'Opener' Malware Targets OS X

the_webmaestro writes "Macintouch.com is covering the "opener" malware, a new and potential vulnerability which affects Mac OS X. If true (it's not on HoaxBusters yet), this could become a Mac user's worst nightmare... Worse even than Microsoft Word macro viruses (heretofore the only real 'viruses' which threatened Mac users)! Normally, when ever I'd see virus alerts, I'd revel in the fact that as a Mac user, I was immune (except for the slow-down of the net, the loss in productivity of my colleagues, and the increase in SPAM--often coming from my friends and colleagues). [Sigh] Perhaps, my days of telling friends and family that there are no viruses for Macs may be coming to an end. There have been stories."

Comments

All machines are vulnerable to this

[dtolton]

I'm not sure how this qualifies as a vulnerability. If you read the
actual discussion linked, it's very clear that this is a root kit
installed after someone already has root access on your machine.

How did it suddenly become a vulnerability that if you have root
access to someones machine, you can write a script that will
automatically install a bunch of malware? If this were a self
propagating system, or if it were packaged up as a program that users
might install by accident I could see the point. As it stands now,
it's a script that you have to run *after* you have root access.

Common sense should apply here. On *any* system, if you run untrusted
code with root level access, it could do *bad* things to your system.

Re: All machines are vulnerable to this

[Black Parrot]

> I'm not sure how this qualifies as a vulnerability. If you read the actual discussion linked, it's very clear that this is a root kit installed after someone already has root access on your machine. How did it suddenly become a vulnerability that if you have root access to someones machine, you can write a script that will automatically install a bunch of malware?

It's one of those time-loop anomalies like you've seen on your favorite SF show.

Re:All machines are vulnerable to this

[CAIMLAS]

All that you say is true.

However, how long until until someone combines this payload with the propigation engine of a win32 worm and an OS X security exploit or 3? That's how these things start. One part at a time.

Re:All machines are vulnerable to this

[Anonymous Coward]

Yes, to make it more clear:

The linked article ONLY talks about the things this program does to a person's computer, once it is on it, and does NOT discuss how it gets onto a computer in the first place--other than by manually installing it.

It might be malicious, but unless it is possible/easy for folks to accidentally install it (like all of the Windows spyware/malware), it is not a threat, any more than is THIS piece of Linux and MacOS Malware:

#!/bin/sh
rm -Rf /

Re:All machines are vulnerable to this

[Anonymous Coward]

Let's us know when that happens. Until then you might want to change the strain you're smoking.

Re:All machines are vulnerable to this

[NSash]

You fucking idiot. If they can get root access on your machine, you're fucked anyway -- this stupid script is irrelevant.

Re:All machines are vulnerable to this

[asjk]

What about this assertion from the MacIntouch page?

John C. Welch

...Using /Library/StartupItems/ for it shows some thought about Mac OS X. One of the problems with that directory is that, while items in it run as root prior to login, you don't have to be root to create startup items in that directory, nor do they have to be owned by root to run. Any admin user can use this directory to create startup items that will run as root. That's a weakness that hopefully will get fixed. ...

Could a Trojan be written to trick the user into installing a StartUp Item?

Re:All machines are vulnerable to this

[WiseWeasel]

Yes, a trojan could be written to do that. It would prompt you for an admin password, even if you launched the trojan executable as an admin user, but it could definitely be done, and if done correctly, a lot of users might be duped by it. Basically, if you run executables from untrusted sources, you could get bitten by this. This is true of any operating system. Trojans are always going to be a problem. Careful users probably won't be affected by it, but others might be. This is a far cry from a worm or virus, in that there is no vector that will allow this to propagate to any significant level. That being said, it's always crucial to keep updated with the latest security patches just to be safe. For now, this is not even a concern, but it could make script kiddies' lives a little easier, especially with this added publicity.

Re:All machines are vulnerable to this

[marcello_dl]

On a relatively up to date 10.2.8 running in a Mac on linux window as we speak, my user account cannot
write into [Volume Name]:System:Library:StartupItems nor into its subdirectories (haven't tried them all but a quick chown or chmod can be a solution in that case). That folder is owned by 'system' and group 'wheel'.

So a script that needs to be installed as root is definitely not comparable to the plethora of vulnerabilities win users are exposed to. If that were the case osx and linux should have approx 5 percent of the total viruses, according to their market share. That simply doesnt happen so I consider this /. article FUD until somebody discovers what can remotely install such script. Keep your "boxen" updated, though.

Re:All machines are vulnerable to this

[zbaron]

On a current 10.3.5, i've just confirmed that /Library/StartupItems is rwxrwxr-x for root:admin. This means that any user that can "administer this comuter" can write in here without sudo or providing an administrator password. I'm running a permission verify to see what it says about this situation. Personally, I see no reason why this directory should be group writable.

Re:All machines are vulnerable to this

[Anonymous Coward]

"Worse even than Microsoft Word macro viruses" said michael

As a long time Mac user you do seem to be suffering under a misapprehension. In no way shape or form is this equivalent to the Microsoft macro viruss. In order to run a Windows virus you have to a) browse a web page or b) open an e-mail msg.

To run this 'malware' you have to a) download the script b) Change its mode to executable c) login as root and d) finally type something like ./run.malware at a console screen. By which time even you should have noticed something amiss.

Re:All machines are vulnerable to this

[AndroidCat]

Someone even installed a keystroke logger on a Sun box.

I think the biggest security hole is this common sense that you speak of.

Re:All machines are vulnerable to this

[yuggoth]

To run this 'malware' you have to a) download the script b) Change its mode to executable c) login as root and d) finally type something like ./run.malware at a console screen. By which time even you should have noticed something amiss.

In fact, you have to do none of the above - you just have to have admin rights (which most not-so-unix-savvy Mac users probably do because the don't bother to add another account beside the one created during system setup, which *does* have admin rights) and run some program from a not-really-to-be-trusted source (e.g. some "nifty freeware tool") which contains the script and installs it without further user interaction. Users with admin rights do *not* need to login as root or to authenticate to install files in /Library/StartupItems. At the next boot, the script will be executed by root and your system is compromised without further notice.

Re:All machines are vulnerable to this

[Anonymous Coward]

Coup detat?

Re:All machines are vulnerable to this

[Alex Brasetvik]

Hm. On my 10.3.5, I have these settings, which are perfectly sane:


$ id
uid=501(alex) gid=501(alex) groups=501(alex), 79(appserverusr), 80(admin), 81(appserveradm)

$ ls -ld /Library/StartupItems/
drwxr-xr-x 3 root wheel 102 4 Aug 11:12 /Library/StartupItems/


I can't remember changing the modes and ownership my self.

Re:All machines are vulnerable to this

[p4ul13]

it is not a threat, any more than is THIS piece of Linux and MacOS Malware:

#!/bin/sh
rm -Rf /

Oh no!! That anonymous coward is spreading the OS X virus on the internet! I must be infected too now. Please, for your own good, close this browser window immediately!!!

Re:All machines are vulnerable to this

[dioscaido]

You are right. And I hope I'm not the only one here to have pointed out that 99% (if not all) of the current viruses/malware/spyware in Windows are due to this same issue. Windows users have been trained to run as root (Administrator) at all times -- so if I write a batch file that starts at C:\ and deletes recursively -- bingo! I have a working malware. We're starting to see a bigger push to move away from this from MS and from the outside, lets hope it gets widely adopted.

Yes, there have been a handful of legitimate exploit viruses. Thankfully if you keep Auto-Update on, these will automatically be patched within days of discovery of the exploit (or even the same day). And no one is immune to this.

Some months ago OSX had a privilidge elevation exploit in their OS, which they patched quickly, thankfully. Funny thing is, if you read the patch description, it says 'improving the user interface'.

Re:All machines are vulnerable to this

[JeffTL]

Well, pointing out that a superuser can run a script to install malware -- and might be tricked into doing so, theoretically (a trojan horse) -- doesn't produce enough FUD. I wouldn't be overly surprised if whoever put out this alert is taking money from Microsoft.

Re:All machines are vulnerable to this

[emerrill]

Incorrect. You do need to authenticate. As an admin you are given slightly brouder privileges, but you are not in wheel. You need to sudo (or the GUI equv) to write to anything in /System/Lib

Re:All machines are vulnerable to this

[Ingenium13]

Actually, the default account created by system setup (at least on my Mac running 10.3.5) is a regular user account for the most part. I can access admin sections of the system, but I am prompted for my password first to confirm that I want to do this. This is really no different than having a seperate user for admin rights, and I feel it's a very good solution.

Re:All machines are vulnerable to this

[jyoull]

You may have changed it...

I just ran Repair Permissions, and have:

drwxrwxr-x 6 root admin 204 30 Sep 11:38 /Library/StartupItems/

However I've made my everyday account no longer "allowed to administer this computer" which it probably shouldn't have been, anyway... though the change doesn't yield much benefit with regard to the posted or similar risks of trojans.

Re:All machines are vulnerable to this

[tfrayner]

Users with admin rights do *not* need to login as root or to authenticate to install files in /Library/StartupItems. At the next boot, the script will be executed by root and your system is compromised without further notice.

Sorry, I can't just let this one go. As a nearby poster points out, the /Library/StartupItems directory is owned by root, and is not writable by the admin group. You would actually have to sudo or authenticate to create items in that directory (I have just confirmed this for myself).

This is on a machine running 10.3.5; I can't speak for earlier versions.

Re:All machines are vulnerable to this

[Anonymous Coward]

Even if you are on an admin account, the operating system will always force you to authenticate before installing something outside your user folder.

If you run a random program that tries to install something into /Library/StartupItems, it will have to throw up a dialog box asking for your username and password. This would look fishy (to me anyway. Stupid people purposefully installing shit onto their computers without knowing what it is or having a malicious program piggyback on the install of a "trusted" one is something nobody can do anything about).

Re:All machines are vulnerable to this

[cloudmaster]

Actually, that'd blow away your homedir and anything else with your group / world write permissions. No root required, and it'd be a major nuiscance. Not that I know offhand an easy way to trick a user into running a shell script... :)

Re:All machines are vulnerable to this

[gordonb]

In the current generation of OSX, any user (or program) can place programs or scripts in the StartupItems folder. These then execute as 'root' or actually as no owner. You do need access, but not necessarily root access (which is disabled by default anyway).

Re:All machines are vulnerable to this

[Anonymous Coward]

No, you're simply wrong. Unlike Linux, by default on MacOS X, there is no root account active. Read that again - there is no root account active. You have to specifically enable it after you've installed the OS. The user created during install does have admin priviledges, but that doesn't mean that he or she has root priviledges. In fact, this has saved OS X from several vulnerabilities that afflicted Linux and other Unixes in the past.

Re:All machines are vulnerable to this

[Anonymous Coward]

Wrong.

Stop posting crap.

Re:All machines are vulnerable to this

[Anonymous Coward]

Actually, by default root login is disabled completely. The default account is in the groups appserver admin and appserveradmin.

StartupItems permissions: drwxr-xr-x
Owner: root
Group: wheel.

So no, it is not writable by the default account or any other non root account weather they are admin accounts or not. The ONLY way to write to this directory is either login as root (which means that you have to enable root login first) or use sudo or some variation thereof.

Re:All machines are vulnerable to this

[pyrrhonist]

Not that I know offhand an easy way to trick a user into running a shell script... :)

I just noticed that you have "." in your $PATH.

MUH, HA, HA, HA!

Re:All machines are vulnerable to this

[someonehasmyname]

My 10.3.5 system has it set to 755 for root:admin

Re:All machines are vulnerable to this

[scruffyMark]

As an admin user though, you should be able to write to /Library/StartupItems. The script will then be run as root on next reboot, and move itself from /Library/StartupItems to /System/Library/StartupItems

Re:All machines are vulnerable to this

[ravenspear]

Sorry, I can't just let this one go. As a nearby poster points out, the /Library/StartupItems directory is owned by root, and is not writable by the admin group. You would actually have to sudo or authenticate to create items in that directory (I have just confirmed this for myself). This is on a machine running 10.3.5; I can't speak for earlier versions.

You must have a custom setup. The default setting is to not require authentication. When you first install OS X, /Library/Startup Items/ is owned by system/admin not root/wheel. All admins have read and write privileges. I am using 10.3.5 as well and this is how it is for me.

Re:All machines are vulnerable to this

[Megane]

I probably did this myself, but on my powerbook it's drwxrwxr-x owner:me group:staff. On my three other OS X machines, it's drwxr-xr-x root:admin, so go figure.

I think I'll just change it on my powerbook to drwxr-xr-x root:admin and avoid the possiblity of getting trojaned someday...

Looking further, I see that the only subdirectory in there is "Cisco", from when I installed the Aironet drivers, and it's also 775 me:staff. I wonder if the Aironet installer created /Library/StartupItems with bad permissions? I sure hope not, but I'm going to investigate this.

Re:All machines are vulnerable to this

[Megane]

Oh crap, it's true. When there is no existing /Library/StartupItems, the Aironet installer is creating one with 775 me:staff permissions. And even when there is, I bet it creates /Library/StartupItems/Cisco with the same permissions. Which means that any admin user (or me without doing a sudo) can change the scripts inside. Scripts that get run as root during startup.

Anyone out there who has installed Aironet wireless drivers, you might want to do something about your permissions in /Library/StartupItems.

Re:All machines are vulnerable to this

[Anonymous Coward]

Nope by default it is owned by root/wheel. I just reinstalled Mac OS X 10.3.5 a few days ago and /Library/StartupItems is owned by root/wheel. If I try and place a file in that directory via Finder with an "admin" account I am prompted to authenticate. I would strongly suggest you fix privileges on your machine.

Re:All machines are vulnerable to this

[coolgeek]

This is what I get on my week-old 2.5 dualie:

puter:~ user$ ls -l /Library | grep Start
drwxr-xr-x 3 root admin 102 15 Oct 23:58 StartupItems

You need to be root to write in /Library/StartupItems.

On my iMac FP though, it is:

puter:~ user$ ls -l /Library | grep Start
drwxrwxr-x 3 root admin 102 15 Oct 23:58 StartupItems

I tried to repair disk permissions on the iMac and it remained writable by admin.

Both machines were installed from the machine-specific install discs that shipped in the box. Perhaps Apple is aware of this and has begun to correct it.

Re:All machines are vulnerable to this

[kalidasa]

On my machine, /Library/StatupItems is owned by system, and admin group has Read & Write permissions. 10.3.5

Re:All machines are vulnerable to this

[Billly Gates]

Does the admin priviledge include install a bash script in the startup folder?

If so then I would say its flaw and most mac users again are unaware of the differences between different types of accounts.

Re:All machines are vulnerable to this

[sinistral]

No, you must be lying. There's no user named "system", and the directory is /System/Library/StartupItems, perms 755 root:wheel.

Re:All machines are vulnerable to this

[mrtrumbe]

Why do you assume HE has a custom setup? Could it not be that YOU have a custom setup? From the posts on this thread, it seems that the majority have permissions of drwxr-xr-x and are owned by root:wheel. That is, in fact, exactly what my system has, and I haven't manually altered the foler myself. It is possible that some installers would create the directory with improper permissions, but running fix permissions in disk utility should fix that. I run fix permissions frequently, as many thirdy party (and Apple! Yikes!) installers seem to be sloppy.

To be absolutely clear, I am talking about Mac OS X version 10.3.5. Older versions seem to be more permissive about this folder by default.

Taft

Re:All machines are vulnerable to this

[wirelessbuzzers]

Does the admin priviledge include install a bash script in the startup folder?

No. You could install one in your own startup items folder, but then it would be executed by admin again, not by root. I wouldn't be surprised if root can take over the system, but I doubt it's that easy.

To the GP poster: there is actually a root account, but you can't login as root. You can, however, sudo -s, as demonstrated in the following example (I don't run as admin normally):

mike:/Users/mike$ su admin
Password:
admin:/Users/mike$ sudo -s
Password:
root:/Users/mike# whoami
root

Re:All machines are vulnerable to this

[ravenspear]

I just repaired permissions. It's still owned by system/admin.

Re:All machines are vulnerable to this

[Anonymous Coward]

Maybe you should calm down and listen to the man's post.

this payload

Read: the "useless" script.

with the propigation engine of a win32 worm

Read: IP-scanning algorithms from Win32 worms

and an OS X security exploit or 3?

Read: buffer overflows from OS X (which DO exist)

So, in summary: dumb script + IP scanner + OS X buffer overflows... Bad news. Yes, it IS possible that someone could put the three together in an automated, self-propogating worm.

Re:All machines are vulnerable to this

[alerante]

Reminds me of this Humorix story from a couple of days back:

http://humorix.org/articles/2004/10/plain-text/

Re:All machines are vulnerable to this

[drerwk]

Retrospect seems to do somthing similar. On 10.3.5 /Library/StartupItems is drwxrwxr-w root:admin. Seems likely Dantz did this as I only have startup items from them.

Re:All machines are vulnerable to this

[rsborg]

When there is no existing /Library/StartupItems, the Aironet installer is creating one with 775 me:staff permissions. And even when there is, I bet it creates /Library/StartupItems/Cisco with the same permissions.

Someone mod up parent!! This is clear example of where 3rd party driver/install software can break the "sane" security model of Unix. Windows has had this problem for a long time; it's only due to the relatively recent popularity of OSX that we'll the the issues with unix/linux.

Re:All machines are vulnerable to this

[drerwk]

This is even noted as a problem: SecurityFocus

Re:All machines are vulnerable to this

[Anonymous Coward]

On the contrary, I just confirmed that I *can* write to /Volume/Library/StartupItems, using an admin but NOT sudo or typing any root password.

