Slashdot Mirror
First Mac OS X Virus?
bubba451 writes "MacRumors reports on what may be the first virus to affect Mac OS X, disguised as screenshots for the upcoming Mac OS X 10.5 Leopard. From the report: 'The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but was actually a compiled Unix executable in disguise. An initial disassembly reveals evidence that the application is a virus or was designed to give that impression.' The virus is said to also spread via Bonjour instant messaging." Update: 02/17 00:09 GMT by P : This is not a virus, it is a simple Trojan Horse: it requires manual user interaction to launch the executable. See Andrew Welch's dissection.
Glad I just 'switched' to windows ;-)
(fp?)
Sounds more like a trojan to me. But the question is, how in the world did they get it to show up as a JPEG image and still be executable? And does this script do any damage beyond the user's home directory? I.E., does it have some sort of a rootkit? Or does it simply prompt the user for the root/admin/sudo password?
Somebody better wake up Apple and fix this application-looks-like-a-pretty-JPEG icon bug!!
Note the following from http://www.ambrosiasw.com/forums/index.php?showtop ic=102379 :
...and then for most users, you must also enter your Admin password.
You cannot be infected by this unless you do all of the following:
1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file
2) Double-click on the file to decompress it
3) Double-click on the resulting file to "open" it
You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.
Well, of course there's a mac virus now - virus writers have been comfortably writing to the intel platform for years, and now with the processor switch, all the viruses will be very easy to port over :)
Ñ'
How can it be a virus if it is a Trojan?
You have to execute it yourself, and that is why it is _not_ a virus.
Use windows vista. I heard it has zero viruses.
But, I don't think OS X users have too much to worry about yet.
Might be good in a way - to shake some people out of the complacent "OS X is invulnerable" mindset.
Wouldn't shock me if it was written by a software company whose name rhymes with 'pedantic'.
[sig]you really dont want the answers, trust me[/sig]
Back in high school we used to make little mean scripts in Applescript. Since there was no concept of security or multiple users in Mac OS 7 and 8, the script could do all sorts of nasty damage. All you had to do was compile/"save as" a standalone executable application from the Applescript Editor and paste an innocent icon on it. We liked to use the ClarisWorks icon to be extra mean.
Another variant was useful on computers that were proteted with OnGuard or AtEase. Simply make a script that would pop up a dialog box asking for the password. An unknowning teacher would enter the password and the script would exit... leaving behind a log file with the password in it for later use.
Nothing magical about these. Very basic trojan horses.
Come on. MacOSRumors.com on a forum post. Let's not loose our heads and start spreading FUD because of something someone's brother's first cousins next-door neighbor read in a forum post. If you're smart enough not to accept random files and put your admin password in for anything that pops up - this won't be much of an issue.
First, they dump the Power PC chip right before it is announced that they will be able to push it to 6 Ghz, then, they start getting viruses.
Where is your God now Mac users?
(Liked Macs when they still pushed performance over style)
You say you want a revolution....
Before this "Virus" Can do anything on macOS X it should ask for the users password. So if the user is dumb enough to put in his/her password to OPEN a JPEG!! Then his/her password should be posted on /. with the ip of their computer.
Where? I want to see!
I followed the link and found that the file in question was a '.tgz'. So, if someone is dumb enough to download such a file and untar it ... maybe they'll even su into root when it asks them to.
It would be trivial to write such a program for Linux. It would work as long as there was a naive user.
It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.
That should be pretty much any default or out-of-the-box configuration of Mac OS X me thinks. Even on Macs with only one user and no password the machine will generally put up a prompt before making certain changes. Probably even saver if you have a password and multiple user accounts.
The Final Countdown was by Europe, not Bon Jovi.
"Bon Jour" is french for "Hello" or "Good Morning" or something like that.
Thought it said the virus spread via "Bon Jovi." I always thought there had to a reason to come out of retirement... other then the whole singing thing.
This sig isn't original enough, it's time to come up with something witty...
In all the latest releases of OS X, the user will also receive the prompt "You are running for the first time. Are you sure you want to continue?" so that's *four* levels of security the user would have to specifically circumvent to be affected. At some point the responsibility has to reasonably be shifted from Apple to the user... -Kurt
"We can categorically state we have not released man-eating badgers into the area." - UK military spokesman, July 2007
More like a typo of "Bonjour"... French "virus", this is sad.
Looks like a lot of work to just get this thing. Not at all a lazy persons trojan.
I lost my sig...
So, to me the question remains... is there a way to get this (or any other) Mac OS X virus by just connecting a Mac to the Internet and/or surfing websites? Or do these exploits still require the user to manually execute a trojan? I guess I'm curious how automated these Mac OS X "viruses" are.
This is true. I've been much more complacent since I switched. While I'd never type in my Admin password due to a JPEG, I am sure the complacency of which you write might well mean that moany users would, especially as the Mac population grows and statistically includes more silly users.
Looks like a Trojan, not a virus. And any OS (disclosure: I admin a mixed Linux/windows system at work and the wife has a Mac at home) is vulnerable to Trojan attack with varying degrees of user "assistance". Our internet capable machines at work are livecd only for this reason (Slax FWIW). Windows laptops use DSL imbedded (at the moment).
Use protection, browse safely, and the net is a pretty safe place still...
Using plain ol' text since 1968
The first Mac virus hidden cleverly inside a picture of desktop eyecandy. No doubt it will spread like wildfire. Insidious.
What wrapper will the first Linux widespread virus take? "Hey, download this PDF -- it's a transcript of a big IRC shouting match about which is better, emacs or vi! You gotta read this!"
