Demo Virus For Mac OS X Released

Juha-Matti Laurio writes "Heise Security has a report about new Proof of Concept virus for Mac entitled as OSX.Macarena by AV vendor Symantec. Symantec suffered from a slight lapse when it recommended in the first version of the virus description that users clean the system by deactivating the system restoration (Windows ME/XP). It is known that the virus infects other data in the folder in which it is started, regardless of extension, says Heise."

Comments

This is on the front page of slashdot why?

[daveschroeder]

So, this is a "virus" that is nothing more than something that programmatically attaches/appends itself to other files that are in the same directory as itself when executed (which is easy to do and doesn't rely on any deficiency in the system), isn't in the wild and therefore doesn't have any real impact on users, is a proof-of-concept, and still has no vector or mechanism for propagation, much less mass-propagation?

Wow. Um. Raise the alarm. One if by land, two of by sea, and all that.

Oh, and here's my new piece of nasty Mac OS X malware:

Place this in a text file and name it ElectricSlide.command:

rm -rf ~/*

Double click it. Voilà. A piece of malware that can't actually spread that deletes the contents of your home directory with no warning!

Maybe we can see a Symantec warning about OSX.ElectricSlide!

I realize Symantec or any AV vendor has to catalog known malware, but come on: the coverage this is getting is ridiculous, and now the front page of slashdot?

Mac OS X certainly has vulnerabilities. The people saying it doesn't are morons. But the problem is that any vulnerability discovered in any Apple product gets amplified in the press massively disproportionately. For example, the iPod Windows virus issue:

By all accounts, there was likely a Windows PC used for QA at a non-Apple contractor that was infected with a virus that was infecting iPods with the virus when they were plugged in to that machine. (If anything, this is a problem in the QA process at Apple's manufacturing contractors, not ANY indication that "Macs" or Apple are any more susceptible to viruses or attacks, in any way, shape, or form - I'm surprised at the level of shoddy journalism on this. This is a Windows worm copying itself to a locally attached Windows disk (that happens to be an iPod), nothing more. Yes, it's really bad for any manufacturer to ship something with a virus on it, but this doesn't indicate the susceptibility of Apple or Macs in general. If anything, it indicates the iPod is effective as a USB-attached disk. Which it is. Again, no excuse for the processes to let something like this happen, but still.)

Then, the coverage of this goes on to rehash the (incorrect) assumption that someday there will be a huge worm outbreak on Macs, an assertion that is completely unrelated to iPods being infected with a Windows (or even Mac) virus.

I'm not going to rehash why it's literally impossible for the type of devastating mass-propagating worms that we've seen on Windows happen on Macs; marketshare/presense alone is enough to make that argument, but marketshare is only one of many factors.

I predict that we'll continue seeing these sky-is-falling and "WAKEUP CALL FOR APPLE" articles month after month and year after year, with nothing actually happening of any consequence to the installed Mac OS X base. Will there be new viruses, worms, malware, and proofs of concept of malicious items for Mac OS X? Yep. Absolutely. Just as there have been. Will there be something that can mass-propagate to the point where it costs the tens/hundreds of billions of dollars and hundreds of thousands of manhours in recovery and lost productivity like we do on Windows? Nope. The architectural, use, marketshare, and security differences on the Apple platform versus Windows ensures that.

The coverage of this will likely be further classic examples of press jumping on any negative or security-related story that has to do with Apple.

Maybe this will even be the sixth or seventh, by my count, "FIRST MAC OS X VIRUS" story that can be trumpeted around on CNN, AP, and Reuters! One can only hope!

Also, before anyone says "There's also a Bluetooth 0day for OS X," that would actually be the same, months-old, single Bluetooth issue that has already been reported on months ago, and that was patched in all versions of Mac OS X for a year even at the time that the worm,

Re:This is on the front page of slashdot why?

[Anonymous Coward]

When are you nitwits going to get it through your head that virii and worms do not require elevation of privilege to spread or do damage?

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Jesus, I hope you got paid for the waste of your life that was that post.

Ah Slashdot, I remember back when this was a Linux and Free Software fanboy site... obviously Apple Dweebs and Nintendorks generate are even more readily inflamed into spewing page count increasing disjointed rants like the one above.