I CANNOT write to /Volume/System/Library/StartupItems.

My test was simply opening TextEdit and trying to save the text file into each directory.

Re:All machines are vulnerable to this

[ioErr]

I'm on 10.3.5. Fix permissions does not fix bad permissions on /Library/StartupItems/ as one might expect it would. I just tried.

Re:All machines are vulnerable to this

[Megane]

The appropriate e-mails have been sent about this.

Re:All machines are vulnerable to this

[TClevenger]

Indeed. I have a fresh 10.3 install that was then updated by Software Update to 10.3.5. I have no /Library/StartupItems folder, and /System/Library/StartupItems is owned by root:wheel and has permissions rwxr-xr-x. System installed less than 2 weeks ago.

Re:All machines are vulnerable to this

[hunterx11]

The user created during install does have admin priviledges, but that doesn't mean that he or she has root priviledges.

Cortana:/etc root# cat sudoers | grep admin
%admin ALL=(ALL) ALL

Close enough.

Re:All machines are vulnerable to this

[Anonymous Coward]

Just asking them to do it would probably work in most cases.

Re:All machines are vulnerable to this

[arekusu]

/System/Library/StartupItems is owned by root and is not writable by admin. So you have to already have root access to install there. That's not really a security hole. /Library/StartupItems DOES NOT EXIST IN A DEFAULT OS X INSTALL.

It will be created if you install any 3rd party extensions that require startup services. For example on my machine, it was created by installing the Wacom tablet driver.

The permissions of /Library/StartupItems depend on who created the folder. In the case of the Wacom installer, it was created as drwxrwxr-x root/admin, so any admin user can write into it without authenticating. Since the default user is admin, this is a security hole.

Repairing permissions doesn't help, since that mechanism looks at the permissions in/Library/Receipts/*.pgk/.../*.bom to make the repairs, and will just restore whatever bad permissions the installer was using.

Re:All machines are vulnerable to this

[tfrayner]

Interesting - I'd not considered this angle. Sounds plausible, though. Worth a further look, especially if this directory is under Apple's radar when it comes to automatically repairing permissions.

For the record, I'm pretty sure that the earliest thing I installed which would have used the /Library/StartupItems directory* would have been the Fink daemonic package.

*As in, not the /System/Library/StartupItems, as suggested below. I'm not quite that easily confused.

Re:All machines are vulnerable to this

[Anonymous Coward]

Not Solaris 10. See here for details. - Bart

Re:All machines are vulnerable to this

[angulion]

You ofcourse forget one "little" difference - Macs and Linuxes usually have sane setups, that doesn't provide every new user created with a "root" account by default, like Windows does.. This is one big showstopper for these kinds of malwares..
Not only trick user to run it, but also to trick into doing it as superuser.

Re:All machines are vulnerable to this

[iluvcapra]

the Aironet installer is creating one with 775 me:staff permissions... This is clear example of where 3rd party driver/install software can break the "sane" security model of Unix.

It seems that this would be hard to fix, if you are shipping your machines with optional root accounts. If an installer needs to modify the /Library/StartupItems folder, and there is no root user on the machine, the installer would be stuck until the operator decided to create one.

The problem is, Apple doesn't want the average user to HAVE to create one. And I agree with them. Troublesome, though.

Re:All machines are vulnerable to this

[Anonymous Coward]

Unlike Linux, by default on MacOS X, there is no root account active. Read that again - there is no root account active. You have to specifically enable it after you've installed the OS. The user created during install does have admin priviledges, but that doesn't mean that he or she has root priviledges.

sudo su
sudo bash
etc.

Cheers

Re:All machines are vulnerable to this

[Jucius Maximus]

" On a relatively up to date 10.2.8 running in a Mac on linux window as we speak, my user account cannot write into [Volume Name]: System:Library:StartupItems nor into its subdirectories"

Agreed. My fully patched 10.2.8 machine's admin account cannot write to this directory.

Re:All machines are vulnerable to this

[iamacat]

Any admin user can use sudo with their own password to gain root access. The reason they don't just use uid 0 is protection from accidents, not to prevent anything they would do on purpose.

Given that people don't tend to be 100% careful with filesystem permissions, even non-admin user is not safe to run suspicious code under MacOSX, or Windows or Linux. Some kind of VM technology that limits damage to a single disk image file is a start.

Re: All machines are vulnerable to this

[Inuchance]

You mean a plot hole?

Re:All machines are vulnerable to this

[Anonymous Coward]

buffer overflow != root access

Re:All machines are vulnerable to this

[rixstep]

All the more reason to make people understand that they're not to use 3rd party software that demands your administrator passphrase to install.

Re:All machines are vulnerable to this

[Anonymous Coward]

Uhhhh huh? I have personally seen Buffer Overflow = root access on OS X (and remotely even.)

Re:All machines are vulnerable to this

[PierceLabs]

Unless you want us to all simply right you off as an anoymous troll, then perhaps you'd care to explain the methodology.

Re:All machines are vulnerable to this

[Anonymous Coward]

Mac Users == Faggots.

'Nuff said.

I am not too concerned

[mj_1903]

As this Bash script (that's all it is) needs root access or physical access to the machine to propagate, I am not too concerned. Root is disabled by default on all shipping Mac's and if anyone has physical access to your machine then you are in serious trouble anyway.

Saying this though, keeping your Mac patched is probably the best idea. Some vulnerabilities in Mac OS X can give you root privs, but having the firewall on and only services that you need enabled (none are enabled by default) will protect you from those issues.

Re:I am not too concerned

[j-pimp]

Root is disabled by default on all shipping Mac's and if anyone has physical access to your machine then you are in serious trouble anyway. Right, but the initial setup of every shipping mac out there has the user create an administrative account on there machine. This person can run sudo to execute a root command. The password prompt you get before installing most mac software runs sudo. So an install program effectively runs as root and if the install program silently added this script to your system then it would run.

Re:I am not too concerned

[mj_1903]

Of course, but if I download and install any software that contains malicious code then I am in trouble. Similar to that incidence of a developer deleting ~/ on users machines that used a pirated serial number.

Re:I am not too concerned

[Anonymous Coward]

i'm just very glad that nobody thought of something like this
while one of the few "real" holes known was still unpatched.
http://www.google.com/search?q=help+viewer+hole+ap ple

Re:I am not too concerned

[Billly Gates]

Are you sure root is not enabled by default?

I have seen contrary posts which state after an installation, the default user account has root priveldges.

If you have the ability to install software by default on your macosx machine, then it has some root priveldges.

Re:I am not too concerned

[mindstrm]

The default user account is a regular user account with sudo configured. Operations requiring root priveleges will obtain them via a sudo mechanism, requiring you to enter your password first.

To say "Root is disabled" isn't really accurate, though... root login is disabled. The root user still exists, and you can obtain a root shell by "sudo sh" (after giving your password, of course).

Re:I am not too concerned

[Anonymous Coward]

Root is disabled by default on all shipping Mac's and if anyone has physical access to your machine then you are in serious trouble anyway.

Wrong! Root is not "disabled" by default. All of root's power is present whether you go into NetInfo manager and "enable" root or not. The only "disabling" of root by default is that you cannot log on as root because the account is locked from interactive logon.

Re:I am not too concerned

[BlowChunx]

Just as a side note, this same model (no root login, all access is through sudo by default) is being used by Ubuntu (desktop oriented Linux distro based on Debian).

There have been increased brute force attacks on ssh from the "outside world" at my place of business. Having no login for 'root' is good under those circumstances. Now the k|ddi35 need to guess an account as well...

Re:I am not too concerned

[tjohns]

Actually, installing most Mac software does not need an admin password to be installed, since /Applications is writable by the admin group. You do need to be logged in using a user with admin privileges, but you won't need to type your password. Only if your program is either modifying system files or has a poorly written installer will it ask for an admin password so that it can execute sudo and gain root access. For this reason, anytime somebody gets a window asking for an admin password while installing something they should probably be a bit suspicious.

That being said, /Library/StartupItems is not writable by the admin group, so as long as somebody doesn't already have the password for root or an admin user (at which point you're already in trouble), I can't see this magically appearing on your system. Still, you're right, it would be trivial to build an installer bundle that would prompt for an admin password, and most users would probably put it in without a second thought.

Re:I am not too concerned

[cbiffle]

I know this is not the best place to say this, but:

Hey! Mac developers! Quit requiring privileged steps during install!

Seriously. The Mac app architecture is designed so you can put all your files into a single bundle without littering crap all over the user's system folders.

I, for one, tend to kill any install that asks for my admin password (which is why I'm still using Preview instead of Adobe Acrobat).

If people get used to entering their admin password on every damn install, trojans like this will be all too easy. It's like software requiring a root install on Unix -- it's suspicious.

Re:I am not too concerned

[Erik Hollensbe]

And the reality, is that only the largest apps do that.

Really, I have over 200 apps on this machine and I can count on one hand (from memory) which ones used installers.

Emacs, XCode, Cisco VPNClient. Sorry, 3.

Everything else is standard mac fare, open DMG, drag n' drop and get to something more interesting.

That said, some of the programs ask for root after they're installed, which I think is a larger problem. A couple of "tweak" utilities that I use to do things which apple buries or makes hard to use do this. I even found one doing this:

echo "rootpassword" | sudo program

So, I think it would be easy to argue that malware is not my biggest problem as a mac user.

Re:I am not too concerned

[Anonymous Coward]

Excellent point! I remember this being brought up at an Apple WWDC session. Whenever possible, developers should use the drag-and-drop installation method.

Re:I am not too concerned

[Anonymous Coward]

> That being said, /Library/StartupItems is not writable by the admin group, ...

You need to read the previous thread about the stooopid Cisco Aeronet installer that left a directory permissioned root:admin in /Library/StartupItems. Once that's done, any future software you install, as an admin user, can write to this folder, adding a script that will be run as root at the next system startup.

Think KaZaa + spyware, and be very afraid.

Re:I am not too concerned

[CoolMoDee]

Even if it didn't ask for a password, I would still be using Preview over Acrobat. My main beef with Acrobat is that it takes forever to start and is much slower overall than Preview.

Re:I am not too concerned

[Colol]

I even found one doing this:

echo "rootpassword" | sudo program

Ugh. I'll admit Apple's authentication frameworks aren't the easiest thing to use the first time you hack something together. For crying out loud, though, it's fairly well-documented and they have in-depth sample code on how to use them, including running command-line programs with elevated privileges. If you can't figure it out yourself after that, use the mailing lists or pay for a developer support issue.

That any developer is passing passwords in that manner is completely reprehensible. It's a shame public flogging has gone out of style.

Re:I am not too concerned

[arminw]

...tend to kill any install that asks for my admin password...

It is probably safe to give the password only IF you are the one that initiated the install process. If you are surfing the web and suddenly the password dialog comes up it is best to cancel that immediately. The Internet has some bad neighborhoods, and it is best to avoid going there in the first place and certainly not download unknown stuff from unknown sources.

Re:I am not too concerned

[gnu-sucks]

Root is disabled by default on all shipping Mac's

This isn't exactly true. Root login is disabled, but the root account is very real. Every startup item, and every bsd script in /etc is run as root on startup (not every script in /etc is run on startup, understand, but the ones that are are run as root).

I still agree with your point though - this is anything but a worm or virus. Its just an evil shell script.

And it doesn't even open a backdoor! How lame! :p

Anti-Virus

[Kesh]

You mean my copy of Virex I get with .Mac will actually be useful now? ;)

Re:Anti-Virus

[Anonymous Coward]

I, for one, welcome our virus writing overlords, and our snakeoil selling liberators.

Re:Anti-Virus

[Anonymous Coward]

Shut up

Re:Anti-Virus

[Anonymous Coward]

No. You'd need an actual Virus for that. ;-)

FUD...

[nordicfrost]

This is lame. A script! -this is Slashdot, you should know tthe possibilities of bash scripting. Besides, it doesn't even spread itself, don't hide its tracks...

Re: FUD...

[Black Parrot]

> this is Slashdot, you should know tthe possibilities of bash scripting.

And of script bashing as well.

Re: FUD...

[Rosco P. Coltrane]

You Sir just costed me a clean shirt :-)

Re: FUD...

[metlin]

And the fact that you have been modded insightful and not funny, has subtle irony written all over :-).

Re:FUD...

[driver_red]

As he says, "...a check of my /var/log files showed that they were _all_ empty and had the same mod date.", a subtle as a sledgehammer method of hiding it's tracks, although it does attempt to.

Re: FUD...

[Anonymous Coward]

How nice of you to correct him with two incomplete sentences. Every spelling nazi eventually meets a grammar nazi :)

Re:FUD...

[gad_zuki!]

>this is Slashdot, you should know tthe possibilities of bash scripting.

Really? I find a lot of the most vocal linux advocates to be using KDE or Gnome for everything and webmin for everything else. They scoff at my simple command line based cygwin setup because "its not linux."

Linux users are definitely geeky, but no offense they arent all command line hackers or even half-assed system admins. OSX users are even below this. I often port scan my subnet and find default services running with default settings on various distros. Its not just mandrake users either.

Thats the thing with popularity, there is a chance the fetished item will be co-opted by those much less interested than the original people and unlike the original "fans" they tend to be loud, obnoxious, insulting, etc. Its kinda like when the mainstream radio crowd "discovers" some indie band. Fanaticism runs deep and no one wants to talk about what equipment they are using this tour, the quality of songwriting, etc just "turn that shit up."

Re:FUD...

[Anonymous Coward]

Best... sig... EVER!

You're the man.

Re:FUD...

[Anonymous Coward]

Really? I find a lot of the most vocal linux advocates to be using KDE or Gnome for everything and webmin for everything else.

My heart sinks when I see any of their kind. They are not true power users on Linux, and they would not be really empowered on Windows, either. But they may feel empowered, for sure.

As long as they are only managing their own precious pee-cees, I don't really mind. But they would be too inept to trouble-shoot and fix a fucked up Linux box in a production environment. (e.g. a big, poorly maintained network)

They scoff at my simple command line based cygwin setup because "its not linux."

Jerks! If they don't care about the shell, what are the chances they really care about the kernel? Pretty small! If Mandrake ran on top of Darwin or Hurd, would they notice?

If you never use the shell, you are not a Linux or UNIX user, you are a distro user. There is no complete interface that will work across all distros, except the shell. If you don't know the shell, you'll have to re-learn a lot of stuff when you switch distro. (you will have to re-learn som stuff, like the package management, no matter what)

Re:As Nelson would say.

[Anonymous Coward]

You might want to read some comments before laughing. The write-up for this (non-)story is misleading. Your laughing applies right back to you.

Normal rootkit

[Spider[DAC]]

*chuckle*

So, this is a progression of the age-old idea of a rootkit. A program installed with administrator (root,superuser,avatar) rights to remotley control the machine.

Admitted, this one looks a bit more aggressive than some (running jack the ripper on the md5 passwords is blatant and obvious) but this is hardly any news for anyone.

What strikes me as confusing is that Mac users aren't used to this already? It's been standard issue with all Unix, Windows and some BeOS applications, that people would post "faked" binaries of some popular software that would instead own the system completely. Or for that matter, latch them on to an existing download, the same way spyware does in windows.

Overall, this isn't self-replicating, its blatantly obvious and appears quite easy to recover from. Don't fret.

Re:Normal rootkit

[erick99]

You are rather shrill, nervous?

Not to worry then

[Armchair Dissident]

Normally, when ever I'd see virus alerts, I'd revel in the fact that as a Mac user, I was immune

Not to worry then, you're still immune. It's not a virus. It's not much of a vulnerability either; and no-one has ever suggested that OS/X - or any operating system for that matter - is immune to trojan horses. And this is what this is (if it's true) - a good old fashioned trojan horse.

Re:Not to worry then

[wrldwzrd89]

I agree with everyone else. This is nothing more than a Trojan Horse - and in order to do anything meaningful it needs lots of privileges, like becoming root. There's nothing seriously worrying in this (Mac OS X is STILL without a virus), because, as mentioned in the article, all the stuff it does can be reversed easily (even more easily if you clone your HD daily like I do).

Re:Not to worry then

[nordicfrost]

Well, technically it's not a trojan horse either. A trojan (horse) always hides itself in vessel, usually some stupid program or excecutable app... This is just a rootkit without andy means of becoming root, so the issue is moot...

Re:Not to worry then

[Anonymous Coward]

The issue is moot,
it can't get root.

Re:Not to worry then

[Anonymous Coward]

Thank you very much, Johnny Cochrane.

Worst. virus. ever

[Anonymous Coward]

So am I missing something, or is this really just a regular bash script that does bad things if given enough priviliges? Not surprising, I guess, since the submitter spelled "spam" using all caps...

Re:Worst. virus. ever

[Anonymous Coward]

> Not surprising, I guess, since the submitter spelled "spam" using all caps...

... and lists "proficiency in Notepad" on his résumé :-).

Re:Worst. virus. ever

[Anonymous Coward]

...Applications & Proficiencies...

XMLSpy Enterprise, BBEdit, TextPad, Photoshop, Acrobat, The GIMP, Studio MX 2004 (Dreamweaver, Fireworks, Flash & Freehand), Homesite (v1.0 beta tester!), Notepad, MS Office XP Expert, Word, Excel, PowerPoint, Mozilla/Thunderbird, InDesign, PageMaker, Quark, OpenOffice.org, Visio, Outlook/Exchange Server, vi, Shell/Batch Scripting, Search Engine Submission/Placement & Removal

Wow.

Let me add to my skills!

