Ready For the Big Mac Virus?

An anonymous reader writes "The IT security manager of the University of Otago, New Zealand, has been educating his OS X users in security best-practices. According to Mark Borrie, many Mac users believe they were immune to security problems -- a trap many Mac fans seem to have fallen into. He said around 40 percent of the computers at the uni are Macs. "On the security side of things I reckon the Mac community has yet to wake up to security. They think they are immune and typically have this idea that they can do whatever they want on their Macintosh and run what they like," said Borrie. "If I can get our Mac users up to speed and say 'you are not immune' -- so when [the malware] hits, hopefully we will be pretty safe," he said. "We want to be ready for the first big Macintosh virus -- because it will come. Some day, somebody will say 'I am going to create a headline and write a virus for Mac'," said Borrie."

Comments

Question about old Mac Viruses

[nebaz]

I have a question. I was a mac user for several years, but not for the last 10 years or so, and I remember that there were several 'viruses' at the time. What ever became of them? This was all pre wideuse internet, so I think those old viruses spread via floppy, but I'm just wondering. Technically, doesn't Mac OSX have some backward compatibility all the way back to the 680X0 chipset?
What happens to the new Macs if they encounter these old foes?

As someone who supports the Mac professionally...

[Johnny Mnemonic]

it can be tough to avoid complacence, particularly when the solution is an impediment in itself.

I do realize that Macs are not immune; indeed, if they were truly immune, Apple wouldn't have to release periodic security updates. OTOH, Mac are not currently affected.

Someday, they may be. Any potential virus would still have propagation issues--it's not as easy to find another Mac that the infected Mac knows about, as it is for a Wintel to find another Wintel. But on the other hand, getting users to install virus protection is problematic, let alone getting them daily updates. We just don't have the culture of paranoia that Windows IT folk do, and the immediate response infrastructure that could potentially be necessary and is pretty well developed on the Windows side. The tools for such aren't available, or if they are available, they aren't well known; they certainly aren't tested and deployed.

Christ, I'm in the biz and I don't run anti-virus on my own machine; it's not worth the trouble. And I can say that since I've NEVER seen a single virus for OS X. But maybe one day one will come, and it'll find the other Macs on my network via BonJour nee Rendezvous using an exploit that Apple learned of a week ago but hasn't released a patch for yet.

As Jayne says, "that'll be an interesting day."

Re:Where's that power button again?

[AKAImBatman]

No. Executable files are not executable through the Apple GUI. If you try to open a file marked as executable, it simply opens in Textpad. This was one of the more brilliant security moves by Apple, because it means that it is impossible to run anything less than a well formed Mac application. (Which, again, requires a full directory tree, ususally packed into a DMG for distribution. ZIP files work as well, though.)

Trojan executables on OS X

[ThreeDayMonk]

The Mac interface *will not* execute even files that are marked as executable! It will only execute .APP directories, which means that the attacker would need to pack the app into a DMG file, then somehow convince the user to extract and run the file. None of this "mydoc.doc .pif" crap.

Not strictly true. You can do a "mydoc.doc.pif"-style trick on OS X.

I have made a proof-of-concept trojan horse that appears to be a JPEG file, opens a JPEG in Preview, and to the layman appears to be a JPEG file. In fact, it's an Application in the form of a .app directory.

OS X is smart enough to realise that an app called "foo.jpeg.app" is nefarious, and displays its full name. If, however, the first period is replaced with a similar-looking Unicode punctuation character, the OS displays just "foo.jpeg". With a suitable application icon, it looks a lot like a genuine image. (The only obvious difference is the absence of size information under the filename, but I think most people wouldn't notice that.)

Admittedly, you still have to package it as a .dmg or .zip, so it's not as gaping a vulnerability as on Windows.