We won't know what hit us...
That may be THE funniest slashdot post ever! I, for one, welcome our executable jpeg masters.
Yeah, I guess I'm funny like that.
Virus != Worm
-- 'The' Lord and Master Bitman On High, Master Of All
Anyone know when the Universal Binary will be avaliable? Plus, we need a "no password" crack.
:(
When will Mac viruses get to the level of Windows when? For godsakes, this one still requires user intervention, and it doesn't even work on all OS X platforms!
Come on Apple! Microsoft has you soundly beaten in this regard
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
I put my Mac on a toilet seat and I got this virus...Really!
Sounds more like a trojan to me.
Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.
I would say (from the description in tfa) that this piece of malware is more similar to a virus then a worm or a trojan.
Why?
1) It appears to self propagate (Trojans do not do this).
2) It appears to attach to other executables (worms are stand alone)
So we have a self-propagating piece of code that attaches itself to other executables. Quacks like a virus if you ask me.
My pics.
http://www.virgin-atlantic.com/
Grrreat... A Unix virus written by someone who probably knows more about Unix than most of the Slashdot crowd has forgotten, and it's targetted at the average non-technical Mac user who thinks that you are supposed to turn a computer off by pressing the power button. ;P (It's a joke folks. Lighten up.)
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
John Gruber on daringfireball.net wrote at length recently about problems with OS X, mainly relating to how the Smart Crash library adds itself to applications through the Input Manager system hook. His current article "Smart Crash Reports Addenda" talks at length about the security implications of the input manager.
It means at least one person at Microsoft still knows how to code.
You have to admit though that many Mac users would like to see Panther pictures, and this is a good way of propagating the trojan.
Panther was 10.3
Tiger is 10.4
Dunno what 10.5 is
Everybody seems so certain that this is a non-starter on OSX because it requires some user intervention to propagate. I have bad news for you: there are clueless Mac users out there, too. These are probably the same folks who will click on a web popup to "see the lastest hollywood gaff" and then "accept" the untrusted executable when windows warns about the download to be executed. And they're the same ones who will dutifully click their bank url in an email and login to make sure their information is correct .
Never understimate the power of the incomptenece of 20% of your userbase.
Is it just my observation, or are there way too many stupid people in the world?
As the Mac user base goes up so will mal-ware. It doesent help that people will be running cracked versions OSX on Windows boxes.
I tried to create an application that had a name of test.jpg.app and was pleased to find that, at least in Mac OS X 10.4.5, when you try to do this, the Finder displays the entire name, including the entire extension ".jpg.app", even though normally the ".app" portion is hidden. Take out the ".jpg" and the ".app" goes missing again. The "hide extension" option in the get info window is disabled when you have a name like ".jpg.app". So, it isn't quite so easy to disguise an application as a jpeg in Mac OS X. Of course not everyone is going to know what the .app means and so it being visible won't help them. Then again, if that's the case, they probably don't know what the .jpg means either!
.term file, which was set to hide the extension. When I made the name test.jpg.term, the full name was displayed including ".term", and the "hide extension" option was disabled.
I also tried doing this with a
--- What?
Hey User, Read and Do The Following:
Bonjour is a good implementation of zeroconf and will be one of the ways forward for making networking transparent in the future. However, at this stage in its development it still seems to me to be insecure and experimental in its wide area applications, perhaps more in its undiscovered potential than its current abilities. I suspect that to make it secure it's going to need a whole new level of content based security. I hope someone takes at Apple takes this as a warning. Oh soryy, what am I saying?
I had to change my signature because of this. :-/
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
OSX should be written together, not OS X. The title can be read "First OS vs virus?". We know this battle is already lost.
======
Am I new here?
YHL GBTW
If I write:
/User/Home'....
#include
main()
{
(void) printf("Hello World\n");
return (0);
}
and also included a couple lines to 'rm -rf
Then I e-mailed or IM'd a person the executable, then asked them to decompress it, double-click on it, and laugh, that would be Mac OS X's first virus/trojan? Ohh wait, I need to associate a pretty icon to it too.....
As much as this author would like to claim they are the first, I think the programmers at Apple were the first ones to do this with their "Disk Utility" that a user has to click on to 'newfs' or your Windows users 'format' your hard drive.
I can not believe this made Slashdot....
well if this is the only viri i need to worry about I am glad i use Mac OS X. How many viri does windows collect in only one month ? ....
so, having "windows_vista_final_screenshots.zip" that woul contain executable with some icon would a virus, too ?
what about "kde_4_screenshots.tgz" with similar payload as this one ?
(note that there is no way to run the executable automatically and, it seems that it is not self-propogating in any way)
Rich
1. Denial and isolation
2. Anger
3. Bargaining
4. Depression
5. Acceptance
I think with the appropriate counseling, the MacOSRumors.com community will be just fine.
Insert simplistic political, ideological, or personal proselytization here.
#!/bin/sh rm -rf /
Check populicio.us
Mac OS X: 1 Windows XP: 4,234,278,247,295 and counting Yup, now that OS X isn't secure, we'd better migrate back to Windows!
games journalism blog
Even in the realm of OS X, is this exploit really all that new or exciting? Not having gotten my hands on a copy of this, I don't know how it works, but it seems similar to the proof-of-concept from nearly two years ago, which exploited issues in the Finder with handling file extensions vs. type/creator codes (IIRC, the proof was an application with type code 'APPL' and extension .mp3, which made the Finder display it as an MP3 but treat it as an application when clicked).