Switching on the computer, inserting a CD-ROM, English (written AND spoken), bathing, brushing my teeth....

Man, sheesh. Worst part is that HR people look for keywords such as this, and this guy would probably land a better job than someone who does not bother mentioning these things.

Re:Worst. virus. ever

[Anonymous Coward]

For those that are interested, here is his Slashdot account.

Username - the_webmaestro

Flame away :-)

Re:Worst. virus. ever

[Anonymous Coward]

Worst. virus. ever

Aren't the "bad" viruses the ones that do the most damage? That would make this the "best" virus ever, wouldn't it?

Re:Worst. virus. ever

[Anonymous Coward]

Don't forgot Palm & Pocket PC... under "skills and tools", I wonder why he didn't list TV remote, cup, fork, knife and spoon as well.

Re:Worst. virus. ever

[ImTwoSlick]

and lists "proficiency in Notepad" on his résumé

Shoot.... I guess I should take "proficiency with pencil and paper" off of mine.

Re:Worst. virus. ever

[Peter Cooper]

Actually, that's a pretty rare skill in the workplace these days, Gramps!

Re:Worst. virus. ever

[Anonymous Coward]

Oh yeah...and you forgot to mention he has a major mullet!

Re:Worst. virus. ever

[Anonymous Coward]

huh, he lists shell/bash scripting... who wants to bet hes the jerk that wrote this "virus" thing to begin with.

Burn them!

[Anonymous Coward]

Burn the programmers who created the OS! Burn the greedy corporation who cut corners to release this junk! Burn the ignorant and clueless users who allow such things to take place! Kill 'em all! Raze their corporate HQ to the ground! No punishment is too harsh, no criticism unwarranted. Finally, definitive proof of the systematically shoddy approach taken by this company to their OS!

Oh wait... you said Apple, not Microsoft. Well in that case, let me just say that the user interface for this exploit is FAR more intuitive than it is for Windoze. And it's also a lot more flexible, thanks to Darwin. In fact, it wouldn't even be possible under Windoze, surely demonstrating once again how much better OS-X is. And anyway, it's not really a virus... more of a feature, really. A mal-feature.

Re:Burn them!

[Anonymous Coward]

Actually, it is a feature, not an exploit, and not a mal-feature either. An administrator of the computer can do whatever they want. That's all, no security vulnerability or anything. Yes, that's right-Apple is so damn good, even their negative press is about things working the way they're supposed to!

Re:Burn them!

[pbjones]

score +2, can't help but smile,

Mac owners are like Volvo drivers...

[Anonymous Coward]

Because they think they're perfectly safe, that must mean that they're perfectly safe and can therefore do whatever the hell they want to without thinking, or learning from the experience.

I have learned this from two years of cycling to work, and taking tech support calls from Mac owners while there.

Pride comes before a fall - just because your computer has training wheels doesn't mean you can do whatever you want to without some kind of consequence... Most of us learned this as children.

Re:Mac owners are like Volvo drivers...

[jd]

You do realise, I hope, that Volvo cars are made from surplus tank chassis, refined by the very best alien technology from Area 51!

Given the desire for American and European militaries to become much more mobile and urban-friendly, it would have made so much more sense to switch to a Volvo hatchback. The milage might not have been as good as they've been used to, though.

Re:Mac owners are like Volvo drivers...

[Anonymous Coward]

Oh, well, at least after two years of cycling to work he's out of the gene pool and won't be passing on his mac / volvo / idiot conspiracy theories: bike seat-induced impotence not really an urban legend after all

Re:Mac owners are like Volvo drivers...

[Anonymous Coward]

BSD is now training wheels?

Wow.

Re:Mac owners are like Volvo drivers...

[mslinux]

Right on... Mac users are promiscuous. They share files, click any url that comes their way, install shareware, etc. Kinda like gays when AIDS showed up... their behavior will have to change or they're gonna have sick Macs... Unix isn't all good, there's some bad there too.

Re:Mac owners are like Volvo drivers...

[Anonymous Coward]

What?

What?

Whoa!

This is some crazy shit

"share files" just like the gays!

Re:Mac owners are like Volvo drivers...

[Anonymous Coward]

If you get right down to it, Mac owners are fags.

"Imagine whirled peas" indeed. Volvo/Mac faggots.

Nice script

[Zorilla]

I don't think it's as much of a real vulnerability as it is Macintouch.com being mesmerized by looking at the code in the "new" exploit.

#!/bin/bash
:(){ :|:& };:

Oooooooh, trippy code!

Re:Nice script

[beelsebob]

I can't claim to know bash scripting (I'm ashamed to say I'm a slashdotter and have never looked at it)... Is this a forkbomb? defining a lambda expression ':' that runs ':' twice, and then running it once. If so, surely the process limits are going to kill it after a short while? Bob

Re:Nice script

[Zorilla]

You know more than I do, apparently. The only bash scripting I've done is to force programs into a specific working directory. I can barely look at that code myself, I just found it under a Google search. My best guess is that it creates a function fork that is very obfuscated to the reader. There were some pretty neat obtuse examples during that "Obfuscated voting machine code contest" as well.

Re:Nice script

[Zocalo]

Yeah, it's a fork bomb with tiny amount of obfuscation, if you can call using a non-alpha character as a function name obfuscation. Things become clearer if you format it properly, and replace the user defined function name ":" with "foo", like this:

#!/bin/bash
foo()
{
foo | foo &
};

foo

So, we define a function, "foo", which runs "foo" piped into itself as a background task, then call "foo", and off we go. Essentially you are trying to execute the infinitely long command line of:

foo | foo | foo | foo | foo...

Re:Nice script

[Anonymous Coward]

Yup, it's a classic fork bomb. If you've set up your limits appropriately, it won't cause you any grief.

Re:Nice script

[Zocalo]

Damn! Forgot to cover the ampersand... Each successive call of the command *also* spawns a seperate instance of itself, behaving in the same manner. Exponential growth and recursion too!

Re:Nice script

[Anonymous Coward]

Can you please explain how to 'set up your limits correctly' in order to avoid this? Thanks!

Re:Nice script

[Anonymous Coward]

man limits

Re:Nice script

[rob_squared]

I pity the foo.

Re:Nice script

[alex_ware]

won't that **ahem** fork up your computer

Re:Nice script

[Foolhardy]

And on Windows (2000 or later) it would be

jobprc suspect.exe -prclimit 100

Or you could set your shell to start as jobprc explorer -prclimit 100.

"Administration" Password Problem...

[torpor]

Something thats always bothered me about OSX is how easy it is to write a program that prompts the user to enter their Admin password, and how many users just enter it when requested, for any old program.

I don't really know how Apple can address this.. perhaps some sort of 'certification' system for "programs which need admin access", but I've seen how that approach got dealt with by Microsoft and I don't really see it as a solution; just more problems. (App Certification is a crappy idea..)

Really, there's just no such thing as a piss-free sandbox. *sigh*

Re: "Administration" Password Problem...

[beelsebob]

OS X does this to a certain extent in that it tells you what application is running the security dialogue and what key it's requested, but unfortunately anyone can fake that interface in seconds. One thing to sure of is that when you type in your password it is into a normal OS X password box, anything else and the program gets to see the plain text of your password and could do anything. If it's the system's password box then the system does all the authentication and the program never gets a chance to steal the password.

Bob

Re: "Administration" Password Problem...

[physicsphairy]

Really, there's just no such thing as a piss-free sandbox.

Uhh... gee I hope when we were kids you never invited me over to build sand castles with you.

Re: "Administration" Password Problem...

[torpor]

So I just write an interface that clones the look and feel of the System Auth password box, and away we go ..

You can never trust computers.

Re: "Administration" Password Problem...

[TheRaven64]

It is very easy to pop up a dialog that looks like the standard system one asking for an admin password. A simple fix for this would be to require the user to press command-option-escape (or some other OS-caught interrupt key combination) before typing in the dialog. This would identify spoofed dialogs and allow a user to check that the program popping up the dialog is the correct one, and it's asking for sensible permissions. I suspect the reason that this is not done, is that there is no reason for trojan writers no to simply use the API calls to create the dialog, and then abuse root privilege.

The best fix for this problem is to apply common sense. Do not give your admin password to any application except an installer for software acquired from a trusted source, or the OS X system utilities.

Re: "Administration" Password Problem...

[torpor]

I never built castles in a sandbox, I'd build them on the beach, where its actually okay to piss on the sand because there's plenty .. and I mean plenty .. of fresh clean sand to move to..

Wish I could say this allegory had a parallel in the computing science realm, but it doesn't. So maybe I'll give up and go surfing for a while.

Re: "Administration" Password Problem...

[WiseWeasel]

That's the stupidest solution I've heard all day. Just how long do you think it would take malicious coders to spoof the required key combo as well? Anything Apple can do can be imitated by other coders. The solution is to NOT RUN UNTRUSTED EXECUTABLES!!!!!! I cannot stress that enough. If you launch an executable from an untrusted source, you can get hosed.

Re: "Administration" Password Problem...

[Spudley]

I never built castles in a sandbox, I'd build them on the beach, where its actually okay to piss on the sand because there's plenty .. and I mean plenty .. of fresh clean sand to move to..

Wish I could say this allegory had a parallel in the computing science realm, but it doesn't. So maybe I'll give up and go surfing for a while.

Oooh! You don't want to go surfing! Someone might have pissed in the sea.

Re: "Administration" Password Problem...

[raju1kabir]

That's the stupidest solution I've heard all day. Just how long do you think it would take malicious coders to spoof the required key combo as well?

That's the stupidest response I've read all day. The point is that the key combo has to be one that's intercepted below the application level, just like control-alt-delete on Windows. Nobody can "spoof" anything unless they've already got their evil code into the OS itself, at which point this is all moot.

Re: "Administration" Password Problem...

[WiseWeasel]

OK, I admit I fired off the response a bit early, without fully reading the parent. Apple will never make users launch the force quit dialog, due to the damage that can be done there (accidentally forcing a program with unsaved work to quit). It's really not even a consideration as a solution to this problem. Not entering your admin password for an untrusted executable is only common sense.

Re: "Administration" Password Problem...

[torpor]

Oooh! You don't want to go surfing! Someone might have pissed in the sea.

Yeah, but at least I'd be surfing.

Re: "Administration" Password Problem...

[SnowZero]

You can make it a lot worse that that. It is (somewhat) exploitable by a timing attack if your virus waits patiently for another program to start installing. There is probably some recognizable signature you can check for in ps, and just keep running it repeatedly. Once another program is installing, the virus can then jump in and do the operation that requires root, thus popping up a dialog box. The title will probably be wrong, but the timing of the dialog box will be *right*, so most users wouldn't notice except for a second box popping up later. They'll probably convince themselves that they mistyped the password the first time.

This is a common vulnerability to just about any shared medium, and why users need to be careful even just running untrusted programs as a user. The unix equivalent is well timed "password" prompts from malware when the user runs something else they expect to generate such a message, such as ssh.

Re: "Administration" Password Problem...

[IamTheRealMike]

You apparently need to research the idea of "trusted desktops". Ctrl-Alt-Delete in Windows is intercepted by the kernel and triggers a switch to a secure window station (basically, a separate desktop). Unless you can compromise the kernel you can't get a window onto this secure desktop.

Re: "Administration" Password Problem...

[jdreed1024]

Something thats always bothered me about OSX is how easy it is to write a program that prompts the user to enter their Admin password, and how many users just enter it when requested, for any old program.

Well, it's not like it's real hard for me to spoof a Windows dialog box asking for your administrator password (and I bet most users would give it, even though Windows has no concept of 'sudo'), or even telling you that your Internet Connection is too slow.

But it's not just OS X - any OS that has a GUI equivalent of sudo (which now includes FC2, RHEL, SuSE, among others) is easy enough to spoof with a dialog box. FC2 and RHEL just have some python libraries you import, and you're all set, and you get a userhelper dialog, just like the one displayed by the system utilities (system-config-packages, for example), and off you go.

The thing is, there is no good way around this. "Certification" is a problem, since getting your program certified (well, getting the CA) costs a *shitload* of money (yes, yes, CAcert, I saw them at USENIX too, except I wasn't real comfortable having my driver's license scanned by a bunch of people I'd never met), and that would rule out the smaller developers. Plus, it's not like the CA used to sign the programs can ever get stolen, or anything (*cough* Microsoft/VeriSign *cough*).

A key combination (like how XP claims pressing Ctrl-Alt-Del to log in makes your computer "more secure") is a pretty stupid idea, and anything will be able to intercept it before the OS does if it tries hard enough.

The best thing I can think of is that unless the software is produced by Apple (verified via some key), the dialog box to request the admin password says something that says "Admin privileges are being requsted by foo.pkg/bar.app located at /Users/joeuser/Desktop/downloadz. According to the metadata, this is required in order to install the following files or do the following operation. This software claims to be produced by FooCorp, at the URL www.foocorp.com". And then maybe that might make the user think harder about what they're doing. Sure, there's no reason why you wouldn't be able to fake it to look like Word or iDVD or something, but hopefully users might take a second or to and think "But, wait, I *have* iDVD, why am I installing a new version". And those that don't are going to get screwed anyway by giving all their money to the son of the former president of Nigeria, or by replying to "Citibank"'s request for their account number and PIN.

Really, I'm convinced education is the only way to fix this. What would be kind of cool would be like what the Justice Department did with online pyramid schemes - setting up fake web pages that lured people in and then told them that they could have been duped and lost millions if they clicked on the "Click here to sign up" link. Apple or someone could make a package that purports to be 10.4 preview release, yet has spelling errors and l33t-speak in the installer text, and then when you give it your admin password, it tells you why you're a moron and how not to do that in the future. But I suspect that wouldn't go over well - people don't like having stupidity pointed out to them.

Re: "Administration" Password Problem...

[Eradicator2k3]

Something thats always bothered me about OSX is how easy it is to write a program that prompts the user to enter their Admin password

Right...because this vulnerability exists only in OSX. Here is a sample of how malicious code could be ported over to other OSes:

10 REM This program will hax0r there b0x0rs kekeke
20 REM Ask for admin password
30 INPUT "What is you name: "; U$
40 PRINT "Hello "; U$
50 INPUT "Would you like free pr0n: ";P$
60 IF P$="N" then END
70 IF P$="Y" then PRINT "Please enter admin password"; A$ else GOTO 50
80 HACK INTERNET; A$

Re: "Administration" Password Problem...

[n8_f]

It is very easy to pop up a dialog that looks like the standard system one asking for an admin password.

This is complete crap. First, you still have to get an Administrator user to run your malware. Second, you can't spoof the Authenticate panel because any other panel has to be associated with an application. When the user clicks on it, the first menu is going to be "Malware" (this would be even better if Authentication dialogs were associated with an "Authentication" application, but it will still be clear it is your app requesting authorization). Assuming the Admin user continues to type in their password, the game is already over. The system's administrator has chosen to run untrusted code and authorize it, and no computer can protect itself against that without severely limiting its usefulness. Third, so what? Now you have the password, but you would have been better off actually getting authorized, because the program can't do anything with the password on its own (it has to be entered by a user for any actual authorization). Sure, it could disseminate it and then run a server on an unprivileged port, but you'd be better of running a shell as root on a port like this exploit does (it saves you the step of typing in a password).

So, what is the point? It can't fake the application it is associated with, because unlike a system dialog, it is attached to it. The only thing it could do is misrepresent the privilege it was requesting ("Requested right: system.daisies.pick"), but whoopty-doo.

Re: "Administration" Password Problem...

[Metzli]

The thing is that this isn't just an OS X issue. I don't know how many people I've seen use KDE/GNOME/whatever and cheerfully enter their root password whenever asked. Users not paying attention to what's actually happening is a problem on any OS.

Re: "Administration" Password Problem...

[Lars T.]

So how exactly would the "virus" wait for another program to start installing, if it can't run because it isn't installed yet?

Re: "Administration" Password Problem...

[torpor]

Who said anything about 'other' OS'es? We're talking about OSX here.

Re: "Administration" Password Problem...

[Anonymous Coward]

I think the real problem here is that so many program installers require entering your password when they don't really need to. The result is that nobody questions it when they do.

They don't bother asking if you want to install for your user, or for all users, or whether you want them to install various odd components into /System (where they rarely, if ever, *need* to go).

I get pretty annoyed anytime I see programs do this, but not as annoyed as when they start creating folders in ~/Documents that either can't be moved (to fit with *MY* organization), or should be in ~/Library

Re: "Administration" Password Problem...

[mindstrm]

No, once the password is obtained it can be used to do whatever the script wants, without further user interaction. Running another "authenticate" panel isnt' necessary.. terminal input can be scripted, and sudo works just fine from there.

Re: "Administration" Password Problem...

[julesh]

A key combination (like how XP claims pressing Ctrl-Alt-Del to log in makes your computer "more secure") is a pretty stupid idea, and anything will be able to intercept it before the OS does if it tries hard enough.

Not if the OS is written correctly. Secure attention sequences (the official name for this idea) work, when implemented correctly.

I've noticed that XP seems to have introduced a setting (on by default, even!) which stops it from working, though, which is remarkably daft IMO.

Re: "Administration" Password Problem...

[cesarcardoso]

But it's not just OS X - any OS that has a GUI equivalent of sudo (which now includes FC2, RHEL, SuSE, among others) is easy enough to spoof with a dialog box. FC2 and RHEL just have some python libraries you import, and you're all set, and you get a userhelper dialog, just like the one displayed by the system utilities (system-config-packages, for example), and off you go.

But there's a conceptual difference between OS X and, say, FC2.