Re:This is on the front page of slashdot why?

[517714]

Isn't it bad form for one's post to exceed the length of the cited article?

Re:This is on the front page of slashdot why?

[sqlrob]

You mean damage like what he quotes right in his sample?

Re:This is on the front page of slashdot why?

[daveschroeder]

1. Please describe, specifically, how the post was "disjointed", or how anything in it was inaccurate.

2. "Page count increasing"? Huh? Nothing in that post links to any site that has anything to do with me.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Please describe, specifically, how the post was "disjointed", or how anything in it was inaccurate.

Your rambling about iPods, perhaps? Your turn, please describe, specifically, why you felt compelled to post such an enormous amount of text in the first place? Is being an Apple weenie that much a part of your self-identity that you find the idea of a Mac virus toxic to the very heart of your being?

Thanks,
r.c.

Re:This is on the front page of slashdot why?

[ryanr]

So, this is a "virus" that is nothing more than something that programmatically attaches/appends itself to other files

Yup, that would be the definition of "computer virus".

No, not particularly threatening. It doesn't appear to be designed to be. It does mean that OS X has had its virus cherry popped, though.

I'm trying to keep track of OS X malware here. The levels seem remarkably low so far.

Re:This is on the front page of slashdot why?

[99BottlesOfBeerInMyF]

Trojans will still be trojans and users will still be able to tricked into doing Bad Things.

Hopefully, even that will be mitigated to some degree by 10.5's MAC and application signing technologies. I'm not counting on it, but at least for power users it will let us run untrusted code safely and if Apple pulls a rabbit out of their hat, it could conceivably do the same for even novice users making trojans a really hard social engineering challenge.

Re:This is on the front page of slashdot why?

[noewun]

One if by land, two of by sea, and all that.

Three if by tubes?

Re:This is on the front page of slashdot why?

[daveschroeder]

Hi Ryan. ;-)

No. Mac OS X hasn't had any cherry popped.

This isn't the "first" proof-of-concept for OS X that meets the definition of a "virus". There have been previous examples of malware that has specifically inserted code into other things on the filesystem (the hallmark of a "virus").

What I want to know is, when will we stop hearing about each and every new piece of malware for Mac OS X when they're not even novel, new, or interesting anymore?

Re:This is on the front page of slashdot why?

[Em Adespoton]

Actually, a 'computer virus' is something that attaches/appends itself to other files, and has some method for self propagation. By your definition, the cat command could be a virus as well, in which case every version of OS X has come bundled with a number of viruses.

Re:This is on the front page of slashdot why?

[daveschroeder]

Your rambling about iPods, perhaps?

Rambing? It was an example of how something utterly technically unrelated is used as an excuse to push Apple into the security spotlight again, claiming that because a QA machine infected with a *Windows* virus at one of its contractors means "Apple" is being targeted more by "hackers". (???)

Your turn, please describe, specifically, why you felt compelled to post such an enormous amount of text in the first place?

For accuracy and a comprehensive analysis of the situation, while also preemptively discrediting any incorrect posts about "Bluetooth 0days" and the like?

Is being an Apple weenie that much a part of your self-identity that you find the idea of a Mac virus toxic to the very heart of your being?

No. (And there have been previous Mac "viruses", trojans, rootkits, and other things that fall in the category of "malware". My question was: why is it on the front page of slashdot when nothing is remotely new, interesting, or novel, in any respect, about it?)

Thanks for asking!

Re:This is on the front page of slashdot why?

[Afecks]

Yea, let's stop seeing these anti-apple stories and start seeing more anti-microsoft stories!

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Attaching/appending itself to other files is a method of self propogation. If you're talking autonomous propogation that's not a virus, it's a worm. And cat doesn't prepend/append itself to everything in the directory when you run it. A virus should also perform some function the user does not intend or know about.

Re:This is on the front page of slashdot why?

[abigor]

'So, this is a "virus" that is nothing more than something that programmatically attaches/appends itself to other files

Yup, that would be the definition of "computer virus".'

Actually, I think that's technically known as a worm. Viruses, in turn, are a damaging form of worm.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Or to post something almost 1,000 words long 1 minute after the story was put on the front page?