Apple made it so that the .app extension cannot be hidden, and so that one is warned before running any application for the first time, probably as a direct result of the mp3 trojan. A user being allowed to execute code he chooses to may be a vulnerability, but is isn't one to be "fixed."
English is easier said than done.
whats next viruses spread by gps satelites ?
Say hello to my little sig.
You cannot be infected by this unless you do all of the following:
...and then for most users, you must also forget to put on the "protector".
1) Are somehow hooked-up with or bringing home the "infected chick"
2) Un-click the bra strap and pants button to en-naked the chick
3) Insert dong into resulting hole to "fill" it
You cannot simply "catch" the virus. Even if you do bring home the "infected chick", you cannot be infected unless you expose the hole, and then fill it.
Step 1. Command-click on a jpeg file and select Get Info.
.app file and select Get Info.
Step 2. Click on the jpeg icon in the top corner, then select Edit > Copy from the Finder menu.
Step 3. Command-click on a
Step 4. Click on the application's icon, then select Edit > Paste from the Finder menu.
Step 5. ???
Step 6. PROFIT!
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
A) New variant of that.
B) If this IS a dupe that means that the virus has duplicated and spread!
Non impediti ratione cogitationus.
Come on. The parent post is a joke, not provocative in any way. Use +1 funny or -1 overrated mods, not troll or flamebait.
Sorry, but the type of exploits we really fear (remote arbitrary code execution) ARE platform specific. One of the reasons I use a PPC as my gateway instead of an X86 is because on the off chance I am running a service with a vulnerability, the attackers will most likely overflow my buffers with X86 code that won't execute on my box.
Could the hacker just as easily change to PPC and attack me just as hard? Yes, but most don't.
Whe you take advantage of a buffer overflow, you're injecting machine code or bytecode into an unchecked buffer, overwriting the next piece of executable code in memory. The payload for this type of attack IS platform specific, unless you're attacking a bytecode-interpreting machine, line the JavA VM.
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
I happen to be in the camp that says "Show me a virus on OS X". It's debatable if this is a virus or a Trojan, but in some ways it would be nice to just get a virus and be done with it. Then all the neigh-sayers can jump up and down in Glee saying "I told you...I told you...nananana"...I can then ignore them finally and get back to using a my Mac, a system that even if one virus/trojan is found is STILL a better more secure system than windows.
What OS and App manucfacturers CAN do is make it harder to inadvertently run such programs. Saving files from the net in a non-executable directory tree would be a good start. Setting up apps that might be exposed to hostile behavior to run as another user and making sure that the user they run as can't access anything useful, run servers or open outbound connections would be another.
I think users are getting more savvy about security, too. Complacency on Windows systems can cost you, and users are becoming increasingly aware that Microsoft isn't going to protect them. Maybe sometime around September 6000, 1993 it might finally become October. Maybe Sepember 7000...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Um, no. The offical title has a space between OS and X.
Suggest you take a look at a definitive source. Perhaps http://www.apple.com/ would be acceptable to you. Take a look at the top right tab. If that doesn't convince you, click on that tab.
Personally I don't care which you use, but if you're going to go around correcting folks, it pays to check your facts first.
Mmm, delicious! Pass the kitten gravy, please.
The Independent: Reverend Spooner Arrested in Friar Tuck Incident - ISIHAC, Historical Headlines
Thanks for your keen insight.
A file that 'looks' like a jpg, that, upon clicking asks for your admin password is not a virus. It's still quite dangerous, but it looks like a trojan or a script of some kind.
There is no OS that can protect from user stupidity - whether it's Linux, OS X or Windows.
*** For a better tommorow, change your life today ***
ahh hell, I'm still waiting on Bon Scott messaging. You know it'd be a helluvah lot cooler.
And a whole bunch of other file display changes; icons don't help me as much as created date, file type, etc.
Anyway. This was a useful post.
You better watch out, there may be dogs about . .
What's with you guys. Next thing I'll find is the dupe.
So, why allow customization of icons?
Because Mac users expect it. The feature was present in versions 7 through 9 of the operating system, and apps often wrote a thumbnail into the custom icon.
That's a totally legitimate question.
If you choose "View as List" in the finder (equivalent to the Detail view in Windows), and then expand the window so that you can see the "Kind" column, the Finder will tell you the kind of file you're looking at. For example, Application, Picture, Document, etc.
The Finder looks at some stuff which is not visible to the user in determining this -- in addition to the ".app" file extension on Cocoa bundles, there are also the traditional Mac 'Type' and 'Creator' codes, stored in the file metadata in the resource fork. By setting a file's Type to "APPL," it becomes an executable. This is the traditional Macintosh analog to the UNIX eXecute bit (but arguably more flexible, since it also handles file typing), and is totally independent of the file name. But anything that you set this way will be clearly marked as an Application in List View, regardless of what you name it, or what kind of custom icon it has.
This is how the MP3Concept trojan worked, and how many old-school ResEdit tricks worked. You can have something that's legitimately named "Mp3Concept.mp3" and looks like an MP3 but is really an executable, by setting the Type and custom icons correctly. It's nothing new, people have been doing it for years. (There were a lot of ResEdit "hacks" that worked off of this principle -- for example, creating a dummy Excel document that gave a rude dialog when double-clicked.) I think it's because we've migrated away from OS 9 and the metadata concepts that people have forgotten how easy it is to do, and that the Mac still supports it.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Except that the product name is OS X
No, the product name is Mac OS X.