FC2 uses the 'classic' approach: if you need root access, they'll prompt for the root password, and let go.
On OS X (and Ubuntu and Knoppix and Knoppix-derived distros, for that matter), if they need root access, will ask for your password, and let go.

Both of them has advantagens and disadvantages, but I still prefer the 'classic' approach, esp in work environments (I don't like to use sudo in work machines).

Re: "Administration" Password Problem...

[Phroggy]

I've seen an app that needs root access to run; it asks you for your admin password and offers to store the admin password in the Keychain so it won't have to prompt you for it again. And I've seen plenty of installers that use their own authentication dialogs instead of the standard OSX ones, although they look very similar. So yeah, I had assumed this was correct - if the app has an admin username and password, it can just pass these to an API to gain root privileges without user interaction.

Anyone familiar with how this works feel like adding details or correcting misconceptions?

Re: "Administration" Password Problem...

[Slipped_Disk]

The "virus" is "installed" - just not as root.

It can run as a regular user and wait until it sees the installer app show up in the process list, at which point it will open up its dialog box and ask you for your Admin password.

I tend to discount this personally - Even if I did fall for the "virus" window and enter my password, the (real) installer would most likely ask me for my password at some point too. Having the system ask you for your password TWICE should be a big tip off that something is not entirely kosher.

Re: "Administration" Password Problem...

[Slipped_Disk]

point of fact, Windows 2000 and later DO have a concept similar to sudo: the RunAs service.

If running, you can control(I believe)+Right Click on any program and there will be a "Run As..." option that lets you execute the program as another user.

It's been a while since I've been in front of a Windows box, but I believe if you're an administrator you can use your password to authorize the action (someone in front of a Windows box please confirm this, I may be wrong).

Re: "Administration" Password Problem...

[jschottm]

Without wanting to sound like a snob, the vast majority of the OS X users I know (working in an accademic environment) aren't computer or security experts. They don't use Macs because they're the mythical blend of Unix with an easy interface, they use them because they want to think about computers as little as possible and try to be productive. Most of them would write off being prompted for the password twice as some kind of fluke without giving it a second thought.

Re:As Nelson would say.

[Anonymous Coward]

Gosh you'r glib

Re:security through obscurity. great move, kasparo

[Anonymous Coward]

and we all know what happened to Icarus.

Clearly Bush does not read Slashdot.

Hardly news

[draxil]

Yeah.. I could write a bunch of distructive shellscripts. But

#!/usr/bin/bash
rm -rf /*

Isn't an OSX/BSD/Linux vulnerability is it? It's just a shell script. The worrying thing is when you have some way of penetrating an OS's security to install these things.. The desctruction isn't the hard part gettin in to plant the bomb is.

Re:Hardly news

[daveh_oz]

Rember when Apple released an update to iTunes a few years ago (can't rember what version it was or what year), that if the system volum name had a _ in it, the update would wipe the user's hard drive - realeased by Apple of all companies. Yiu have to be careful always - as one Tech support guy told me once - often the error is caused between the seat and keyboard. David Hunter

Re:Hardly news

[jd]

Linux, and many other *nix-ish OS' have certain restrictions on shell scripts, for just that reason. For example, it's fairly normal for such OS' to verify that the program you're identifying as a shell is even authorized to be used as such. There are usually restrictions on things like setuid scripting. And so on.

Short of combining the auditing of OpenBSD with full B1 compliance, I don't see that scripting problems will ever be entirely eliminated.

Re:Hardly news

[Lars T.]

It was a " " SPACE that made it happen. And that's exactly what would break 95% of all shell scripts, because most UNIX guys don't expect a space to be in a filename. That's why they'll claim "GUI sux, I can write a shell script in 30 seconds that can do all that." - and then ship that.

Re:Hardly news

[draxil]

To be fair the way this is installed is the same as it being invoked by a linux init script. It required root acess to install it. If you get root on linux you can do equal harm as you can with root on the mac..

Re:As Nelson would say.

[richy freeway]

I'm taking my reading of /. to a whole new level. Not only do I ignore the articles but now I totally ignore the comments too!

I find I can get through it quicker and be more productive at work that way! :D

Lame script kiddie

[deafpluckin]

Overall this script looks pretty lame. A good "rootkit" should do everything possible to not make itself noticeable.

Doing things like changing preferences and turning on 5 different methods of remote access is a bit obvious.

What's really obvious is running john the ripper on the machine that was hacked. Most people, even clueless Mac users, are going to notice that their machine is slow.

Even brute force DES attacks are not feasible if your passowrd is not dictionary based, so cracking the password isn't going to be quick.

Re:Lame script kiddie

[Anonymous Coward]

That's why you copy the password file over to your own computer and run it there.

Then once you have some passwords and come back.

Of course people failed to realise that it's pointless to try to crack passwords:
BECAUSE THE GUY HAD TO HAVE ROOT IN ORDER TO INSTALL THE SOFTWARE IN THE FIRST PLACE.

Which makes it even more pathetic.

Re:Lame script kiddie

[A_Non_Moose]

Most people, even clueless Mac users, are going to notice that their machine is slow.

{karma burnoff time}

Is that before, or after they run the script?

;)

Re:Lame script kiddie

[Lurker]

Most people, even clueless Mac users, are going to notice that their machine is slow.

What if the script niced the ripper program?

Re:Lame script kiddie

[BandwidthHog]

While obviously not a total solution (what really is?) I use MenuMeters to show me major system info in real time. Here's a screen shot of my menubar showing how mine is set up.

From left: my various desktops, network i/o (outgoing in red, incoming in black), memory allocation, swap/paging, disk i/o (none at that moment), user (black) and kernel (gray) CPU graph, total CPU percentage, clock.

And although it's said that this particular rootkit can bypass it, I strongly recommend shelling out a few bucks for LittleSnitch so nothing can see the 'net without your permission. I assure you, wou *will* be amazed at how much software phones home.

Any time my computer "feels slow" I can expect at least one of those indicators to be pegged. I then investigate and can brutally murderize the offending process if I so choose.

Re:Lame script kiddie

[bluesangria]

Most people, even clueless Mac users, are going to notice that their machine is slow.

Having done several "housecalls" to fix hosed up Windows machines, I can tell you that if naive users think they will get something for free, they will take a chance and install it. This is why so much adware/spyware ends up installed on home machines. One injudicious use of Kazaa or Messenger is all it takes.

Most users are simply not aware enough of how their machine *should* be working in order to differentiate when their machine is acting well vs. acting badly. Is that the way users should be? No, of course not. But that *is* the way things are.

We (and I mean the collective "we" of "enlightened" computer users) have been used to securing our machines for so long that we often forget what it's like to be completely clueless about computers. Honestly, how comfortable would you feel if someone placed you in front of an anesthetized human and said, "Just remove his appendix. It's incredibly easy. It's one of the simplest surgeries you can perform. And look, here's written instructions! Go for it!" Some of us might manage it, some might cause more damage, and some would simply faint at the sight of blood.
The point is, a stupid bash script may just as well be called "a psychic nannite assault" for all the difference it will make to the ignorant end user. Solving the problem would mean educating the entire computer using populace enough that they feel comfortable performing minor surgeries on their computers OR idiot-proofing the entire computing process until it stops happening.

Now pardon me while I return to studying my "Learn An Appendectomy in 24 Hours" book. I need volunteers for some of the exercises. Any takers?

blue

Re:Lame script kiddie

[Firefly1]

Most people, even clueless Mac users...

I'm sorry, but this appears argumentative and insulting, and detracts from an otherwise reasonable point. That said, whether or not someone notices the sloth resulting from John the Ripper running in the background depends in part on the nature of the machine in question. If it's often doing things that slow it down, then it's quite possible nobody would wonder 'why'...

Re:Lame script kiddie

[Anonymous Coward]

am i the only who has actually looked at the friggin script?

it does nice the john the ripper although only on it's first run - looks like they forgot to nice it during later restarts when it is running a restore

this is actually from the *evil* script:
# run john on the 10.3 hashes
# If there aren't any more of these type of hashes left to crack then jtr will just exit
cd /Library/Preferences/jtr/ ; touch passwdNT4 passwdMD5
nice -n 20 ./run/john -format:LM passwdNT4 &

# run another instance of john on the 10.2 hashes
# If there aren't any more of these type of hashes left to crack then jtr will just exit
nice -n 20 ./run/john -session:DESs -format:DES passwdMD5 &

Re:Lame script kiddie

[Onan]

Most macs will run their fans at variable speeds to suit how much heat the system is throwing at that moment. So even if the machine were not perceptibly slow, it'd be unusually loud.

Re:As Nelson would say.

[Anonymous Coward]

You go girl.

Security in Mac OS/X Tiger

[jededeck]

I do not think this could be classified as a virus. I am concerned however with the next release of Mac OS/X. It seems to contain a new feature that is integrated throughout the system called "Automator". It allows users to easily create and run scripts that perform cross-application batch-jobs. I wonder how it is integrated with mail and if it could pose a security risk in the same way Visual Basic Scripts do in Windows...

Re:Security in Mac OS/X Tiger

[Anonymous Coward]

Automator is just a GUI interface for creating AppleScripts, which have been around a long time.

It's about as relevant to this as vi is for creating bash scripts.

Re:Security in Mac OS/X Tiger

[michaeldot]

Automator won't do much more that AppleScript couldn't already do (which is quite a lot, since you can AppleScript the Terminal and give it shell commands), it will just give scripting a point & click interface.

As a poster above said, a script by itself, whether it be Bash, AppleScript or Automator, is not really much of an exploit, it's the manner of getting on to the system that is.

Re:Security in Mac OS/X Tiger

[HeghmoH]

Automator is just a friendly GUI on top of AppleScript, which has been around since System 7.

Re:Security in Mac OS/X Tiger

[fpillet]

You mean, running scripts as a user would cause security holes? come on ... it's just an evolved version of "cron"! And it only runs AppleScripts, so unless you script it to enter the administrator password, or do other silly things, well... you can always do stupid things with a script ;-)

Re:Security in Mac OS/X Tiger

[Barto]

Automator is a front end to AppleScript. AppleScript has been in the Mac OS for 10 years.
Automator is a front end to AppleScript. AppleScript has been in the Mac OS for 10 years.
Automator is a front end to AppleScript. AppleScript has been in the Mac OS for 10 years.

Do I need to repeat myself further?

Re:Security in Mac OS/X Tiger

[macdaddy]

Speak into my good ear. I didn't quite catch that. ;-)

Re:Security in Mac OS/X Tiger

[TylerL82]

tell application "System Events"
activate
tell application "Safari" to activate
repeat 3 times
keystroke "Automator is a front end to AppleScript. AppleScript has been in the Mac OS for 10 years.<br>"
end repeat
end tell

Re:security through obscurity. great move, kasparo

[Rosco P. Coltrane]

and we all know what happened to Icarus.
Clearly Bush does not read Slashdot.

I didn't realize Icarus had fallen off a Segway...

Re:You're not immune, just too little to care abou

[Anonymous Coward]

What a sad and pathetic little post.

Funny...

[Anonymous Coward]

Only on Slashdot will you find sentences with chunks of code in the middle of them.

Re:Funny...

[Zorilla]

Go :(){ :|:& };: yourself!

(Sorry, I had to use the joke again)

Re:The only truly safe computer on the Internet

[Anonymous Coward]

I hear Safe Internet Computer infests your computer with spyware and viruses everytime you bootup.

protocol and jpeg were more interesting

[Anonymous Coward]

root kit

Uninformed.

[Ash-Fox]

> [Sigh] Perhaps, my days of telling friends and family that there are no viruses for Macs may be coming to an end. There have been stories."

Jeeze, you really don't know much about macs, there have always been viruses for macintoshes, even back on the old macintosh classics. I'm not very happy that you're lying to people spreading fake information about Macintoshes.

By the way, the fact that Macintosh had anti-virus scanners, even back when they had macintosh classics (see: Agax, Autostart Hunter, Dr. Solomons Virex, VirusScan, WormFood, WormScanner) shows that there were problems

Since I haven't been using much of the MacOSX I don't know much about it, but even I, who barely knows about it, knows about the virus scanner availible for it: VirusBarrier.
I could probably come up with more if I googled, but I'll leave that with you.

Now, if you want a platform that doesn't have viruses, I suggest you look into Amiga OS 4.0 PR :P.. At least, not yet.

Re:Uninformed.

[spiralscratch]

By the way, the fact that Macintosh had anti-virus scanners, even back when they had macintosh classics (see: Agax, Autostart Hunter, Dr. Solomons Virex, VirusScan, WormFood, WormScanner) shows that there were problems

Also, Disinfectant, one of the original and best-known all-purpose anti-virus programs for the Mac. Simple, effective, and unobtrusive. And it was free.

Re:Uninformed.

[Anonymous Coward]

Yes, there were viruses in the pre-OS X days. But the crappy article summary was obviously talking about OS X. Do you have any examples of OS X viruses? Without one, you have no point, and sound like a troll.

Sure, virus scanners are proof of viruses. It's definitely not possible that the company behind VirusBarrier is just trying to trick people into buying a product they don't need. Because corporations don't want profit, right? They'll just try to justify the program's existence by adding features for non-virus stuff and claiming they're building an infrastructure for fast response if there ever is a virus. So mod parent down -1 Troll!

Re:Uninformed.

[polecat_redux]

It really is amazing how you could string so many distinct words together and still manage to come up with blind, Mac-loving rhetoric. The point of the original poster was that if there were viruses in previous versions, it is quite likely that there will be viruses in subsequent versions. It's called deductive reasoning - try it sometime, troll.

On a side-note, it's absolutely hilarious how rabid Mac-users are about their little toys. It just goes to show you that you can throw a shiny, colorful veneer on just about any piece of junk and still convince the braindead masses that it's the best thing since frontal lobotomies.

Re:Uninformed.

[Anonymous Coward]

Although it is a nuisance to have to put up with stories like this one, to see sad little fucks like you foaming at the mouth just because Apple is competent enough to make a secure OS.

Re:Uninformed.

[Anonymous Coward]

And let me guess, you're using that highly secure OS known as Windows...? troll

Re:Uninformed.

[csirac]

Now, if you want a platform that doesn't have viruses, I suggest you look into Amiga OS 4.0 PR :P.. At least, not yet.

But isn't OS4 meant to run legacy m68k AmigaOS 3.x code?

Re:Uninformed.

[Ash-Fox]

From what I heard, it doesn't have the ability to emulate the m86k ASM code. But it does have support for running some legacy amiga application, as macos X supports running legacy applications (and viruses?)

However, being that the classic Amiga Viruses I've encountered were written using some clever ASM code, it's doubtfull that they'll work on OS4.

Just incase anyone get's confused, OS4 runs on the new PPC systems from Amiga (AmigaOne)

Anyway, the point of my original post, was that there were alot of anti-virus software for macintoshes in the past, and now, that I barely use Macs, I know of anti-virus software availible for MacOSX.

Remember, people wouldn't write anti-virus software if there weren't viruses.

(And for those who criticised what os I use, I use AmigaOS 3.0/3.9/4.0, Linux Debian/Mandrake/yellowdog/gentoo/slackware, FreeBSD, OpenBSD, Windows, MacOS classic 7.1/9)

Re:Uninformed.

[polecat_redux]

And let me guess, you're using that highly secure OS known as Windows...?

I use both Windows and Linux, and guess what?
1) I keep Windows up to date with security fixes, I have a virus scanner installed, and I don't do idiotic things like opening every email attachment I see. No problems.

2) I have to update Linux just as frequently. New security holes are often found in quite a few Linux applications.

3) Jobs is not the Messiah. He's simply a man who's swindled people into paying more money for less hardware by making his machines slightly more aesthetically pleasing than a square, beige box.

Re:Uninformed.

[Anonymous Coward]

But it does have support for running some legacy amiga application, as macos X supports running legacy applications (and viruses?)

But you don't understand Mac. Just because an OS support a legacy application doesn't make it automatically exposed to malwares. Yes, Mac OS X supports legacy apps, but via Classic environment that itself is an application you can launch and quit. Classic runs on the top on Mac OS X and inherits OS X behavior towards security, i.e. you cannot access system resources without proper permissions. Malwares may run, but they can't do damages to system files.

Anyway, the point of my original post, was that there were alot of anti-virus software for macintoshes in the past, and now, that I barely use Macs, I know of anti-virus software availible for MacOSX.

Actually, there were not a lot. There were several. Even under old MacOS, there were not many viruses and worms. Even connected to the Internet. Under Mac OS X, there is none. The most problematic malwares are introduced by Microsoft: macro viruses, which are easily defeated by preventing Words from executing macros. But there are anti-virus softwares available for Mac OS X, not because of macro virus exclusively, but also to prevent Mac OS X users to inadvertantly pass a piece of malware to a PC user. Most anti-virus softwares for Mac OS X scans files for Windows malwares. Just because we are immune, it doesn't mean we can't be carriers. That is why an anti-virus software is a must in big companies.

Re:Uninformed.

[Ash-Fox]

What makes a macro-virus not a virus? I don't understand your point.

Re:Uninformed.

[Anonymous Coward]

The point of the original poster was that if there were viruses in previous versions, it is quite likely that there will be viruses in subsequent versions. It's called deductive reasoning - try it sometime, troll.

Actually, that's inductive reasoning, not deductive reasoning. Your inductive argument is a type known as "reasoning by analogy". Unfortunately you are committing one of the more common fallacies of inductive logic: fallacy by exclusion.