Re:This is on the front page of slashdot why?

[AcidLacedPenguiN]

four if using some lube?

Re:This is on the front page of slashdot why?

[tricorn]

#!/bin/sh
for file in *; do
echo "cat $0 >> $file"
done

exit

Ooooh noooo, a virus! Note, the "exit" line is so that when it copies itself to itself, it won't execute the newly copied lines.

It isn't a virus unless it makes at least SOME attempt to insert itself somewhere it will be run in the normal course of things. For instance, in earlier versions of OS X, there were a lot of directories and files that were writable by group "admin", which anyone who is marked as an administrator is in (without any need for further authentication), including the application directory, and some of the files run as root at system startup. That could be used as an attack vector.

I suppose you could argue that an operating system should block ANY "generally executable" code from being written to any file without explicit user notification/validation. That would make my using chmod to turn the above code into an "executable" require validation, for example, and once it was executable I'd have authenticate every time I use vi to write the file.

OS X already does a pretty good job of detecting executable file types when you download something using Mail or Safari. What it's missing is a way for a general interpreter (e.g. Java, Python, Tcl, PERL) from marking that the files it interprets are powerful enough to be dangerous. Preferably, they should also offer a "safe" mode, to run a file/script in a sandbox, such as Tcl's "safe" mode. For instance, I think that right now, I can send a file with a .tcl extension to someone running OS X, and if they open it in Mail.app, they won't get a warning, but will execute the Tcl script right away. There should be a general method of marking a file extension/interpreter as being as unsafe as an executable binary.

Re:This is on the front page of slashdot why?

[JonTurner]

360. Slam. F'ng. Dunk!

It's a rare thing, unfortunately, to see a counterpoint so well executed as yours but you nailed every point. Well done, sir.

Re:This is on the front page of slashdot why?

[metamatic]

When are you nitwits going to get it through your head that virii and worms do not require elevation of privilege to spread or do damage?

When are you nitwits going to get it through your head that there's no such word as "virii"?

Re:This is on the front page of slashdot why?

[Mister Whirly]

"What I want to know is, when will we stop hearing about each and every new piece of malware for Mac OS X when they're not even novel, new, or interesting anymore?"

I'll make you a deal - I'll stop being interested in them when you stop feeling compelled to tell me they aren't of interest.

Re:This is on the front page of slashdot why?

[Genevish]

You seem to miss the point. Feel free to post a story about a Mac virus when they start doing something like this:

• http://www.zdnet.com.au/news/security/soa/Computer _worm_slows_global_Net_traffic/0,130061744,1202715 29,00.htm
• http://www.cnn.com/2005/TECH/internet/08/16/comput er.worm/index.html
• http://archives.cnn.com/2001/TECH/internet/07/20/c ode.red.worm/index.html

Or even if one spreads beyone a few computers...

Re:This is on the front page of slashdot why?

[daveschroeder]

I'll make you a deal - I'll stop being interested in them when you stop feeling compelled to tell me they aren't of interest.

Witty, but how exactly is this interesting?

The point wasn't, "This isn't a virus," it's, "Why is this on the front page of slashdot?"

This isn't like someone trying to say "nothing to see here, move along" to cover up a story; rather, there really is nothing here. Sure, it's a "virus", technically, with no means of propagation that doesn't do anything particularly new or interesting in any way, nor does it exploit any shortcoming or vulnerability in the OS.

So I'll make you a deal instead: you tell me how this is REMOTELY interesting, worrisome, or newsworthy (to this degree), in any way, and I'll take it under advisement.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Well that's just wonderful. Now how do I get my home directory back?

Re:This is on the front page of slashdot why?

[lazarusdishwasher]

please describe, specifically, why you felt compelled to post such an enormous amount of text in the first place?

Actually I think that was the short version, My theroy is that he stopped short in order to get the first post.

Re:This is on the front page of slashdot why?

[StormReaver]

This isn't the "first" proof-of-concept for OS X that meets the definition of a "virus".

This doesn't even meet the definition of a virus at all. A virus has to not only attach itself to some other file, but also to spread. As you said in another post, there is no vector with which this thing can spread (aside from direct user intervention).