Face it trollboy: if you would have done some more effort to see how it works, you would see from your own quoted definitions that this is not a virus. A virus spreads between different computers without any user interaction. However, this thing is only able to send the fake JPEG file to other computers via a few IM programs. The users on those other computers still need to be online, accept the file, and open it themselves to 'install' it. Therefore it is a trojan. Only within the limits of a single computer it could be considered a virus, because it can copy itself automatically to other programs upon opening an infected one (provided that the user who opens it has enough privileges to modify programs).
... why did they use the "all or nothing" approach of requiring the admin password to install some things? Why not introduce a new model where everything in the filesystem is an object of one of the following types:
- operating system
- hardware
- hardware configuration
- program
- program configuration
- interface configuration
- data
Have the option of using different passwords for access to operating system, hardware, and program objects. When you run a program installer, it wouldn't be able to mess with your hardware or OS that way. The admin password would basically never be needed unless you were doing OS updates.
Oh, and the most obvious thing, you'd have to also look for the resource fork's Type code that's used on Carbon apps, and flag it as executable if the Type was APPL.
(See my other comments in this discussion -- this is how MP3Concept works, and the Type code is the traditional, pre-OSX Mac analog to the UNIX eXecute bit or the Windows/DOS file extension.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
That'd make this the first "Retrosexual Virus".
All of the older unix viruses still work just fine.
Remember the honor system viruses, which informed you that you were now obligated to delete a few files at random and then send the virus on?
hawk
Disregarding the old-school viruses that attached themselves to executables, isn't today's definition of "virus" = "malware that spreads"? If this is spreading through instant messaging, then it's a virus (or, at least as much as a Windows virus is (Windows doesn't have many old-school "attach to executable" viruses either).
If this is merely a trojan, then it's not the first. A couple of years ago there was malware disguised as a pirated version of MacWord 2004 on warez sites.
-- "I never gave these stories much credence." - HAL 9000
There are routines to get the path to a bundle's executable file. It doesn't matter what the extension is, etc. So the Finder can very easily determine whether something is in fact executable. For an example, pop open the Inspector window in the Finder (Cmd-Opt-i) and select a few file. If they're applications, that window will tell you so. If it doesn't say they're an app, the Finder won't even try to launch them. Also, in 10.4.4 upwards, it'll put 'Universal', 'Intel', or 'PowerPC' after the file kind. So, it's not at all difficult to have the Finder flag executable files with a badge.
-Q
Social Engineering Always Works.
This is not a security hole in the OS, this is a social engineering attack, just like every previous "first OS X virus" has been.
Social engineering works, BUT for most people it doesn't work very often. Once is usually enough... UNLESS the system trains them to click "OK" when presented with a security dialog. If you can keep it from working a second time, you'll kill this kind of attack dead.
I've had the same people come to me many times and say "Peter, I think I have a virus, I clicked 'OK' again". I've never had someone come to me and say "Peter, I saved a file and opened it and I think I have a virus" more than once. Because when you download a file, there's no urgency, you don't have to decide RIGHT THEN whether to go on with it. You can stop and wait, and no reflex loop develops. And that pause, even if it's brief, is more than enough for most people to get out of the "open everything anyway" habit.
In Safari, TURN OFF "OPEN SAFE FILES AFTER DOWNLOAD". There are NO "safe" files that are guaranteed to be safe.
In instant messaging, don't use an application that doesn't give you the ability to completely disable automatic execution (with or without a dialog) of downloaded files.
Back when social engineering was the virus vector, and you had to actually save a file to disk and open it as a separate action, viruses spread slowly. When Microsoft integrated IE and the desktop and allowed automatic execution of untrusted content, THAT is when they took off. And the biggest problem with Microsoft setting such a low bar is that people accept a slightly higher bar (a dialog box) as OK, EVEN WHEN THAT IS PROVEN INADEQUATE.
Users: Don't automatically open files.
ALWAYS save them to disk, and run them by hand, later.
Developers: Don't give users an option to bypass this step.
I've been saying that dialog boxes asking "DO YOU WANT TO DO THIS STUPID THING" were a stupid idea since before Safari was created.
And I've been saying this was a problem in Safari since it's existed.
Users: TURN OFF "OPEN SAFE FILES AFTER DOWNLOADING"
Apple: TAKE THAT OPTION OUT OF SAFARI.
No application that displays untrusted content should EVER have an option to open files automatically after downloading. No matter whether it thinks they're safe or not. No matter whether you pop up an "I'M ABOUT TO DO A STUPID THING, IS THIS OK?" dialog first. Don't do the stupid thing.
Downloaded files should be dropped in the user's download folder, and left there for the user to take care of or not at their leisure.
CDROMs and USB keys and other external storage should be mounted, and made available to the user, but NEVER EVER auto-run.
Files outside specific "application" or "plugin" locations should never be considered as potential handlers for content, and there must be no mechanism to move files to these locations without an EXPLICIT request by the user.
(yes, that means no auto-installing Dashboard plugins or Firefox extensions... and of course ActiveX is beyond the pale)
I've been trying to make this point to developers and software publishers for at least seven years now, but they're all following Microsoft like lemmings. I've sent in bug reports, suggestions, and made personal requests to people at Apple asking them to back away from the edge before they go over. But... no...
Apple: I TOLD YOU SO.
Everyone else: TURN OFF OPEN SAFE FILES AFTER DOWNLOADING. DON'T USE APPLICATIONS THAT DON'T LET YOU DISABLE AUTO EXECUTE. That means Internet Explorer, Outlook, AIM, anything else that will run untrusted content without you explicitly pointing at a file and saying "OK, I've downloaded this, run it".
Why not mark every executable from external sources as not-trusted? And when an untrusted executable is executed a dialog should be presented.