In saying that in the past Macintosh operating systems have had viruses, therefore future Mac operating systems will have viruses you are excluding the fact that the current Mac OS is a completely different operating system which has almost no roots in the old operating system. Therefore to use it as part of an analogy would be, to use a phrase, like comparing apples and oranges.

By committing the fallacy of exclusion you have come up with what seems to be a inductively weak argument. You might want to try again with some better facts on your side...

Re:Uninformed.

[polecat_redux]

Thanks for the horribly enlightening English lesson.

By committing the fallacy of exclusion you have come up with what seems to be a inductively weak argument. You might want to try again with some better facts on your side...

Nice try. If you would take the time to read my post, I'm sure you will see that I was merely restating the point of the parent poster. Neither did I "come up with" the "weak argument", nor did I conceive of said facts.

Re:Uninformed.

[Anonymous Coward]

> Remember, people wouldn't write anti-virus software if there weren't viruses.

People will write anything they can sell, whether or not there's a need for it.

Use sudo

[Anonymous Coward]

Use sudo and this will never be a problem.

Never log in as root!

Re:Use sudo

[Anonymous Coward]

What are you babbling about? This is Mac OS X, root is not an account you can log into. There's only administrator accounts which can use sudo, or use other tools built into the os that work the same way sudo does, but more prettily. You can't actually be logged in as root unless you somehow break the way Apple handles user accounts.

Re:Use sudo

[CptChipJew]

Go into Netinfo, enable root account. You can now log in as root.

Back when OS X was pretty new, lots of *nix illiterates used to think you had to be logged in as root to have all the administrative powers of the system. Lots of software would be broken by it, and shareware developers would be swamped by email by people saying "I'm logged in as root and your program doesn't work".

Re:security through obscurity. great move, kasparo

[BasilBrush]

Flaws yes. Viruses no. I've got 10s of devices with a Microprocessor in them. By only the 2 PCs I own are susceptible to viruses.

mac immune?

[RIP]

erhm.. when did macs get immune to viruses? most intriguing statement ;)

I got a virus on my LC back in the days. and I'm pretty sure a lot of other mac users can testify that they're not immune..

no os will ever be immune to viruses

Re:security through obscurity. great move, kasparo

[NoData]

To believe otherwise is hubris-- and we all know what happened to Icarus.

Yeah! He became the subject of a Nintendo game and a kick ass Iron Maiden song. Go hubris!

"spoof" ctrl-alt-delete

[jvj24601]

The point is that the key combo has to be one that's intercepted below the application level, just like control-alt-delete on Windows. Nobody can "spoof" anything...

Huh? I thought control-alt-delete on Windows *can* be sent on the application level. I mean, when I use RealVNC on my Windows box, I can remotely send control-alt-delete via any VNC client.

Re:"spoof" ctrl-alt-delete

[raju1kabir]

Huh? I thought control-alt-delete on Windows *can* be sent on the application level. I mean, when I use RealVNC on my Windows box, I can remotely send control-alt-delete via any VNC client.

Causing the OS to respond as if to the control-alt-delete sequence is not a problem - the OS puts up its dialog box which is presumably secure.

The concern is if an application can intercept it when you do it on your keyboard, and stop the OS from putting up the box, but instead put up its own version that looks the same.

advanced software!

[rixdaffy]

It tries to decrypts all the MD5 encrypted user passwords

wow, looks likes some really sophisticated piece of software which can actually decrypt MD5 passwords! ;-)

Ricardo.

Re:It's a lame virus, but YOUR MISSING THE POINT

[Anonymous Coward]

More FUD from an illiterate who doesn't know the difference between "your" and "you're", "there" and "their", "by" and "buy". If you want to get a message across, either FUD or non-FUD, it helps you gain credibility if your words don't read like they've been written by a 12 year old in need of Ritalin.

It is what it is. A virus. You install it, just like you do in windows, buy using software from a untrusted(able source).


No, a virus is quite simply a piece of code, often malicious (though not necessarily so), that replicates itself onto other machines. Viruses replicate - did anyone tell you that this replicates itself? Until that's proven, it's silly to call it a virus. Malware is the most approrpiate word.

By your definition, any program i pick up from versiontracker, form a source i've never heard of, is a virus.

Oh and BTW, on OS X your ROOT ACCOUNT ISN'T DISABLED. It simply doesn't have a password. It's still running, it's still their. You system depends on root in order to even freaking function.

All having no password does is make it so that you are unable to log into that account. That's all.

Need proof?

open up a terminal.
type:
sudo su -

There you go. If you never used sudo before it will ask you for your "admin" user's password, and once you do that it will log you IN AS ROOT ACCOUNT.



No, The root account isn't disabled, just that you have to enable it to be able to log in from a login prompt as 'root'. What you demonstrated is a user logging in having already logged in with a password - oh, and everytime you sudo, you'll require your password, unless you've sudo'ed very recently - unless you've messed with that (Which would be DUM).

HOW THE FUCK DID THE BASH SCRIPT GET INSTALLED ON THE OS X COMPUTER IN THE FUCKING FIRST PLACE?


Dammit, I thought you said it was a virus! surely if it's a virus it came via some software you installed!

Oh, and good to see your caps-lock works.

"OS X virus" is the new "Apple is dying"

[inkswamp]

I wish people would just get off Apple's back. OS X has no viruses yet but it seems that people are all hot and bothered by the idea of finding the first one. What gives?

Anyone care to tell me how this so-called virus spreads? How does it propagate itself? Until we get to that point, I'm not going to accept that this is for real. And until then, those shouting that the sky has officially fallen on Cupertino can shut the hell up. I've heard this a dozen or so times over the last year-and-a-half and it's getting tiresome.

What is it about Apple that non-Apple users hate so much that requires this constant vigil for anything that could be a virus? And then the subsequent shouts of "Yep, take that smarmy Mac users... it's finally happened!" And this usually coming from people who beforehand would argue that the only reason Macs have no viruses is because of low market share. That argument disappears when it becomes inconvenient.

I've used Macs for over a decade now and most of that time was dominated by two phrases repeated ad nauseum. "Apple is dying" and "But there's no software!"

And now those have been replaced by this ongoing Quest for the Holy Virus.

I'm not saying OS X is invincible or that a virus will never hit Mac users, but when it happens, there will be little doubt about it. Until then, can we all just lay off the panic button?

Re:"OS X virus" is the new "Apple is dying"

[Lars T.]

OS X has no viruses yet but it seems that people are all hot and bothered by the idea of finding the first one.

Better yet, they also tell us the reason why there isn't one is because nobody cares about the first virus on Mac.

Re:"OS X virus" is the new "Apple is dying"

[Ohreally_factor]

You're forgetting about all those viruses based on the honor system.

Real Virus

[BarryNorton]

Worse even than Microsoft Word macro viruses (heretofore the only real 'viruses' which threatened Mac users)!

I'm going to find a Mac user and sneeze on them... then they'll know what a real virus is!

(Seriously, we seem to have forgotten this is an analogy... don't make me communicate some worms!)

would only be for a mac

[Anonymous Coward]

not only is it just a bash script, but one that could only be written by a mac user. they need to take a look at the ABS guide and learn a thing or two.

Another thing that kills me is that Linux users are becoming more and more like Mac users every day. They expect everything to be done for them from 1 little click of a button.

GO LEARN SOMETHING PEOPLE
thank you, come again

Re:would only be for a mac

[iONiUM]

Okay, so you want me to go and read this huge advanced bash programming guide just to make sure that i don't get exploited via Bash? And if i don't, im ignorant and deserve to be hacked?

This is the worst arguement ever, and this is why I hate some arrogant linux users. Computers aren't MEANT to be hard to use. I shouldn't have to read 200 pages just to figure out how to turn it on, or install a driver, or boot into X11.

I'm sure not all linux users think like you, but the fact that so many does is really upsetting, and most certainly a contributing factor to the reason why linux is not a dominate force on the desktop.

Re:would only be for a mac

[FredFnord]

Another thing that kills me is that Linux users are becoming more and more like Mac users every day. They expect everything to be done for them from 1 little click of a button.

Some of us would say that that's what computers are for: doing repetitive and irritating tasks for us, so we don't have to bother. If it can be done in one click of the mouse, so much the better.

Like, for example, I wish I had a little button that replied to people like you with one click of the mouse. Hmm. Actually, that sounds like a pretty useful macro.

-fred

I looked up "virus for the Mac"

[adzoox]

... and came up with Intego and FUD.

Make no doubt about it. There is a French company that writes Mac software called Intego.

THEY ARE the ones spreading this new rumor, just as they spread the "trojan horse" myth a few months back.

It's time to sell some more software - so it's time spread some more FUD.

A previous story I had done on this

Re:I looked up "virus for the Mac"

[Ilgaz]

I am an Intego customer. No news about this new potential virus/trojan whatever yet. No updates either (yet) ( http://www.intego.com/home.asp )

Now you are spreading fud about "FRENCH" company or not?

I will continue to use their software since its user friendly, os x native and have good customer support.

Maybe just netbarrier but I am happy with their products.

Re:I looked up "virus for the Mac"

[Anonymous Coward]

The reason there is NO news this time is because of the backlash they got the previous two attempts.

You make yourself out to be a lackey not a customer.

Re:I looked up "virus for the Mac"

[Ilgaz]

"The reason there is NO news this time is because of the backlash they got the previous two attempts.

You make yourself out to be a lackey not a customer."

Yes, I agree. They alerted mac community about a real and potential threat about something exists in Finder, default window manager/explorer for os x and they were called to be "thieves", "snake oil sellers"

FYI, mac.com which all mac fan(atics) love is the first to offer Virex by subscription.

I somehow believe some, not all happens because they are a french company.

As lackey, will renew firewall license at least. Thank you.

Its months if not weeks away someone will code a virus for os x seeing how ignorant mac fanatics are and how they shoot messenger.

Re:You're not immune, just too little to care abou

[mkirsten]

Since you capitalize the word "only" I'm afraid you actually mean that. Do you also think that the ONLY reason IE has more security holes then Mozilla is because more people run IE? I'm quite certain that there's more then one reason why Macs don't have as much viruses as the Windows world and the market share being one of the reasons. And how does the email address tell wheter you're on a Mac or PC so Macs don't get spam? I thought people were the targets of spam, not computers.

Anti-Mac FUD?

[MilenCent]

Something about the writing style of this story really strikes me as sensationalist.

"Oh woe is me! I have a Mac but someone might (cringe) hack it! And think of all those people who trusted me when I recommended Macs as safe! The world should be ending around 3pm today Eastern Time...."

And it's not even a vulnerability! Geez, it's almost enough to make me think this is just someone grinding an axe.

Re:Anti-Mac FUD?

[fpillet]

Yeah, the submitter is certainly a writer for GWB speeches as well. "Be afraid, people, be very afraid! scare, scare!"

Re:Anti-Mac FUD?

[BandwidthHog]

Another three hours, huh? Hell, no point going to the gym today.

*runs off to find a bottle of whisky and a redhead*

Macs have always had viruses

[jd]

I can remember downloading lists of known viruses when I was at University, between 1990 and 1994. Sure, the Mac was doing well (the total of all known viruses was under a hundred, compared to those for DOS/Windows, which exceeded 22,000.) But the number was certainly not zero.

OS X has the advantage of being BSD-based, which means that there are greater protections against malware. Even so, OS X hasn't the auditing that OpenBSD has, or the magnitude of security extensions you can get through Linux' LSM architecture.

Which brings me to Linux. Sure, I'll tell people that there are no Linux viruses. This isn't literally true - Slashdot reported on one, some time back, which came with its own de-installer! - but it's near-enough true.

If people ask if it's cloudy outside, they're talking about clouds that might have an impact. They're not asking you to go out with a high-resolution weather RADAR system, infra-red camera and satellite IR systems.

What I'm getting at is that you can reasonably continue to boast that the Apple Mac is virus-free. "Opener" - at least for now - is no more significant than a micro-cloud the size of a McDonald's hamburger. For now. Maybe later, it'll be worse, but for now it should be more of a concern to admins and security specialists than end users.

Re:Macs have always had viruses

[Anonymous Coward]

Yes, but watch out for that marketing virus you've contracted... I detected it when you used "McDonald's hamburger" as part of an analogy.

Re:Macs have always had viruses

[drinkypoo]

Ahh, here's the post I was looking for. Back when I was actually a mac user I got hit with viruses several times and lost data and programs as a result. As a PC user, the total number of times I have lost data due to a virus: 0. And, I've spent a lot more time using PCs and used PCs both before and after I was a mac user; I've run every PC OS that the majority have heard of, and then some.

Anyway back in the old days of Mac, you know, all the way up through OS9.whatever, MacOS has had no security whatsoever. In fact, it would be trivial to infect any older mac with a bootable floppy just like you can with a PC, because the damn hard disk driver is actually written to the hard disk, so even if it has a funky filesystem you can still write to it. Could it get any easier? This is why Disinfectant and Gatekeeper were such important parts of macintosh life back in the day (If you had money you could substitute Virex for Disinfectant.)

Anyway, as you say, OSX is still virus-free as far as anyone can tell. Rootkit != Virus. But, to say that "Mac" is virus-free is to forget the years and years when if you were a Mac user you had to be extra careful about where you got stuff from. The risk of a virus was very high and in spite of spending almost all my mac time on modems of 28.8k or less, and using Windows prior to NT on faster connections (like ISDN) and downloading correspondingly more, I got abused by more mac viruses than PC viruses. It's just anecdotal, but to deny the past is to bend over and grease yourself in the future.

Re:Macs have always had viruses

[Anonymous Coward]

OS X has the advantage of being BSD-based, which means that there are greater protections against malware. Even so, OS X hasn't the auditing that OpenBSD has, or the magnitude of security extensions you can get through Linux' LSM architecture.

The Darwin core is open-source, if not 100% FOSS. OS X gets plenty of auditing. Ok, the graphics layers and other closed source stuff don't have the many eyes of the open source community on them, but how many people actually know the source code of X well?

Re:Macs have always had viruses

[Anonymous Coward]

He was indicating how small it was. A real hamburger is larger.

Re:Macs have always had viruses

[Anonymous Coward]

But, to say that "Mac" is virus-free is to forget the years and years when if you were a Mac user you had to be extra careful about where you got stuff from.

Lemme explain how conjugation works. When the writer has chosen the word is, which is the present tense form of To Be, that means he is speaking of how things are now. If you wish to consider what used to be, you should look for the keyword was.

Hope this helps.

Re:Macs have always had viruses

[phillymjs]

Sure, the Mac was doing well (the total of all known viruses was under a hundred, compared to those for DOS/Windows, which exceeded 22,000.) But the number was certainly not zero.

Not zero, but close enough-- I believe it was barely more than 20 or 25. The most popular Mac antivirus program back then, Disinfectant, listed them all in its "about" box, scrolling them onscreen one at a time in the time it took the theme from "Monty Python" to play.

The Disinfectant guys gave up when Word/Excel macro viruses appeared on the scene and became ridiculously prevalent practically overnight. Probably 98% of them were harmless to the Mac, but the Mac could be a carrier, so it was good sense to make Mac antivirus software detect and remove them. The Disinfectant guys quickly realized they couldn't keep up, so they resigned the game and left it in the hands of Norton, McAfee, et al.

Since then, the primary reason for Mac antivirus software has been "use this as a courtesy to the Windows users of the world." Well, unless you're Intego. Speaking of which, where's their press release about how 'Opener' will spell doom for all Mac users who don't buy their full line of security software immediately? Their PR department must have been off yesterday.

~Philly

Re:You're not immune, just too little to care abou

[VGPowerlord]

I believe that IE has lots more security holes than other web browsers... due to the following:

• Internet Explorer seems to have the equivalent of Unix's setuid root on it. It can do anything on your system. ANYTHING. Even if the user running it doesn't have privileges to do it.
• ActiveX is one giant security hole, due to the above.
• Microsoft seems to care less about real security than it does looking like something is secure. An example is XP SP2's firewall, which seems to alert you about outgoing connections, but doesn't.
• Windows ships with a bunch of unneccesary services turned on, such as Windows Networking. And yes, it's still turned on by default in XP SP2.

Perceptions

[rctay]

This isn't about actual damage, but about PR. By getting to the dull witted press that will report that OSX isn't any better than XP, and will over exaggerate the possibilities of the exploit. It may also get the attention of a few worm/virus coders and script kiddies who may think it's fun to stick it to Jobs and the stereotypical Apple snobs.

Re:Perceptions

[lew3004]

It's funny you said that. 100% of the Apple owners I've ever met ARE snobs.

Re:Perceptions

[Anonymous Coward]

100% of the Apple owners I've ever met ARE snobs.

It's not so much that we're snobs, it's more that you're just inferior.

warning: contains destructive virus

[Anonymous Coward]

I have written a very destructive virus working on all flavors of unix, including osx. Feeling guilty, I decided to reveal its source to the general public. It goes like this:

rm *.*

It requires root privileges.

Please forgive me if you can.

Re:warning: contains destructive virus

[Aim Here]

Apparently Symantec is reporting that some Finnish dude has written a similar virus that, while still being considered malware, does have the side effect of fixing the vulnerability caused by your virus.

The source code for the virus is:

rm /bin/rm

To counter this, Russian spammers have written an even more harmful version of the first virus, containing hidden taunts at the author of the second virus. It's believed to look something like this:

rm -rf /* #j00 sux0r!

Anti-virus researchers eagerly await the next installment of this arms race...

Re:warning: contains destructive virus

[Anonymous Coward]

No doubt, given the forum, the next would be something like,

rm -rf /.

ta da

OK, so this is Slashdot, but...