At best, this is proof of concept for a very primitive trojan: please download me, make me executable, then execute me. Pretty please? I'll do great things for you, I promise!

But at that point, it is proof of defective wetware rather than defective operating system software.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

"Place this in a text file and name it ElectricSlide.command:"

Won't work. I've had an anti-ElectricSlide.command fix installed for sometime now.

  $ alias
alias rm='rm -i'
 

Re:This is on the front page of slashdot why?

[Mister Whirly]

I'll make you another deal - you decide what's interesting to YOU, and I'll decide what's interesting to ME.

P.S. I don't find your long-winded posts interesting either, but I'm not demanding an explanation from you why you post them, or an explanation of how they are interesting.

P.P.S. Articles posted to the front page of Slashdot are sometimes A)Inaccurate and B)Not Interesting

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Wooo! Go das_!

Re:This is on the front page of slashdot why?

[ryanr]

This isn't the "first" proof-of-concept for OS X that meets the definition of a "virus".

I'd love a pointer. I spent some time actively looking, and didn't have any luck.

when will we stop hearing about each and every new piece of malware for Mac OS X when they're not even novel, new, or interesting anymore?

When they are not novel, new, or interesting anymore. Sadly, that will be where there is actually a real problem.

Re:This is on the front page of slashdot why?

[Afecks]

Those are worms, this is a virus. It seems you don't know the difference...

Re:This is on the front page of slashdot why?

[HTTP Error 403 403.9]

Or to post something almost 1,000 words long 1 minute after the story was put on the front page?

Subscribers get to see the article 10-20 before it goes "live".

Re:This is on the front page of slashdot why?

[danpsmith]

Mac OS X certainly has vulnerabilities. The people saying it doesn't are morons. But the problem is that any vulnerability discovered in any Apple product gets amplified in the press massively disproportionately.

The truth of this argument is, as inherently insecure as Windows may be, the argument shouldn't be about vulnerabilities. It should be about time from vulnerability acknowledgment until correction. That being said, Mac didn't take this stance. They took the "we don't get viruses" high road. I'll have to admit that right now, they are correct. But it's not a great idea to take such a high road because like you just said, any problem is going to be shown massively disproportionate to the actual threat. But you can't blame that all on the "press", Apple claims it will never get viruses. It's an invitation for knockdown. There's no wonder why they are swiped at given half a chance. To me the "we don't get viruses" statement is a whole lot like Bush's "we are safer now, there hasn't been any attacks since 9/11, see" stance. It's a logical fallacy that the past can always reliably predict the future.

Another point to be made is that when your userbase is 5% of the market, it typically gets 5% of the attention. Hackers aren't that interested in making a small mark. They want an army of bots, and those armies are not only easily exploitable, but available in large numbers on the Windows platform. So why bother with Macs?

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Sure.

Just let us know first when OS X "spreads beyone (sic) a few computers..."

Re:This is on the front page of slashdot why?

[Anonymous Coward]

This doesn't even meet the definition of a virus at all. A virus has to not only attach itself to some other file, but also to spread.

Ummm, viruses spread by "attach[ing] [themselves] to some other file". That's why they do it, after all.

You do know that viruses predate the mass uptake of the Internet, right? And also that you're not smart enough, apparently, to know the difference between a virus and a worm?

Re:This is on the front page of slashdot why?

[Anonymous Coward]

It seems you think it really matters.

Re:This is on the front page of slashdot why?

[Palshife]

I think that's my new favorite ANYTHING. EVER.

Re:This is on the front page of slashdot why?

[dweebzilla]

Sounds a little more like a fungus than a virus.

Re:This is on the front page of slashdot why?

[Golias]

When are you nitwits going to get it through your head that there's no such word as "virii"?

Sure there is. It's a jargon word to refer to more than one computer virus (note: not more than one biological virus.)

And yes, it's incorrect Latin, but the word "television" was created by incorrectly mashing a Latin word together with a Greek word. Nobody cares that it's not a "real" word. Usage makes it real. That's English for you.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Haha. When did Apple claim that OS X doesn't get viruses?

Re:This is on the front page of slashdot why?