Surprised nobody has said it yet, but who uses Bon Jour? I've never even heard of it. iChat or Fire for me. I know this problem is not Bon Jour specific, but like lots have said, Safari will ask when an executable is being received via download. We all know IM is susceptible, and we all know OSX is not bulletproof. Use common sense and move along, nothing to see here.
Disclaimer: I write network management software for Mac OS X; I have therefore seen a fair bit of what can happen with mis-configured system folders
I'd advise you not to change permissions on /Library, or at least please don't do it recursively. You're asking for pain there. /Library/Application Services, /Library/Caches, /Library/Frameworks are supposed to be writable by administrators.
The reason your root library folder is writable by members of the Admin group is because that's what it's for. There's /System/Library, which is owned by root/wheel. There's /Library, which is where the machine's administrator can install things for all other users, and there's ~/Library where any user can write their own things into their own personal space.
The reason the root one is writable by admins is simply because that's the place where admins (which are, you know, admins for a reason) can write things. Things like all the fonts installed by Macromedia Flash. Things like all the project templates, SCM, Design, WebObjectsGUI plugins for Xcode. Things like InterfaceBuilder palettes. Things like Adobe fonts, SVG viewer resources, color profiles. You know, thing used by all users of the machine. But which a machine administrator can change or remove. That's kinda the point of the Admin group.
Also, please take note that the sticky bit is set on the Library folder. So you'll need to chmod 1775 /Library. Oh, and I hope you're prepared for some stuff to stop working, because it quite likely will. I've seen whata happens when people decide to arbitrarily make most of the system writable only by their One True User (whoever that may be). I then get many tech support calls where we try to figure out why my software is making all their software stop working. It then transpires that their software just doesn't have permission to access the disk, and just can't install things, use caches, etc. Or it's using a home folder -- mounted from a remote server -- for all that, and is therefore taking *ages* since another fifty people are doing the same thing.
At the end of the day, there probably is an argument for not letting Admin account create folders within the /Library folder, so for example only root can create the InputManagers folder. That would be the same as the StartupItems thing, and it's likely what Apple will do. But don't apply those rules to Application Support and suchlike. It'll hurt, believe me.
-Q
Mac users don't use their power buttons to shut down their computers. The power button puts the computer to sleep.
PS What do you mean by "turn a computer off"...is that like a "restart"
I wonder if it would make sense for MacOSX (And user-oriented Linux distributions?) to keep all binaries and libraries etc. (i.e. not /home) normally read-only (unless you are in the middle of uninstalling/upgrading of course). (I know that some people keep servers and "appliance" type systems like this already). Until now, this kind of trojan has been localized and rare, but with the popularity of OSX, this one could be a turning point.
Anyone want to make a hack of dpkg to try this on Debian?
My password is "password" and my IP address is 192.168.1.100.
Do your worst!
I wonder if it would make sense for MacOSX (And user-oriented Linux distributions?) to keep all binaries and libraries etc. (i.e. not /home) normally read-only (unless you are in the middle of uninstalling/upgrading of course).
They do. Normal users have no write access to system directories, the installation process runs as a privileged user that has write access. The thing is, you don't need write access to system directories to launch malware, or have it auto-executed when you log in... there's plenty of places for it to hide in your home directory in any system...
http://www.sophos.com/pressoffice/news/articles/20 06/02/macosxleap.html
Is this the same?
They say it's a worm...
"The test of the morality of a society is what it does for it's children." -Dietrich Bonhoeffer
Malware doesn't need privileged access to find a hiding place.
When I was at Berkeley in 1978 people were already putting trap files in their home directories to catch people snooping around and do nasty stuff to the intruder's accounts, including hiding backdoors in their login scripts... and this was on Version 6 UNIX, a system so primitive the shell didn't even have native flow control built in.
Restricting the scope of malware by restricting user privileges is great, it gives you an easier recovery path, but it's not a panacea.
First, let me say that human stupidity is how the vast majority of malware spreads, and can generally be relied upon. It's one of those, ya know...universal constants. As Einstein said: "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." Moreover, if Apple picks up marketshare, especially with iMacs (e.g. more of a consumer level product), as it could be poised to do with the Intel deals struck, the average level of user savvy will drop. So stupidity can be relied upon to increase. Especially since knowledgable users are more wary of Intel procs in general (though the mobile chips are somewhat excepted here). However, it is, as you imply, worthy of note that it doesn't exploit security holes.
/. mightn't have had something to do with this, what with the article that appeared a month ago. Sort of a proof of concept challenge, if you will.
Anyway, I can't help but idly wonder if
This is not a virus. It's not self-replicating. Implant this very helpul link's information into your brain, so we can finally understand WTF the difference is between virii/trojans/worms.
Take the advice from one of the 'top' companies in AV protection.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Look, we know technically it is not a virus; but I have to say "Welcome to the world." All these things get labeled as a virus. The PC world faught that for years, but ultimatly the media has won. Mostly because people don't care. All they care about is that it is impacting their machine and they want it fixed.
It's like when someone starter goes ut in their car. They don't want a 20 minutes lecture on why, they just want to know how much it costs, and how soon it will be ready.
The Kruger Dunning explains most post on
This exploit is actually an example of a very old idea. A proof of concept can be found in this followup article from March 2004 (the link to the original article is already dead and buried), which also mentiones the need to visually identify executable files.
The Hacker's Guide To The Kernel: Don't panic()!