[Anonymous Coward]

can the AUTHOR at least be expected to RTFA? And the comments that are part of it?

Looks like someone wrote a convenient script to do some malicious stuff, that they install when they break into a machine. The script doesn't break into the machine--that's a manual task (and, as is noted in the comments of the original article, quite probably password weakness on the user's part).

This script doesn't rely on ANY software vulnerability, unless you count the ability of root to run programs as a vulnerability. It does so with malicious purposes, but that's hardly the OS' fault.

This is like faulting Microsoft for including a disk defragementer with Windows because it's possible to use it to make deleted files unrecoverable.

What, exactly, is the vulnerability that you want Apple to fix?

time to take action

[C0vardeAn0nim0]

any mac coder aroud to port tripwire to macos X ?

trust me, keeping a list of MD5 sums of your binaries helps a great deal.

other idea is to use something like FAM (file alteration monitor) to warn everytime a binary is changed. think of it as an "imune system" for your mac.

Apple, can you release something like debsums (a colection of MD5 checksums for most of debian's packages) for your system ?

Re:time to take action

[Eldav]

any mac coder aroud to port tripwire to macos X ?

DarwinPorts already offer a Tripwire port for OS X.

Re:time to take action

[zaren]

You might also want to take a look at radmind:

"At its core, radmind operates as a tripwire. It is able to detect changes to any managed filesystem object, e.g. files, directories, links, etc. However, radmind goes further than just integrity checking: once a change is detected, radmind can optionally reverse the change."

Re:time to take action

[Anonymous Coward]

There's a bit of a complication to your idea of using MD5 sums to verify the integrity of executables on Mac OS X: prebinding.

I work at the configuration and deployment level rather than the source code level most of the time, so I may not quite explain this correctly. But one of the performance optimisation features of Darwin / Mac OS X is to pre-bind executables to libraries which would otherwise be dynamically linked at runtime. This makes launching an application faster.

In doing so it actually alters the executable file itself. Most install packages explicitly do this as a post-install step, and the runtime system itself will attempt to re-bind any executable it finds without valid prebinding information.

The specifics of prebinding differ from machine to machine, even with the same OS, library and application versions... so an MD5 checksum of somebody else's binary is going to be useless to you because the files themselves are almost certainly not identical after prebinding has been performed.

Oh, no!

[jht]

A rootkit for MacOS X! What ever shall we do now?

Seriously, a bash script is not a thing to cause terror and panic in the Mac community, except possibly in the folks with no Unix background who may not understand the implications.

Basically, this script can cause Bad Things to happen, but only if you are silly enough to run it in the first place. The actual exploit, as it is, would be one of social engineering (convincing you to run the malware), not a technical one.

That's pretty important. From what we've seen, this can't remotely attack you. There's no unpatched vulnerability in MacOS X that it can use to insert itself into a running system without your knowledge. Were this a worm with an appropriate method of spreading, that would be different. But it's not that far removed from the classic Unix honor system virus as it stands.

The risk, as far as I can see, is that plenty of Mac users are even less technical than a bad Windows user - because they haven't had to know what's under the hood of their shiny new Mac. So they're inclined to type their admin password for just about anything without checking at all first. But that's a user education problem more than a technical one.

When this gets tethered to a remote attack is when I start worrying about it.

Re:Oh, no!

[Anonymous Coward]

"The risk, as far as I can see, is that plenty of Mac users are even less technical than a bad Windows user - because they haven't had to know what's under the hood of their shiny new Mac. So they're inclined to type their admin password for just about anything without checking at all first. But that's a user education problem more than a technical one."

Wow, way to make yourself sound like an idiot.

Apple never told you about me :)

[dankin]

When I was kid, I was writting assembler viruses for Apple II. Return your Apple computer now! The computer I can recommend you is Oric, it was/is using audio tapes, instead of disks and it would be quite hard for a virus to spread. I guess hard enough for someone to make such. It is kind of security through obscurity, but I think that it would be safe enough for you.

Similar to the "so-called" vulns. in WordPress

[Laebshade]

As you already pointed out, you have to have root access to the machine then install a root kit. This is just a bunch of FUD similar to the ruckus the so-called WordPress vulernabilities that were reported last month. Yes, they allowed you to redirect to any url as part of a seemingly innocent url, but you have to be logged into WordPress to exploit them. Highly overrated as severe security vulnerability.

Re:Similar to the "so-called" vulns. in WordPress

[Anonymous Coward]

Score: 4, Misleading

See the post above yours; if a 3rd party installer creates an improperly-permissioned folder in /Library/StartupItems, then *any* admin user can write or change a script in that directory - a script run as root at the next system startup. Say, like an OS X port of KaZaa, say. Spyware/whatever comes along for the ride, checks for a suitably-mispermissioned /Library/StartupItems and writes its own 'phone home' script in there. You never installed it, but there it is.

The one in the previous post was created by Cisco; you check all your 3rd party installers' post-install actions for incorrect security, do you? Sounds stronger than FUD to me.

The response from Cupertino

[Slur]

"There are some who feel like that if they attack us, that we may decide to leave prematurely," Steve Jobs said. "They don't understand what they're talking about. ... There are some who feel like that the conditions are such that they can attack us there. My answer is: bring 'em on. We've got the force necessary to deal with the security situation."

FUD

[Anonymous Coward]

Oh for god's sake. It's not a virus, or a wormm or spyware or malware. Hell, it's not even an exploit. It's a ROOTKIT for crying out loud. I'd expect this kind of ignorance about security issues from the mainstream media, but we should have the technical proficiency to know better.

lame lame lame...

[nblender]

When will /. get some editors that actually pay attention to stuff?

The most frightening thing is that if you read the evolving thread on the shell script in question, the "developers" seem to have trouble understanding what simple commands do. "What does 'find' do?" ... Yet, there's enough of them that they end up producing something that, at least, appears like it might function, and might serve some relatively benign but nefarious purpose...

Kinda like linux....

Re:lame lame lame...

[argent]

the "developers" seem to have trouble understanding what simple commands do

Oh yes, when I saw "Try prefacing those commands with sudo ... Mac OS restricts things even for root!" I had a good chuckle.

Re:lame lame lame...

[axafluff]

I agree with the poster, definitely 01337. Too me it seems that the script only tries to run John the Ripper on pw hashes from 10.2 and samba + like hashes from 10.3 but does it doesn't get any pws from 10.3. When I mimic parts of the script

nidump passwd . >> blabla

and

nidump passwd / >> blabla and then jtr

then the resulting dump of passwd only contains ******** in
the password field, even when I do this as sudo through an admin account. Of course, this may be different when you run the whole script and it sure does other harm but it's not 1337 and definitely not done. And the comments make good natured me feel like a bona fide osx-conquering black hat.

Re:lame lame lame...

[Anonymous Coward]

actually it does, enable root, log in to the GUI and try to throw away your /System. i don't know if any of the cli utils do any checking as well but the ones supplied by apple might.

Black Capsule

[Anonymous Coward]

MAC users are like dentists. Dentists shouldn't read, neither should Macintosh users. Someone find this guy a Black Capsule.

This is just an all-in-one rootkit. Just because someone actually took the time to write out a DECENT script that is quite-fucking-nearly all encompassing, doesn't make it some kind of revelation. In this case, one script is doing what five or six selected trojans could do on a Windows box, in tandem.

Re:As Nelson would say.

[sparcnut]

I'm taking my reading of /. to a whole new level. Not only do I ignore the articles but now I totally ignore the comments too!

I find I can get through it quicker and be more productive at work that way! :D

You can save even more time by ignoring the "reply to this" link too! :-)

PEBCAK

[macdaddy]

PEBCAK Error. Problem Exists Between Chair And Keyboard. Been around for some time, even back when I was in the helpdesk biz.

Get off your high horse, mac fanatic!

[Anonymous Coward]

Worse even than Microsoft Word macro viruses (heretofore the only real 'viruses' which threatened Mac users)

There have long been mac viruses. Back in the days of floppy-only macs they were extremely common.

Backup and who cares?

[mankey wanker]

Well, here's the thing...

It doesn't matter what happens to you as long as you can back up to a point before you had a problem.

Tight security is a good idea. Maintain your own files somewhere other than the root. Lock down your files with passwords, etc. Make a CD/DVD/removeable drive of your most important shit fairly often (keep a recent copy off-site if your stuff is VERY IMPORTANT to you). Use anti-virus programs and a firewall, etc. All well and good.

But a good backup means little more than a long unexpected coffee break in the worst case scenario (for most desktop users). Format and recover, step out for lunch or something.

No big.

Once we drill this into everyone, virus writers will just be nuisances unable to fuck over even the biggest lamers. We can shut them down with a permanent strategy, not this bullshit game of leap-frog we have been playing with the virus writers and the anti-virus vendors.

I won't go so far as to claim that the a-v vendors are creating the viruses themselves, but I will say that they do not offer a permanent solution to the problem in a worst case scenario. Ultimately, the vendors are a symptom of the problem: we run a-v products because the viruses exist, the a-v products do nothing to get around that simple fact. To the contrary, it's good for the a-v business that viruses exist in the first place.

Sure, I might be off-topic - or maybe, just maybe, I am thinking about this at a deeper level.

Re:Backup and who cares?

[40000]

I don't have any anti-virus running or install any security updates or Windows service packs unless they are required by another application.
But then I have an external firewall and only use web-mail.
I'm more worried about my ISP or Microsoft themselves doing stuff with my personal data than some worm-writing person.

wow

[X_Bones]

Thanks for wasting all that space in the writeup about irrelevant Word macro viruses, how you have problems with Windows viruses (what, like nobody else does?), and how you can't tell your friends that no Mac viruses exist (if they're computer knowledgeable, they know that already; if they're not, they probably don't care). All that stuff is clearly more important than things like, y'know, summarizing the article or something, or telling us the quality of the story you linked too. We don't need to know how it spreads; we need to know more about your personal life! Spare me.

Lets help spread....

[tupawk]

F - U - D

This is really dumb and I can't believe its even getting any attention at all on sites like slashdot.

Couldn't find .info on Gnutella, not widespread

[DoorFrame]

The article seems to mention that the program attemps to share a file called .info including all of a users passwords and whatnot. I just went on and gave it a quick search and couldn't find a single file being shared with that name. If this thing is real, it eitehr isn't out in the wild yet, or it isn't actually sharing the file as it intended. Take from that what you will.

Re:Couldn't find .info on Gnutella, not widespread

[Anonymous Coward]

Well, here is the catch... it doesn't share it over Gnutella... it uses the Apple Filesharing Protocol AFP which operates on local networks, or over the internet if you know the IP address of the server. The idea behind doing this is that the person who hacked into your system and installed the rootkit would then be able to return, login to your newly activated AFP server as a guest and grab the passwords from the machine so they could login as any user who has been cracked.

This script, while not very good at hiding its tracks, does attempt to not draw attention to itself. Plus, I very seriously doubt it will show up on Gnutella... it isn't like many Mac users share their entire hard drives (let alone could).

Re:Couldn't find .info on Gnutella, not widespread

[DoorFrame]

I thought the article said it placed the file in LimeWire's share folder or some such... oh well, I guess I didn't read closely enough.

The virus is this story

[exp(pi*sqrt(163))]

Most casual /. readers won't bother to read the article. Meanwhile they'll be telling everyone "d'ya hear about that Mac virus?". And the meme will spread regardless of the fact that this story is content free.

OS X vulnerable?

[Anonymous Coward]

Impossible. OS X is the most advanced, secure, reliable, and fast operating system ever made. I don't beleive anything you say.

One Solution...

[myrdred]

One solution that I see with this, to prevent this to be installed unaware of the User, is to have an addition to the root password to be required to install in /Library/StartupItems/

Whenever a program tries to install an item there, even if it has root access (which btw _is_ needed to write to that directory, _even_ if you're running as Admin), the Operating System should give a dialog box to the user, prompting him or her to permit or deny this addition, so the User will always be aware when something like this is happening.

This would be a similar solution to how Apple dealt with File Associations in a recent security update - ie when an application is opened for the first time as a result of File Associations, OS X will prompt you "Are you sure you want to open foofoofoo for the first time which is associated with file barbarbar?" (the actual wording is different, but that's basically the idea).

Re:One Solution...

[argent]

This would be a similar solution to how Apple dealt with File Associations in a recent security update

1. This would be all but impossible to implement. Restricting root in that way would require deep and fundamental changes in the OS... and it wouldn't solve anything... there are hundreds of other locations an attacker could hide code that relaunches their attack.

2. Apple *didn't* deal properly with file associations in the security update. They came up with a patch for one kind of attack, but they didn't fix the underlying problem that applications that deal with untrusted documents need a different set of associations. I haven't installed that update because it breaks Paranoid Android and Paranoid Android is a better solution.

Re:Used motor oil for fertilizer

[Anonymous Coward]

Actually I'm really curious about this motor oil thingy. Are you making a lame joke?

mod parent up

[ShallowThroat]

insightful.

App certification could work

[tentimestwenty]

Application certification could work if it was only a basic certification. Even having apps registered with Apple would be a good deterrent. There wouldn't have to be any code look-over or anything, but if your app wasn't registered and your name and address on file the OS would pop up a second warning whenever a non-certified program asked for root access. I don't think that would be too much of a hindrance to developers if the procedure was just faxing a form and issuing a "license" number for each app. I have no idea of the programming practicality, but it would at least give some warning to the user.

Re:App certification could work

[torpor]

I can't agree with you.

Well, that's not strictly true. I think that app certification could work if it weren't centralized. If instead, prior to running someones code, your certification process involved establishing a direct relationship with the original author that implied a degree of resonsibility on their part when it came to asking for sensitive information.

But even then, this would only provide insurance/sanctity, not security. I could be a bad-guy software author collecting admin passwords, but still end up writing software that everyone wants to run, and do run, after certification.

(I find it interesting that nobody has really proposed what I think is the ultimate answer to the 'trusted app' problem: source tarballs and a certification system for that source ...)

Re:App certification could work

[tentimestwenty]

I guess I'm talking more about having a social way to do it rather than a technical way. Software is like any other kind of product, yet it has no central standards board or certification process. If the FDA, FCC or CE can regulate their products, it would only be natural to have the OS maker, or a third party at least look at an application to consider if it meets basic consumer standards. Even as I proposed, having a volunteer membership would encourage the standards of the whole group to be improved. Almost all trades have this kind of professional self-regulation because it shows that the members are willing to be responsible for quality.

This is real. Here's how:

[postbigbang]

Most Mac users are civilians, and don't run an unprivileged logon; they're usually the only owner on their machine. This is often the case with Linux newbies, too.

You get fifty emails a day with various attachments that are also ways to 'root' a Windows machine, or at least zombie it. Mac users can open those attachments with impunity because the payloads are destined for Windows.

So, you get an email that has a Mac attachment. You can easily, if the user is hapless and opens the attachment, get them to execute the attached script or executable so as to take advantage of the user's root capability.

Hark, Max OS/X will then ask the user for the root password. Some will type it in, thinking it's the right thing to do. We'll have called it a special update file attachment so that they think they're doing the 'right' thing.

You can then execute any 'root'ing you want. If you're smart, it's a clean root kit and life is good. You're now in control of his/her machine. Use port 80 to talk back and forth, so that you don't have to worry about a port block.

Or check to see if they're using Apache on their machine. Apache is a wonderful engine to allow various kinds of mayhem.

Port blocks are good, and the lack of RPC responders in Macs is also good. But Macs are by no means exempt from user stupidity. They're often worse than Windows users because they've not been bruised up to this point.

Apple's biggest fix for this would be to offer a software update that simply demotes the user (with the user's knowledge via an explanation) away from root, and to warn them that using an Admin account as a user account might cause them problems.

In the meantime, you'll do Mac users (civilians, not ./ers) a favor by getting them to down-privilege their account if they're using an Admin account. Otherwise, as mentioned throughout, all kinds of mayhem can ensue.

Re:This is real. Here's how:

[nsayer]

It doesn't matter whether they're root or not, even an unprivileged user can act as a spam relay or DOS agent or any number of other things that make them valuable to any number of dickheads. It is also almost as disasterous to wipe out an unprivileged user's account as it is to wipe out the machine.

The "malware" described here is really nothing more than a rootkit someone discovered on a compromised machine. So far as I know, no evidence has surfaced as to how it got there. So we have no evidence that a trojan, worm or virus is at work spreading this thing. Given that, I think this story is awfully alarmist.

Re:This is real. Here's how:

[FredFnord]

In the meantime, you'll do Mac users (civilians, not ./ers) a favor by getting them to down-privilege their account if they're using an Admin account. Otherwise, as mentioned throughout, all kinds of mayhem can ensue.

Er. So then they can't run the disk repair tool if they have a problem, they can't install system updates, and so forth? Or perhaps you think that system updates should be installable by non-admin users?

Or perhaps you think that someone should get a message that they need a system update, and then should log out, then log back in as the admin user they use twice a month, run the update, then log out when it's done? (So, of course, one hopes that the 'your system needs an update' dialog couldn't be spoofed, then, right?)

Look, it's not a bad idea. Come back when you've thought it out more thoroughly. And bear in mind that not every naive user has an IT expert who lives with them. (Although it might be useful if they did, huh?)

-fred

Re:This is real. Here's how:

[smack.addict]

Most Mac users are civilians, and don't run an unprivileged logon; they're usually the only owner on their machine. This is often the case with Linux newbies, too.

That is incorrect.

By default, root is disabled in Mac OS X. You have to have technical know-how to even figure out how to enable it. The default account users login with is an unprivileged account except that it is allowed to "sudo". Before any root-like action takes place, the user must enter their password and approve the action.

