Even after Apple's fix, 140k machines are still affected by Flashback malware
According to a post on the Symantec security blog, Apple's attempts to get rid of the Java-based Flashback malware that affected 600,000 computers haven't solved the problem completely.
Context & Ripple Effects
Flashback exploited an unpatched Java vulnerability without requiring a password, prompting warnings about the Java entry point and an Apple patch aimed at an estimated 600,000 affected computers. Apple then issued a dedicated removal tool and a Java update, turning response from vulnerability closure to endpoint cleanup.
Symantec's estimate that a substantial infected population remains shows that releasing a fix and reaching every compromised machine are separate operational problems for Apple.
First-order effects
- About 140,000 affected machines remain exposed to Flashback despite Apple's patching and removal efforts, leaving their owners dependent on further cleanup.
- Apple's response is judged on eradication rather than release of the fix alone, while Symantec's infection measurement becomes a key check on that outcome.
Second-order effects
- Apple must treat Java-related Mac security incidents as an endpoint-remediation problem as well as a patch-distribution problem, increasing the importance of detecting systems that did not successfully clean up.
- Security vendors gain influence over incident response by measuring the remaining infected base after platform vendors ship fixes.
Third-order effects
- If repeated infections survive patches at this scale, Mac security will be evaluated less by the platform's resistance to infection than by the speed and completeness of its recovery tooling.
- The episode points toward tighter scrutiny of third-party runtime components such as Java, because a vulnerability in that layer can set the security burden for the host platform.
The trend: Consumer-platform security is shifting from one-time patch releases toward measurable, end-to-end remediation of compromised endpoints.