It's a perty poor virus. The OS puts up a dialog box stating that there is an executable program inside and asks you to type in the Admin password and click OK to run it. A user would need to be "way stupid" to do that when he thought he was just going to look at aJPG image file. Needless to say this "virus" did not get very far ad no one knows of any damage caused by it.
This article gives a lot of good points in a short amount of time.
/home directory and destroys your data. Unix still runs, no downtime, start again. Really only the recent Karma Sutra virus goes around and destroys data. Most act as zombie drones.
/home(user done). It doesn't destroy your computer but installs as a .bashrc line to execute in some common User priveldged library. Now, to us we might see that the file was modified or that there is a file that we didn't install hidden in our home directory. But really, who here knows whats in .firefox/default/aso8zx9mawmSOI/ ? I sure as hell don't. And there has to be some GUI linux programs that run background command lines so you know .bashrc will be executed. So the .css files that are in .firefox/default/aso8zx9mawmSOI/, name your virus chrome_main.css. When was the last time you checked that folder for executables?
/Library and I normally don't fool around with it. Or even /bin/gnuc and if you execute it without the proper switch it just prints out 'The program cannot be executed in the terminal, It must be called from another program'.
/random/directory that is known to have write access to all users. This is where a virus can lay around and execute.
The jist of it is that *nix IS more secure. There is no doubt about it. But Social Engineering and other things of the great modern email scams can still penetrate in and run.
But I guess that goes without saying. The chain is only as strong as your weakest link and the computer system is only as secure as its stupidest user.
This wasn't discussed. All the article talks about is a virus that comes into your
But imagine this. A computer virus comes in your system and runs in your
Especially in an OSX enviroment where the users are tricked to believe that the system is secure. As a unix system it might never get any worms or other propigating viruses embedded deep into the system but there are still a ton of stupid users.
You can even imagine it being smart enough to update itself IF a OSX vulnerablility is known and then elevate itself to root and install deeper into the OS. I have no clue whats in
Either case good short read.( i think my comments are almost longer) No matter how good we think we are at knowing our systems there is someone who knows we don't look in
> Apple made it so that the .app extension cannot be hidden
/Applications folder have the '.app' extension visible (but the extension is there).
What? None of the applications in my
You're wasting your day coming up with solutions for an OS you don't own, don't maintain, and have no control over.
You're such idiots. No wonder slashdot has such a crappy reputation. It's full of morons who think they're brilliant.
Definition of a virus from wikipedia: In computer security technology, a virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. This virus does these things. It replicates itself into other executable code or documents. It spreads itself via iChat to your contacts. Arguing that it isn't a virus because someone has to do something to activate it shows a good level of cluelessness. Hint - look up the definition for 'worm'. Perhaps that's what you're thinking of. Those who are calling it a Trojan are even further off the mark. Trojans don't spread themselves. Sorry, you're wrong. Try again later.
If instead of failing to do something to Fire.app, the trojan had scurried through the Mac OS X address book, and then sent the file as an attachment in an email to all your contacts, and some of them had opened the attachment, etc. and so it had propogated like that, then would the Mac zealots admit there was a problem then?
My main question is - what actually causes the admin authentication dialog to open? Is it just the fact that you're trying to run a program that Mac OS X hasn't seen before? If not, then would trying to open a TCP/IP socket (e.g. to a mail server) cause the user to have to authenticate as admin? If not, then this seems like a lucky escape to me - this could have spread quite widely amongst Mac users.
Btw, Windows has a system for marking EXEs as untrusted (in some way - using a special stream, iirc) - IE and FF do this, I believe. So the first time you try to run the EXE, Windows asks if you're sure, and explains why. Does Mac OS X do this? Is this why the admin dialog appears?
Enquiring minds want to know. :-)
(BTW, anyone claiming Mac users wouldn't fall for social engineering in the first place needs to get a grip)
I just realized how amrt it is of Apple to ship iPhoto with new consumer macs.
See, if a trojoan like this comes along with something unpleasant really novice users will try to move it into iPhoto - which will just say "sorry, that's not an image".
More advanced users that would just try and open an image in Preview would say "Opening an image file and it asks for my password? No thank you sir!".
Which is why this trojan has not really spread, or really affected many computers.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This story is the biggest FUD of the day.
.tgz file in Safari, Safari warns you that it's an application, and you have to click to continue.
1.) Several proof-of-concept viruses have been written for OS X in the past, so this isn't the "first." They never propagate.
2.) When you download this
3.) When you run it, an admin password prompt is displayed by OS X, and you have to enter it to continue.
Like I said--FUD of the day.
"Sufferin' succotash."
It can work as a shell script too.
For example:
http://srmail.net/cool.dmg
TriRus or a VoJan...
Well, then, if the user is careless enough to provide the admin password for one of these "concept gone wild" pieces of code, then at SOME point is no longer is the case of:
"The executable never actually crashes any part of the OS to gain control of the OS and do something that the user doesn't authorize."
It probably won't need to 'crash' the os, but it'll have free reign to run, or worse, free run to reign OVER your system (hmm, think I just coined a cool phrase...).
Who cares that it "doesn't authorize" before hand? Isn't the worm/virus/trojan going to get access?
I think one way to deal with this is to make the OS provide the user or admin the option to "chunkify" the task so that an operation that is wide in scope and deep in penetration has to "hit up against" an execution firewall. Meaning: intense processes could be made to be "stopped" or "interrupted" to help contain SOME of the damage. A process could be divided into, say, 10ths, and the user hast to SIT there. Most of us are sitting there, anyway. If it's a short process, then clicking yes 10 times to some rogue or new app could be disguised by making the OS show some OS-useful/informative admin/user-needed material. If it's a LONG process, then most likely this will slow down the admins and FORCE them to THINK about what they're going to be implementing.