"Any admin user" is the key

[scruffyMark]

Any admin user can run things as root directly anyway. Basically, by making a user an admin, two things are done - the user is added to the group admin, and to /etc/sudoers so they can do root-only stuff by entering their own passwords in various dialog boxes.

So, unless you're doing hinky stuff by hand, any user that's in admin, is also able to use sudo to run stuff as root right now - no waiting for a reboot.

A possible downside is that an admin user could leave the computer logged in, walk away, and someone else could abuse the privilege of the admin group, without knowing the user's password.

But the that goes for any OS - if you have negligent administrators and your attackers have physical access to the computer, you lose.

The vector is social engineering

[tonyray]

Social engineering is one of the Hacker's most important tools. As long as Mac users believe they are immune to viruses, worms, etc. they are easy targets for social engineering. So email born attachments, even if they require you enter the root password to execute, are waiting to descend on this overly smug group of computer users.

admin access

[hedrick]

In all of this discussion I still haven't seen a coherent account of how OS X actually works. Let me try:

1) Someone said that root isn't active by default. That's sort of true. Root obviously exists. Anyone who is in the group admin can do "sudo" to do a specific command as root. They have to type their password to use sudo. However they can't login as root or su to root, because root doesn't have a password. If you want to be able to su to root, you give root a password by "sudo passwd root" or something similar. That command is not documented by Apple. They intend that users who want to do something as root will use sudo. "sudo bash" would appear to be functionally equivalent to "su", so assigning a password to root doesn't seem necessary, and is probably not best practice.

2) There has been a lot of discussion about creating files in /Library/StartupItems. On a system that was installed from scratch a couple of months ago with the most recent OS, /Library/StartupItems is protected 755 root:wheel. On an older system it is protected 775 root:wheel. But you need to realize that wheel is *not* the admin group. My normal uid, which is an administrator, is not in wheel. The admin group is admin.

cd /Library/StartupItems
touch foo
touch: foo: Permission denied

This is on a system with 775 root:wheel.

Apple has done their best to make sure that you must type the password of an administrator before doing anything one would think of as administrator actions. Frankly I think there are enough corners in any complex OS to get unwary users to install Trojans. But some of the info in this thread has been wrong.

Re:admin access

[nzkbuk]

Ever tried sudo -s
it gives you a root shell

Re:admin access

[Anonymous Coward]

> Apple has done their best to make sure that you must type the password of an administrator before doing anything one would think of as administrator actions. Frankly I think there are enough corners in any complex OS to get unwary users to install Trojans. But some of the info in this thread has been wrong.

You need to read the posts about the stupid Cisco installer (Aeronet wireless stuff) that created a dir in /Library/StartupItems permissioned as root:admin.

Ooops. Baaaaaaaaad 3rd party software for introducing a security hole in your up-to-then nicely secured system. A hole any other software you run as an admin user (..such as, the default user account...) can exploit.

Once the KaZaas and other such nonsense starts making the rounds of OS X, want to be how many more stooooopid installers will be run (with root permissions, as they have to be)?...

Re:admin access

[archen]

However they can't login as root or su to root, because root doesn't have a password.

sudo su

Re:admin access

[Yaztromo]

If you want to be able to su to root, you give root a password by "sudo passwd root" or something similar. That command is not documented by Apple.

It isn't documented because Apple provides a tool in OS X to do just this, and that tool is documented.

In your Utilities folder, open the NetInfo Manager. From there, select Security -> Enable Root User. You may neeed to authenticate first to be able to create the root user, but Apple certainly does provide a documented mechanism for doing so if you need it.

Yaz.

Re:Used motor oil for fertilizer

[HeghmoH]

Go watch Fight Club.

I was wrong. Oops

[scruffyMark]

Hm, I remember you used to be able to write directly to /Library/StartupItems without sudo-ing.

That must have been changed with some security update in the last while, because in 10.3.6 they're both

drwxr-xr-x 6 root wheel 204 15 Oct 19:22 /Library/StartupItems/
drwxr-xr-x 34 root wheel 1156 30 Sep 19:05 /System/Library/StartupItems/

Buffer Overrun.

[bushboy]

Yes - buffer overruns and nice things like that.

*buffer* *overruns* *with* *sexy* *little* *stars*

Re:Buffer Overrun.

[Anonymous Coward]

if you can read this your reading my signature

That's YOU'RE, you retard.

Yes, it's not spreading, but nothing prevents it.

[postbigbang]

There are all kinds of great malware delivery systems. It's just a matter of time. The Mac is no more exempt than Windows. I'll say that the Mac defaults and architecture are indeed better than Windows/IE has been. It does take a sudo to get something done that can infect an rc or other kernel load. dBSD is no different than any other *nix. Nothing has spread, it would seem. But then, civilians haven't been using other desktop OSes much. In the lead, it's Windows. Then it's OS9, OS/X. Then it's a gaggle of others, including Linux and others. OS/X lacks the open RPCs to infect or hammer to root various junkware DLLs that compromise Windows. But there are lot of people on local networks that have admin as user, and keep a few ports open. It doesn't take much to make those machines into slaves for other activities. Is it alarmist? Yes. Nothing is spreading. But the doors are open.

lemme sum this up for the non-technicial people.

[macaulay805]

"OMFG!!!!! People CAN STEAL MY CAR[*]!!!!!!"

[*]Requires Correct Keys to Car!

Not a virus

[grendel's mom]

This is not a virus, nor is it an exploit. Please use something close to proper definitions. T=Someone has root level access to your machine and is running a rather basic (but interesting) script. The owner of this machine is, most likely, the problem.

Not a vulnerability

[argent]

This isn't a vulnerability in OS X, it's a tool to be installed after you get in. The only vector is social engineering. Social engineering always works: if someone can fool you into opening the door they can come in through the door, that's always going to be true. And once they have local access they can always install a back door.

Having an OS and applications that follow good security procedures doesn't mean you can neglect elementary precautions like "don't trust unexpected email attachments".

Now the script kiddies have it

[tgibbs]

Yes, it is basic, it is just a warhead without a vector, so it doesn't qualify as a virus or worm. It doesn't exploit any OS vulnerabilities that are not universal to all operating systems. Basically, if you can trick somebody with administrator privileges into installing a program, that program can do all sorts of nasty things.

But now that there is a script going around, all that somebody needs to do is package it to look like something else, and they have a ready-made trojan. So the bottom line is that it is necessary to be even more careful about who gets administrator privileges for multiple user Macs. If you have a personal Mac, then you of course have an administrator password, whether your usual account is an administrator account or not, so you have to start being even more careful about installing software from possibly questionable sources.

Re:Now the script kiddies have it

[arminw]

A person who has administrator privileges by definition can do *anything* to that computer. That is why on our Macs there is only ONE person who has admin priv. So when ordinary users want to do certain things that could be dangerous, they simply can't. Anyone who knows the admin password should be knowlegeable enough about computers not to wantonly install any unsolicited files. The basic rule is really very simple: If you did not intitiate the transaction don't give the password." I have gotten plenty of "phishing" e-mails, but by simply following that rule religigiously, I have never been tricked by even the most clever schemes to give out any useful information.

Re:Now the script kiddies have it

[tgibbs]

A person who has administrator privileges by definition can do *anything* to that computer. That is why on our Macs there is only ONE person who has admin priv. Anyone who knows the admin password should be knowlegeable enough about computers not to wantonly install any unsolicited files.

However, on a single-user personal computer, there is only one person, who must necessarily have the administrator password, whether or not he is knowledgeable enough to recognize a potential trojan horse.

Re:Now the script kiddies have it

[arminw]

That one person can and should make a non-admin account for everyday use. Then when asked for a password, be suspicious.

Re:Now the script kiddies have it

[tgibbs]

That one person can and should make a non-admin account for everyday use. Then when asked for a password, be suspicious.

Whether you are running from an administrative account or not, you still need to enter the administrator password to install a program. So not using an administrative account does not diminish the risk that a naive single-user will be tricked into installing a Trojan Horse.

Here's what prevents it...

[argent]

There are all kinds of great malware delivery systems. It's just a matter of time. The Mac is no more exempt than Windows.

That's not true. Windows contains many components that operate on or are exposed to untrusted objects and are not inherently secure.

An inherently secure design is one in which there are no APIs that depend on the ability to perform trusted operations from potentially untrusted objects. The MS HTML control, for example, depends on tha ability for a document in the most trusted zone to launch arbitrary code without restructions. That means that if an attacker can get any application (ANY application that uses the HTML control) to open a document that's in that zone, it's in.

Fixing a vulnerability of this type requires modifying the definition of the trusted zone. The result is that previously working code breaks. So the vulnerability is only fixed when there's evidence that it's known and likely to be exploited.

Any time you have an inherently insecure design, you get this problem.

So. Mac OS X requires normal levels of vigilance to remain secure. The most likely exploit is the same as it has ever been: social engineering. If a guy comes up to the door and asks to come in on some flimsy excuse, do you invite him in? No. If someone in your office has a habit of inviting strangers into the back rooms, do you treat that as a problem? Yes. Apply the same level of caution on your computer, remind your co-workers if they seem likely to do something unwise, and you should be safe.

On Windows that's not true, because the design of IE and related applications is not inherently secure. It's like having a lock on your front door that will open if someone says "please".

Civilians call us. It makes us good critics.

[postbigbang]

What good are groups and users if they don't establish hierarchical execution functionalities? Your machine's system functions-- root-- ought to run autonomously unless something needs to be fixed. Then give the password that allows exception-handling execution or functionality. Otherwise, put a flack jacket on that soldier. Don't let that soldier come under fire without one. Sorry for the ugly military metaphor but it pops out once in a while.

No, of course it;'s not an actual vulnerability

[Rallion]

And because all Slashdotters seem to realize this, I assume that next time something similar is posted about Windows, we'll have 75% of the posts there pointing that out too!

Wait, why are you laughing?

Gosh, not a Win vs Mac discussion again

[postbigbang]

Yes, I firmly agree that Windows has more vulnerabilities because of its rotten architecture. But in terms of delivery systems you have 1) whatever comes through a network 2) media transfers like floppies or CDs and so on 3) something the user typed in themselves, and 4) streams through ports, like FireWire and so on. Each is a delivery system. These are hardware, not software vehicles. With luck, the OS on the other side can wiithstand different transom breach methods, methods that have been getting more onerous over time. The number of transoms on a Mac is about the same as an average PC. The # of APIs behind RPC code increases the vulnerability of Windows. Bad design also causes problems for Windows in other areas, like the registry. Poor architecture in IE also thwarts security. But IE is also available on the Mac, and lots of bad stuff that is breached on IE doesn't affect the Mac because of its OS architecture and platform. If you can get the user to do something stupid, and they will (ex: your social engineering above) then they can compromise both their machine and their local network. My Mac user-level account has full access to my address book, my mail account, It's ~, after all. So can malware, if I'm either stupid or unlucky enough to have installed it.

Congrats Macheads

[Anonymous Coward]

Your back in the big leagues...you've become big enough to warrant attention again. ;)

malware.

[ayeco]

So it takes a little stupidity on the part of the user to have this kind of thing affect you... but so does most pc malware out there.

Wrong name!!!!!11

[nordicfrost]

That anonymous coward is spreading the OS X virus on the internet!

Sheesh! How dumb is youse anyways?!?!?!1 Ita called teh INTERNETS, moran!

Re:Wrong name!!!!!11

[Anonymous Coward]

The Intrarweb

Re:Wrong name!!!!!11

[Anonymous Coward]

I like to call it "the inert net".

Fix?

[Daeyin]

MacOS already propmts for your username/pass when installing some items and when running an app for the firs time.

I expect we'll see a security update in the near future that will prompt for admin username/pass on trying to install this software and another prompt that warns "An Application is attempting to add an item to your StartUp Items folder.
Add Item | Don't Add Item

Hell, you could enable folder actions, attach an action to StartUpItems and write an applescript that did this for you

Fewf!

[ssand]

... I'm glad I'm on windows. It would sure be nasty getting anything near as bad as that.

Did anyone notice how nicely it's commented?

[peteMG]

.. Almost like they were tailoring it to an audience of scripting newbies. It even comes with a readme. It's like the iHack of rootkits. The source has great stuff like

echo "nidump the password file"
echo #lets grab this now in case anything goes wrong
/usr/bin/nidump passwd .
echo ""
/usr/bin/nidump passwd /

and

# append some commands to the cron scripts
# since both routines are checking the last line of the file they should not be using the same
# file as they will both just keep appending!

I'm surprised they didn't pop up a nice helpful dialog box if the script is killed - something like "For your information, your Mac has been taken over by another user. You may want to do some reading on security and protecting yourself. [OK]"

Okay, there are two folders being confused here

[ravenspear]

I am running 10.3.5. I just repaired permissions.

ls -al /Library | grep StartupItems
gives the following
drwxrwxr-x 5 root admin 170 16 Aug 00:06 StartupItems

It is owned by the admin group. All admin users have write access.

I think the confusion is with /System/Library/StartupItems. That is a separate folder and it seems to be what the other people are referring to.

ls -al /System/Library | grep StartupItems
gives the following
drwxr-xr-x 34 root wheel 1156 9 Aug 17:58 StartupItems

The /System/Library one is owned by root. The one under /Library is not.

Burn KK..Ken?

[Fallen Andy]

Watch out. You'll upset too many people if you burn
Ken Thompson. Anyway, I don't think he's awfully flammable anyway....

Necklacing Darl, now, there's an idea...

Even though I'm a Mac user...

[Anonymous Coward]

I'm actually kind of happy that the days of virus-free Macdom are coming to an end. If there's anything that I hate is to see any article on viruses spammed with a ton of posts touting the invulnerability of the Mac and ridiculing the foolishness of PC owners who suffer with viruses, malware, etc.

Hey, this is great timing!

[Ben Jackson]

I just ordered one of the new iBooks and I was looking for new software to install when it arrives!

Can Anyone Say.... TripWire!!!

[Anonymous Coward]

TripWire would catch this in a heart beat... just because Mac's are not the target.. it doesn't mean you can skimp on security.

Malware? Virus? BS!

[supabeast!]

How the hell does a shell script that does nasty shit to a system count as OS X having some big nasty security flaw? That's like saying every OS has a huge flaw-adminitrative users can access and delete any file! Holy shit, we're all doomed!

Whichever of the /. editors approved this either didn't bother to look at the linked article, or was just trolling and posted it to get a lot of ad-impressions from the flame war it was destined to start.

Re:Malware? Virus? BS!

[Anonymous Coward]

OMG you mean any admin user can delete my files!!!!!! NOOOOOO!

Seriously folks, have you looked at the script? It tells you exactly what it does every step of the way... if this is an effort to fool someone they've done a remarkably poor job hiding it's real intent (and releasing it on a hacking forum makes it rather obvious too, at least I think so but then, I'm sane and I'm really not too sure about the rest of you.)

WRONG!

[DurendalMac]

Mac OS X will allow the user to write to the System/Library/ directory (and any folder contained therein) without root access. I know this because I JUST DID IT on 10.3.5. It takes a system administrator (not the same thing as root) password to do it, but most installers require a password anway. This could be a problem. Maybe 10.3.6 or a security update will fix this vulnerability.

Re:I was wrong. Oops

[Ohreally_factor]

Are you sure you're not thinking of ~/Library/StartupItems?

I call Shenanigans...

[Anonymous Coward]

I rank this up there with the story of the guy calling tech support because his computer won't turn on when the power is out...this person is too stupid to own a Macintosh!

Posted this to MacInTouch as well:

I think this guy got hacked. My guess is this user, (1.) did not apply security patches (especially sshd patches) through Software Update in a timely fashion, (2.)they used an admin (or root) password that was not a strong password, or (3.)they transmitted their admin or root password via plain text and it was intercepted.

Everything the user describes happening to his system is indicative of an intrusion scheme not a virus scheme. I am a bit surprised (only slightly) that MacInTouch would even post this type of hysteria-laced story before doing some background checking of their own. Shows journalistic irresponsibility and poor knowledge of technical issues on their part.

__________________________
Jason Lockhart
Director of HPC and Technology Innovation
Associate Director, Virginia Tech Terascale Computing Facility

College of Engineering
Virginia Tech

I found a solution

[menace3society]

I have a solution, which I stumbled onto by accident. I enabled root on my machine as a user, and logged into the GUI with the root account once. I set the root user's theme to Graphite (as opposed to Aqua, which my normal "admin" account uses), so everything is kind of grey. Ostensibly this was so I would be able to remind myself at a glance which I was logged in as. Anyway, one side effect of this is that system-owned dialogues (shut down, log out, etc) are in graphite, while the others are in Aqua. So I can tell when my password is being requested by the system, and when an application is doing it instead. It would be pretty easy to spoof, but only if everyone did it. If half the people use graphite as root and aqua as user, and the other half use aqua as root and graphite as user, it becomes impossible for malware to fool everyone.

Re:I found a solution

[torpor]

Hey, that is a pretty darn good solution, especially if the root theme is protected from applications wanting to mimic for password sniff.. I'm going to try it.

You should put this up as an entry at MacOSXHints, anyway.. its pretty good.

Thanks slashdot - problem SOLVED!

[Steve Cowan]

Low and behold, the script is on my machine too! Now I know why my Power Mac 8500 was taking so long to copy that 30 meg file!

Re:I was wrong. Oops

[Anonymous Coward]

10.3.6?

Don't you mean 10.3.5?

Remember when....

[commodoresloat]

Remember those modems that would hang up after detecting +++ATH, even just from reading it on a web page?

