor Web reports the virus can also alter Google search results, displaying spam links instead of actual ones.
Boris Sharov, CEO of Doctor Web, says the number of infected machines started leveling off soon after Apple’s software update. Normally, new patches temporarily cause an uptick in attacks since they publicize the underlying flaw, and not all users update their computers at once. Apple may have been helped by its practice of distributing patches to all of its machines, even those using pirated software, and frequently reminding users when they have updates waiting. Also, Apple stopped installing Java by default last year, putting fewer computers at risk.
Sharov says the most likely explanation for the abrupt end to the virus’s spread is that the criminals gave up. To be effective, a virus must be able to send and receive information to a remote server controlled by the hackers. Once Flashback was discovered, security researchers and Apple began identifying and shutting them down. (In its zeal to stem the virus’s spread, Apple accidentally tried to take down a Doctor Web server that was mimicking the hackers’ command-and-control machines to study the malware.) Frijters says the debacle should be a wake-up call for Apple. “I think it’s pretty lame that they can’t manage a coordinated release with Oracle,” he says. “They seem to believe in their own marketing message, that Macs can’t get viruses.”