Just some ideas. Don't know if parallels already exist. So, not claiming anything new or novel, except my "free reign to run/free run to reign"
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
I have not installed brand new, never before run software on my Mac lately - too busy trying to get my work done. But I seem to recall that the very first time an application is run, a dialog pops open and asks you if you want to run it. Is that correct, or am I imaging things?
you would see from your own quoted definitions that this is not a virus.
lol no its not a virusWELL PLAYED, SIR!
I don't see how this can be called a virus. The last time I remember a virus uses some type of exploit either with a system process or 3rd party application which is granted administration privilages without the user knowning. If this so called virus comes up asking with a password to me it's nothing more than a simple little script made by an amature. You can do this with Applescript as well. Last time I checked a trojan does not replicate itself. A virus does but this is by far not a virus more like a pitiful excuse for one at least.
"Once the media gets a hold of a blanket term, we're stuck with it. Yes, it's technically a trojan. But nowadays malware that's not adware gets lumped into the virus category. Take a look at the term "hacker." "Cracker" would be the preferred term for a bad hacker, but the media still uses "hacker.""
Hacker has always been the correct term since the 80's. Only recently have people unsuccessfully tried to make up a new word, and change the meaning. Msiusing the word virus is a different matter, but this thing self-propogates so it's more than just a trojan
To all the purists out there who can't resist piping up with "It's not a virus - it's a trojan":
It's a useless distinction to say that trojans are not viruses because they require user intervention.
Would you go around saying that gonorrhoea is not a true disease because you have to do something voluntarily to get it?
Trojans are a CLASS of virus.
Apple: Apple to 'Switch' to Windows?
/ 1826257
http://apple.slashdot.org/article.pl?sid=06/02/16
WOW!
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
The hardware isn't _that_ much better than what you can buy in the Windows world.
Depending on the market you're looking at it's not that much better but that much cheaper/easier. Try finding a decent entry-level notebook guaranteed to run a unixoid OS. You have the Thinkpad, but IBM/Lenovo charges even more for the name tag than Apple does. Then you have... various laptops that might or might not work (and usually won't completely). And you have the iBook, a notebook known for it's robustness and for an OS actually worth paying a premium for, which also happens to weigh less than the usual notebook. And come with a usable 3D card. Not to mention the decent price. And the fact that you can choose the size of your mainboard/RAM/etc. when buying from Apple's online store. With no shipping costs. And did I mention the fact that students get a price cut?
If you want a cheap notebook that runs something besides Windows Apple makes a _very_ good offer. I hope that the iBook stays the same with the switch to Intel (cheap, light and silent with decent battery life that is).
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
a Symantec or McAffee employee. Anyone want to place bets ? ;-)
I'm pretty sure I'm kidding...
sudo rm -rf
A really nasty one too. Naturally, you'll need to enter your admin password to operate it... but that's the rule for Mac viruses, after all.
Buy Text Processing in Python
Where Mac OS, Windows and all the rest fail is that they don't enforce strong visual cues for executables.
I have said this before: Superimpose all representations of executables with a red circle or red border, and these trojans will become an endangered species!
Stop confusing data and code in the minds of users!
This is more social engineering rather than finding a security hole:
.app extension would let everyone know this is an app and not a picture.
* Claims to be a file of interest. Usually picture of a hot nekkid girl. This is for Mac Geeks, so it's a picture of a hot screen shot of the next OS.
* Pasted a copy of the JPEG icon onto the app. Could happen in any OS.
* You'll be asked for the SysAdmin password in order to "view" this JPEG. Some users may get suspicious about that, others will blindly type it in.
* Again, shows that hiding extensions is not a good idea. If extensions are shown, the
=======
This is a problem much in the same light like the email phishing scams. I'd like to see a mask applied to executable icons, so that looking at an icon will let you know if its a program or not -- even if the developer attempts to make you think the file is benign by pasting over another icon on top of it. The mask will let you know it's really an executable.
The other is user education. Users should know that viewing a JPEG shouldn't require the System Administrator's password.
> The resultant file decompresses into what appears to be a standard JPEG icon in
> Mac OS X but was actually a compiled Unix executable in disguise.
Sounds like a Trojan to me. Does it attach itself to other executables? How would it do that on OS X, without admin privs? Trojans for Unix are of course possible and have been around since, to a first approximation, the beginning of time (i.e., 1970). What makes this news? Is this one spreading quite a bit, or something?
Cut that out, or I will ship you to Norilsk in a box.
The user first has to request that the file be downloaded, then Safari will ask if the user would like to open it, then the app is decompressed and launched, then the Finder alerts them that this is a new app being run and asks for verification to do so, then the app asks for the user's password, then the app is executed.
... 8 years now since Microsoft introduced this kind of misbehaviour with Active Desktop.
Aha, so the people saying it's not a dialog box are being misleading.
It's two dialog boxes.
It doesn't matter if it was three dialog boxes, it's the same reflex action. In fact in more recent versions of Internet Explorer you do get multiple dialog boxes that have to be OKed for some files, and people do repeatedly check yes. Because 99.9% of the time "yes" is the normal response, and an unexpected "yes" is no different.
How would it be better if Safari just dumped the downloaded file into the user's download directory so they had to go double-click it from there to start the same sequence of events?