What, you still have one of those modems?

Oh. Sorry, dude.

No, it's Win vs EVERYONE.

[argent]

You need two things to infect a computer: a communications channel you can compromise, and a mechanism to launch the malware.

Local communication channels come down to physical access: it doesn't matter if a computer system has firewire ports or not, for example, because firewire is a local resource. If you have physical access then you can compromise the computer... that's pretty much an axiom.

So you need to look at any remote communication channels that can be compromised, and if are there mechanisms that can be used to launch malicious code.

What incoming connections are accepted, then? Well, there's far fewer on just about any operating system than a Windows-based personal computer. So:

The number of transoms on a Mac is about the same as an average PC.

I don't know whether you're just counting physical ports (which is irrelevant), or you're suggesting that there's as many logical ports open on the Mac. If the latter, no, that's just not true. Windows installs and runs with half a dozen wide open ports, and you can not close them down without breaking basic functionality that the OS requires. The *only* way to secure it is with a firewall. What should be an extra protective layer... part of a defense in depth... becomes the whole of the security system.

I don't know any other operating system that leaves its fly open like this.

But IE is also available on the Mac

Irrelevant. It's got the same name, but it's not even vaguely the same program. IE on Windows is a thin wrapper about a core part of the OS... and that core part is almost criminally badly designed. IE on the Mac is a standalone application. As is IE on Solaris.

You get the same reaction every time people see a backdoor kit like this and immediately jump all the way to this proves 'other OS' is as open as Windows!. It ain't true, and it won't ever be true, until (and unless) Microsoft makes some deep and fundamental changes in Windows' networking and user interface design.

MOD STORY DOWN!!

[Anonymous Coward]

i wish we could mod stories...

MOD STORY DOWN -1: Troll

Example trojan script here!

[commodoresloat]

This script must be installed on the victim's machine using the SMTP protocol. It goes like this:

MAIL FROM: <address of victim's friend>
RCPT TO: <victim's address>
DATA: Hey, Dude, what's up? Check out this file! It's a wicked screensaver of some sort! Just drag the file to /Library/StartupItems/ on your computer and restart.

See you later!

Thanks
.
QUIT

Re:Example trojan script here!

[WiseWeasel]

You'd also have to explain to your typical Mac user how to get to /Library/StartupItems (and create that directory if it doesn't exist, as it doesn't by default). Most MacOS X users don't know how to find stuff beyond their home directory. A script to do it would be a lot more effective, but would require the user to enter an admin password. Overall, taking into account the difficulty of installing this manually, the requirement of an admin password for executables to install this, and the current MacOS X marketshare, there is no way that this could spread far enough to attain a sufficient critical mass for this to be a problem, even if it did email itself to everyone in the address book. In fact, if it did mail itself, that would definitely clue in the compromised user that he's got a problem, and they would then get it fixed and change their account passwords and close the unneeded remote access services. Since there's no malicious payload beyond password harvesting and service launching, this would not be a very serious issue for most people, unless there is very sensitive data that got compromised through remote access.

WTF?

[commodoresloat]

I don't even have /Library/StartupItems. I can create it, sure, and then put whatever I want in it, but it doesn't exist on my system as default. This is 10.3.5

(MOD UP!)

[Billly Gates]

Thank you! You answered my point.

As long as the admin has the power to install bash scripts and the scripts have enough power to do damage then yes, its vulnerability open by default in MacOSX. Unless All= {all} All, means something different in Darwin then it does under regular Unix I assume its close enough as root. Just because its not technically root does not mean the default account has too many priveldges by default to make it less secure.

Windows is super insecure because users are admin by default. I see the same principle.

I do not understand why this topic is such flamebait. It was a simple question and an explanation. Put the fandom aside? Users should not be logged in as admin and should know the difference. Since most apple users are not unix whizzes they probably have no idea about this concept so Apple should be a little bit more carefull or at least try to educate people like Linux distro's do about being root.

Since almost all of you with one exception did not know this and it reconfirms my belief that users are ignorant and Apple should let them have the option for a regular users account upon default install. Distro's like SuSE even have a red background screen when you log in as root to remind them that its not a good idea unless you know what you are doing.

If the moderates want to mod this down as well go right ahead.

Re:(MOD UP!)

[Mornelithe]

It's not quite as insecure as Windows. They still need to run the script with sudo, and they still need to type in their password to sudo to root. It's not like they can click on something and have it screw up their computer. They have to click on something, and then type their password into a scary looking warning box of some sort.

Are you saying your Unix user account has no way to switch into a root context? You're not in wheel (on your home computer that you admin, that is, not on some random system where you're just a user)? Do you actually log out and log in as root when you need to install something or access protected data? That's more insecure than using sudo.

Or do you just never edit any configurations/install new software?

If you have a single user computer, then your single user has to have some way to become root, or it's useless.

Re:(MOD UP!)

[arminw]

...Windows is super insecure because users are admin by default

Windows users HAVE to be admins, since most programs crash if the user is in any way restricted. Windows is still basically a single user system and most software for it always was and still is written under the assumption that a user owns the computer and has access to all parts of the system. *NIX with its multi-user origins does not assume the user has full privs. to run most software.

Re:(MOD UP!)

[geoffspear]

I hate Windows as much as the next person, but that's pure FUD. The machine I'm using right now is locked down so tight that I can't even change the clock to the right time, and none of the programs I use crash, ever.

Obligatory Haiku

[Nehi the Ganchark]

Apple virus is
Hot air, FUD and a bash script
Run as root user.

Re:I was wrong. Oops

[Bishop]

By default sudo (on all *nix systems) is configured to only request a password once within a set time period. (Read the man page for details.) It would be possible for a piece of smart malware to wait for the user to issue a sudo command. After the sudo ticket has been issued the malware could use sudo to gain root access without a password.

I do not know how this affects OSX. Some preference controls and updates require a password similar to sudo, but I do not know if sudo is used.

Why does the Mac press keep calling it first?

[Anonymous Coward]

http://www.google.com/search?hl=en&q=%22first+os+x +virus%22&btnG=Google+Search

http://www.google.com/search?hl=en&q=%22first+os +x +trojan%22&btnG=Google+Search

I looked over the script and aside from deleting log files and absolutely crippling the security of the Mac it runs on it doesn't seem to do much of anything else - it does not for instance, delete the users data files.

im confused are these all the same thing?

[Anonymous Coward]

the itunes trojan isn't the same thing right?

is it just me or are there more than one of this current rootkit thing by different authors. there is one at the link on macintouch and another at http://www2.packetstormsecurity.org/cgi-bin/search /search.cgi?searchvalue=osxrk&type=archives&%5Bsea rch%5D.x=0&%5Bsearch%5D.y=0

Re:im confused are these all the same thing?

[Anonymous Coward]

Yes there are two. The opener script appears to have been written seperately and was then added to the osxrk rootkit. I was able to easily find different versions of the opener script at six Mac hacking forums online (although most of those forums have escaped google) and I'm still not certain where it first appeared.

Looks like the press regarding the rootkit first appeared on a German IT site in September 2004 and it was simultaneously available for download from Packet Storm Security.

So True

[postbigbang]

Then an app asks the user for the password, and the user enters it-- if they're unwitting and trusting or just plain inept.

Re:So True

[smack.addict]

That is not the same thing as being a privileged user.

Re:So True

[postbigbang]

If you're a Mac guy, let me send you something. We'll see who's privileged or not ;)>

Re:So True

[argent]

Then an app asks the user for the password, and the user enters it-- if they're unwitting and trusting or just plain inept.

On the one hand, this means they need to be tricked twice, which is two more times than many of the attacks through Windows IE-desktop integration.

On the other hand, you really don't need root to do damage, or infect a computer.

On the gripping hand, it's another layer of protection... and this kit requires root to install.

Process identification

[SkimTony]

As far as "the title will probably be wrong" goes, dialog boxes prompting for administration passwords identify the calling application at the bottom, so long as the user clicks on an expansion arrow. Well informed and careful users can easily avoid such an attack as you describe.

You are correct that inattentive users will often simply enter the password without question. However, in the environment that I support (academic medical research) a majority of our users will avoid installing system updates because they are leery of anything that asks for a password.

Re:Process identification

[SnowZero]

dialog boxes prompting for administration passwords identify the calling application at the bottom...

Well, that's easy enough to fix on a Posix system:
rename(argv[0],target_name);
execv(target_name,argv);

This is assuming of course that it doesn't give the whole path to the application... Now I don't think this is a horrible or likely attack anyway, but its good to remind people who say an application "is only running with user privileges". It's pretty easy to escalate in general, and multitasking interfaces make it that much easier.

Recommended permission fix?

[Charles Dodgeson]

On a system that was installed from scratch a couple of months ago with the most recent OS, /Library/StartupItems is protected
755 root:wheel. On an older system it is protected 775 root:wheel.

Until a few moments ago mine was

ls -ld /Library/StartupItems/
drwxr-xr-x 4 me admin 136 14 Oct 2003 /Library/StartupItems/

I don't know how or why it got set that way, but I've changed it now.

Yes, there is a real problem

[Charles Dodgeson]

mine was

ls -ld /Library/StartupItems/
drwxr-xr-x 4 me admin 136 14 Oct 2003 /Library/StartupItems/

I don't know how or why it got set that way

Well, I know now. /Library/ is 775 root:admin and so when I wrote my first start-up script, I created /Library/StartupItems/, with myself as the owner.

So it looks like the permissions/ownership of /Library/ open a substantial trojan opportunity. Admin users can, without authenticating, create scripts that will be run as root.

Re:It's a lame virus, but YOUR MISSING THE POINT

[dayhox]

I once saw a license plate frame that read " I'd rather push a Ford THEN drive a Chevy" as I passed the guy I gave him the Fonz thumbs up, moron.

Could this be fixed in bash and the kernel?

[Admiral Burrito]

It might be wise for Bash and other script interpreters to refuse to execute scripts that are in any way writable by other users. You almost never want to do that; it's a security problem by its very nature. This would incur some additional overhead of having to stat the file and its parent directories up to /, but those inodes probably have to be read anyway as part of the normal unix permissions system.

A similar check could be added to the kernel, for regular executables (binaries and #! scripts).

Of course, it should be possible to selectively turn this off for those special cases when you really do trust the other user.

Typical /. mentality

[Anonymous Coward]

1) Clueless git reads article and doesn't understand it
2) Same git submits article to /. with a stupid summary
3) Clueless /. editor approves article
4) /.ers with a brain realize that summary is nonsense, and proceed to trash it.

Not that OS/X and Safari won't "autoplay" ...

[Anonymous Coward]

According to my roommate, he can build a several-layer object (a compressed image of ... [I'll ommit the rest in the name of public decency]) that Safari will "autoplay" if browsed to / downloaded.

So while this *is* just a script, it is *also* somethign that could easily be turned into more of an exploit than the poh-poo-ers are blowing it off to be...

But that's just a "rumor" even if I've seen it done.

nope, GUI is not sudo

[Anonymous Coward]

specifically to deal with this type of vulnerability and to get rid of the 5 minute window the GUI does not touch sudo.

-theed

Re:nope, GUI is not sudo

[Bishop]

Thank you. This is good to know.

Immune to viruses - I think not.

[paperclip2003]

I can remember a time (circa late 80's) when Macintosh viruses were more common then they are now. This was mainly due to the fact that the Macintosh was a much more popular and common computer. One virus I remember that was very nasty used to write itself to boot blocks on floppy disks and every Mac you inserted the disk in would be infected, and the infected Macintosh would infect every floppy disk in turn. The virus would keep itself running in the clock memory of the Macintosh and delete and corrupt files at random. I remember it wiped out all of the Macintosh Computers in a high school lab. It came back numerous times .. destroying files at random. This was long before there was Windows and the PC as we know it. (hopefully I got that correct .. it has been a while) Now.. people think that just because I virus can't run as root, it doesn't do any damage. Well, here is the problem with that thinking: Say I have 100 document files in my home directory -- virus X comes along and deletes all those files but leaves my OS intact... I lost my files... (It did not have to run a delete of my files as root ) Another thing that I think is funny: It would not be to hard for a good programmer to exploit code in modern operating systems because of the millions of daemons and services that are running. Hell, any one of them that has 1 little security flaw is an open door. That goes for Windows, BSD, Linux, Mac OS ... any modern OS with a billion lines of code and 100 different services running. It is a matter of statistics.. the more lines of code... the more flaws... the more flaws .. the more hacks... the more back doors... the more viruses... Windows of course has two things working against it. First it has a bad design from a functional perspective (bad design makes it an easier target) Also it is a target for political reasons (It is cool to hate "big" "bad" Gates). Many people hack Windows because they hate Microsoft. Apple is the underdog currently, so people don't have it out for Mac. When Apple squeezes more than 10% of the total computers out there; then you will see a lot more viruses. Most of them may not kill your OS, but most will kill your files (Keep copies of everything important). As Apple gains more market share, by default you will have more Apple haters. Again a numbers game. If more people hate Apple then more people will write viruses to attack Macintosh computers. With all that said my only point is as a Mac OS and Linux user -- you should keep copies of important files. I think a good analogy would be "Just because you have never had a car accident, doesn't mean you won't have one." This is not a holy war, it is a damn computer. It is like two friends once talking about what is faster ... the Millenium Falcon or the USS Enterprise? "My Macintosh can run Photoshop 1% faster and you can lick the icons" -- "Oh yeah, I can run Microsoft Word 2% faster in XP then it does on your Mac and you can lick the keyboard after I pressed the ctrl-alt-del 100 times" Ron Stoddard

Re:Immune to viruses - I think not.

[Ilgaz]

If you remember lamers coding viruses are already slashdot reading geeks...

And if you remember companies like Intego alerting about potential vulnerabilities called "french thieves", "snake oil sellers".

It will be real soon we see a real OS X virus.

If I was a virus coding lamer, I'd target os x first. "The invincible OS (!) got infected", imagine the lamer brag value of it...

Anyways, OS X is a supero OS, people paying $2000+ to G5'es and giving up PC are stupid to expect viruses etc.

Re:Dear Dumbass

[Anonymous Coward]

whether or not root access is required to install a startupitem is largely dependant on how tight the permissions are on the boot volume. if the mac has more than one boot volume then there is a section in the get info window to "ignore permissions on this volume". any joker can then install the script on that secondary volume and once someone restarts from that volume the script runs and infects the first volume regardless of its permissions or what level of access the joker had to begin with.

once the script is installed in startupitems os x runs it at startup as root and thus root is running the script or you might say the script has root privileges should i keep saying this different ways? why not. if the script manages to get into startupitems on any startupvolume that is later booted from then game over man, you are owned.

Re:lemme sum this up for the non-technicial people

[Anonymous Coward]

riiiiiiiiight and then the average hacker would say...

not if I'm driving a tow-truck or not if i have a slim jim and a dent puller... or a brick and a screwdriver.

Re:Dear Dumbass

[Anonymous Coward]

Ooooh if it copies itself to other startups and it gets on a machine in a Mac service dept it could spread fast...

Days are over?

[edstromp]

No way are the days over. Even if this proves to be real, we can *still* say that Mac's have had *only one* virus in the last three years of OS X. "Virus free" is nice, but I personally think that "one virus in 3 years" is a heck of a lot better than what Microsoft can offer.

Stupid is stupid does.

[Anonymous Coward]

There is no perfect system. If the operator of the system is stupid then there is no absolute system that will prevent every situation. The Mac OS 10 system does it best by disabling root access unless you are really know what you are doing which is the best under normal circumstances. But stupid people seems to supercede these "normal" circumstances and kill what ever they touch and not limited to computers.
Stupid people are somewhat like "Death" character in the old game Gauntlet.

who's kidding who?

[Anonymous Coward]

oh come on! this is not a virus or a worm and wtf is up with sophos? did anyone else notice that while all the other posts about this thing are version 2.35 or 2.38 only sophos the "anti" virus company seems to have a VERSION 2.4!!!!!!!!!

for petes sake please dont buy into this b.s. and dont buy sophos products either or creating problems and selling the solutions for them may become the next version of spam.

No viruses on Macs?

[mink]

Since when?
Robert woodhead of Wizardry fame wrote one AV product for use on Macs back in the early/mid 90's (Interferon).
It is true that hardly anyone bothers to write viruses for Apple hardware, but thats is a different thing then there not being any viruses/trojans/worms.

Re:No viruses on Macs?

[Warlock7]

You are, of course, aware that the old viruses, etc were for OS 9 and Apple is using OS X now. The two are not remotely close to each other. That and OS X is safe from being affected by viruses in the emulation environment of OS 9 (Classic).

Re:No viruses on Macs?

[mink]

Yes I am, but the statment I see people make is not "people dont write for OSX", I hear people say "Macs dont have viruses".

Re:No viruses on Macs?

[Warlock7]

Which is, of course, a valid observation. I just have to believe that most are choosing to ignore OS 9 when making those types of generalized statements. Don't you?

They could be much clearer in their statements, but then they'd be as verbose as say, myself. Or you perhaps.

Check out the FUD version of this article.

[Anonymous Coward]

Someone should educate the writer.

http://www.newscientist.com/news/news.jsp?id=ns999 96576

Finally a decent article on Opener

[Pfhreak]

Not that anybody's gonna see this, buried as deeply as it is, but:

http://www.businessweek.com/technology/content/oct 2004/tc20041028_9388_tc056.htm

This article at least has some research behind it. It specifies that Opener isn't a worm, and has no vector to spread. It also does a good job of pointing out that the weak link in Mac OS X security is arrogant users that insist on pretending that Mac OS X is invulnerable.