Apple employees have laptops compromised via malicious website

Apple has announced that a ‘small number' of its employees' Mac laptops were compromised by malware, although it is not aware of any data that had been exfiltrated.

The computing giant said that it was compromised by the same people who breached Facebook last week by exploiting a flaw in Java. Apple employees had visited a website for software developers that had been infected with malicious software, with the malware designed to attack Mac computers, according to Reuters.

Apple declined to elaborate on the scale of the attack, but said that the malware was also employed in attacks against Mac computers used by ‘other companies'.

“Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers. The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers,” a statement said.

Reuters reported that the malware was distributed, at least in part, through a site aimed at iPhone developers, which might still be infecting visitors who had not disabled Java in their browser.

Apple said it plans to release a piece of software on Tuesday that customers can use to identify and repair Macs infected with the malware used in the attacks.

Sean Sullivan, a security adviser at F-Secure, said similar attacks could have easily struck other technology companies that lacked the capabilities to detect a breach before saboteurs made off with data.

“There are hundreds, if not millions, of mobile apps in the world," he wrote in a blog post.

“How many of the apps' developers do you think have visited a mobile developer website recently With a Mac and a very false sense of security”

Paul Ducklin, head of technology for Sophos Asia Pacific, said: “Both Facebook and Apple have now admitted to being hacked due to malicious Java code hosted inadvertently by a website popular with mobile developers.

“Twitter, too, admitted to a breach recently, but didn't say how it happened, but suggestively invited everyone to turn off Java in their browser as part of its official statement. The smart money, then, is that Twitter fell into the same hole as Facebook and Apple. No one quite seems to know where this attack, or series of attacks, came from.”