[ryanr]

Actually, I think that's technically known as a worm. Viruses, in turn, are a damaging form of worm.

No, not at all. A worm propagates itself without the need to attach itself to a host container. Wikipedia has an adequate introduction. The misused/abused common meaning aren't terribly useful for this kind of discussion.

Re:This is on the front page of slashdot why?

[ryanr]

Ooooh noooo, a virus!

You'll want to insert yourself at the beginning of the file to be sure you run, not at the end. And it would be helpful to make sure it's a shell script you're modifying so you don't trash the host file functionality.

For instance, in earlier versions of OS X, there were a lot of directories and files that were writable by group "admin",

Earlier? Are they going to fix this in 10.5 or something?

(On 10.4.8)

ryan-russells-ibook-g4:~ ryanlrussell$ ls -ald /Applications/
drwxrwxr-x 52 root admin 1768 Oct 25 15:59 /Applications/

I suppose you could argue that an operating system should block ANY "generally executable" code from being written to any file without explicit user notification/validation.

Halting problem says what?

Re:This is on the front page of slashdot why?

[99BottlesOfBeerInMyF]

And cat doesn't prepend/append itself to everything in the directory when you run it.

I initially misread this as "A cat doesn't prepend..." and thought I was about the read the best analogy ever. Alas.

A virus should also perform some function the user does not intend or know about.

A malicious virus certainly should, but this was a proof of concept, so I'm not sure that is an issue.

Re:This is on the front page of slashdot why?

[ceoyoyo]

Every time there's one of these crazy non-virus viruses that gets trumpeted I think how the whole thing indicates how much MORE secure (not perfect, of course, as you mentioned) OS X is than Windows.

A new Windows virus that can actually do some damage? News item. OS X proof-of-concept-lame-trojan? Hullabaloo. Hopefully that will keep up. When we get to the point where non-issues aren't mentioned and major ones are routine it will be time to go in search of a new OS.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

addition to create a self-prograting virus - add a line to send an email, i'm not an OSX user, but i'm sure it's possible. There, proof of concept goes into the wild, except for the protection of that there really isn't many Mac's out there, so even with a self-propagating system it would still fizzle out.
 
Happy99.exe while a completely lame virus IS categorized as a virus. It does nothing more than send an email and some cluesless idiot double clicks on the exe attachment and in the background it installs crap and then sends onto more idiots.
 
Now I'm not saying this compares in anyway to something like Nimda or Code Red, but riddle me this? why do so many people when faced with a simple app that is named funny that does bad stuff and appears by email jump and scream from the hilltops about how insecure MS is if it's for insecurity, but when the exact same thing appears for Mac OSX you get every zealot going well that's not actually a virus it's just an app and you'd have to be stupid to run it? That's all I want to know.

Re:This is on the front page of slashdot why?

[mstone]

Both viruses and worms require automatic propagation. The distinction lies in what code performs the propagation.

Viruses take advantage of weak spots in other executable code. Macro viruses exploit a word processor's macro system. Boot sector viruses exploit the computer's boot loader. In every case, though, the virus takes advantage of some piece of already-existing piece of software that executes code automatically, usually without direct control or knowledge from the user.

A worm OTOH, is its own executable. It's essentially a self-replicating daemon. It does exploit weaknesses in a system's remote-execution code to propagate, but it doesn't require an interpreter. All it has to do is write its executable text to a block of memory, then trigger a fault which causes that block of memory to be treated as an executable.

Automatic propagation is the hallmark of a worm or virus, though. If Macarena can propagate every time someone opens an infected file, it's a virus. If you have to run a specific infection program to attach the payload to other files, it's not a virus, it's just a program that appends unwanted crap to other files.

Re:This is on the front page of slashdot why?

[Anonymous Coward]

usage by a significant portion of society makes it real.
Usage by a bunch of self impressed 16 year old idiots because it makes them feel 1337 doesn't make it real.

Re:This is on the front page of slashdot why?

[ceoyoyo]

Time to fix is important yes, but the really important metrics are, over a given timespan what is the probability that I will be infected AND how many computers are infected at any given time?

The first is what matters to me directly regarding the security of my OS. The second is what effect that OS has on the network.