Fewer would get caught once. Almost none would get caught twice. This is what I've observed with hundreds of users over the
It doesn't matter how many levels of "OK" are involved. Clicking on a link is routine, clicking the "OK" that comes up after many links are clicked on is routine. Having any kind of break in the pattern between downloading and explicitly opening a jpg file instead of having it just show up in the browser? That's an exception.
It makes a real difference
Viruses need to a) spread by themselves and b) infect applications. Worms only need to spread. Trojans need to do neither, they're simply apps disguising as something else.
The application in question is a Trojan and possibly a Worm (depending on whether the spreading actually works). Certainly not a virus.
Actually, this is just Apple's way of making up to a long lost son. You see, many years ago, Apple and Windows 3.1 got drunk at a party and one thing lead to another...
Nine months later, the bastard child of Windows 3.1 was born to much acclaim--with a red-faced DOS wondering why on earth is own child looked so little like him. Well, it's been a few years, and that son's faithful parents have both passed away. After several years drifting between orphanages and foster homes, Apple opened the local paper to find a picture of the bastard son he had nearly forgotten.
This adoption is Apples way of righting what went wrong and maybe, just maybe, giving this poor child a future full of hope and promise.
In April, 2004, CNN reported on the exact same type of trojan that used an MP3 file extension.
Also, there is no confirmation that this screenshot propogates itself, and it definately does NOT self-execute.
No Big Deal.
Well, here's the thing - there are no one-button mice for Windows PCs, so there's no need to hold down a modifier key. Having two button mice right out of the box is far more convenient than control-clicking any day.
I've used every version of Windows, and the first Mac I used was a 128k back in the 1980s. When I got a G4 Powerbook I was frustrated by the lack of a right-click button - OS X is clearly designed in such a way that the machine needs to have one for more than the most casual use. Right clicking makes any number of common tasks faster and easier (copying and pasting for example, both of which can be done by right clicking in OS X as well as Windows)
I recently got a Powermac G5 quad and was glad to see the Apple Mighty Mouse in the box, however Apple's first attempt at a mouse that lets you right-click doesn't quite do it - it's as though it was designed by someone who never heard of right-clicking before; in order to right-click you have to remove all of your other fingers from the mouse which just doesn't make sense from a usability standpoint. The side squeeze buttons are great though, and I love the scroll ball. I'm hoping they come out with a software update that will fix the right-clicking.
Putting moderation advice in your
If you are running as an admin-level user, there are things that a trojan like this will wipe have access to ( i.e. everything in your Applications folder ) that would be protected if you were running as a regular, non-admin-group user.
Reading the article, or better yet, the Ambrosia Software write-up of the worm, will give you a clear idea of how an admin-group use is more susceptable to this attack than other users.
That's clearly not a solution.
Putting moderation advice in your
--
"We need an expert in computers"
Thanks to Mark Allan and various other people Clam database now has information about this "whatever you call it" crap.
ClamXAv , a Cocoa GUI for opensource Clam engine which makes it accessible to majority of OS X users can detect it:
http://www.clamxav.com/
It is free (donation) ware.
I think it also means that the users of ISPs/Corparate Networks using Clam engine to detect viruses won't get it via mail attachment too.
Oh wait, what? Nobody ported the honor system virus to Mac OS X?
You just got troll'd!
I can't believe they updated to say it wasn't one. A virus is just a program that infects other files with itself. A worm is a program that spreads itself using internt connections directly. This program does both of those. Just because it requires the user to run it, doesn't mean it isn't one.
I'm sick of people who don't know what these terms mean flashing them around. It's a trojan if it doesn't try to spread itself, this does.
Most windows viruses/worms require the user to execute it manually. In fact, that's 99% of DOS viruses, are you saying most past viruses are just trojans? How do you think those spread? Someone inserts a disk with an infected program, runs it and it injects itself into other programs on the computer. Those other programs are then spread MANUALLY by the user not knowing that they're infected.
REQUIRING IT TO BE MANUALLY RUN INITIALLY doesn't make it just a trojan.
McAfee and Sophos have both classified this as a worm/virus. STOP BEING MORONS. It's funny that even the people who read the analysis still managed to talk out of their ass about this and deem it just a trojan.
Interestingly enough, you're right. From Ambrosia: It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan
That doesn't work eventually, but it actually does try to infect other applications.
I meant to keep the files at mode 555, or on a read-only filesystem. Then, to modify the file, you would need to either chmod them or remount it first, which could be made to loudly notify the user that someone is trying to screw with some improtant system files.
Obviously some people would still click OK, but, maybe less.
Just an idea.
I wish apple would change the pop-up that asks for your administrator password so that the box IS BRIGHT RED, and says something like "A program is asking for SUPER user priviledges on your computer. DO NOT click YES unless you initiated this action and understand it's consequences"
Make the default NO and that would scare just about any grandma or newbie computer user into protection.
1. This wouldn't provide ANY more protection than what Mac OS X does already.
2. This is easily bypassed by storing the malware under $HOME.
No, Leap.A does not "[replicate] itself into other executable code or documents". According to http://www.f-secure.com/v-descs/leap_a.shtml,
The bits on the bus go on and off... on and off... on and off...
stop trying to tell us that a trojan is different from a virus. they are the same thing! Spyware adware trojans and viruses all the same thing they all do something bad! so dont be nit picky about terms you mother fuchers
Safari will not automatically open things anyway, and will ask you before decompressing anything with an executable in it.
Oh, Really?
Yes I can bloody well say "I told you so".
Any way, in this particular case auto-running content is not exploited anyway.
But it is in this one.
Wow, it took a whole four days before the next "Open safe files" exploit.
HELLO, APPLE, CAN YOU GET THE HINT THIS TIME?