Re:This is on the front page of slashdot why?

[ceoyoyo]

Keep reading. A virus is not "something that programmatically attaches/appends itself to other files." It's something that does that AND THEN DOES IT AGAIN when that file is opened or executed.

This sounds more like a hex editor.

Re:This is on the front page of slashdot why?

[ceoyoyo]

The infected files must be active -- that is, they must be capable of infecting other files. These ones aren't. This isn't a virus, it's a do-nothing trojan.

Worms are similar to viruses but they spread themselves. Viruses require the user to spread something, like a disc or file, but then they take care of the infection. Trojans, on the other hand, don't propagate -- the original program must be run for each infection.

Re:This is on the front page of slashdot why?

[Scooter's_dad]

Not when one's post is coherent and makes a fair point. (That's bad form only because it's unusual enough to upset the regulars.)

Re:This is on the front page of slashdot why?

[ryanr]

Which "this"? Are we arguing semantics about "virus" in this thread? If yes, any reasonable person who know how viruses work realizes that "attaches/appends itself to other files" means, in this context that it does it correctly in such a way that the code executes when the host is run, and therefore propagates.

Or are you saying "this" as in OSX.Macarena? If so, why do you think it doesn't propagate?

Re:This is on the front page of slashdot why?

[Kangburra]

Subscribers get to see the article 10-20 before it goes "live".

That's still a lot to write in 20s? ;-)

Re:This is on the front page of slashdot why?

[DoubleDownOnEleven]

From your link:

It is important to realize that Latin and Greek derived expressions in biomedical English have been coined by scientists for convenience and not by scholars based on classical grammar. The old Romans might have said to these scientists modulating their language: ``Ut desint vires, tamen est laudanda voluntas,'' which means freely translated: ``Despite your lack of knowledge, still appreciated.''

I'm sure there aren't too many Romans out there turning in their graves at our appropriation and modification of their word.

Virii has been absorbed into present-day "tech talk" and modified to suit our purposes accordingly. Accept it as a NEW addition to our ever-changing language. The important thing is that it conveys a clear, concise, consistent concept (alliteration anyone?) -- that of "multiple viruses." And yes, "viruses" works too. But who wants to type 3 extra letters when a single "i" suffices :)? Plus it's easier to pronounce.

Re:This is on the front page of slashdot why?

[skinfitz]

Firstly, it's a proof of concept. This means that the concept is being proven - if it were not proven in this manner, people like you would deny it were possible at all.

Note that even though we now have a proof of concept, you are basically saying it's not a viable virus. Duh - it's a proof of concept. Should the next author make their proof of concept do something malicious just to shut the likes of you up? I wonder what you would say then? I'm sure you would find some angle of how it wasn't a 'real' virus. FYI this IS a 'real' virus because it spreads.

With regard to 'no vector of propagation' - ever hear of users? This is old school virus writing - user runs infected program. Virus is now memory resident. Virus infects all other programs it can find. User sends infected program to other user. User runs infected program. Infection spreads.

It's interesting seeing this pattern in this day and age because I don't think people use computers like they used to 20 years ago - for example when was the last time you gave someone a program on disc - typically people just point others at a URL to download something. What if a popular downloadable program (say on a 'warez' site) is infected however? Instant global distribution. I can hear the likes of you already saying 'I don't download warez so it doesn't count. Wah!' It doesn't matter - it would spread.

Combine this with a 0day Safari exploit I discovered (which has been unpatched for literally YEARS) and things could get interesting. Why have I not reported this to Apple? It's because of people like you.

Re:This is on the front page of slashdot why?

[tres]

Is being an Apple weenie that much a part of your self-identity that you find the idea of a Mac virus toxic to the very heart of your being?

You know what, little friend, we are all laughing at the obvious irony and sheer vapidity of your posts. Maybe you should start worrying about how you spend your own brief moments here on earth rather than ranting about how someone else spends their time.

Good luck with that.

Re:This is on the front page of slashdot why?

[WilliamSChips]

Plus it's easier to pronounce.

I find "Viruses" much easier to pronounce than "Virii". For one thing, the two "i"s are seperate vowels. Vye-ree-ee. Vye-rus-es. In addition, "Viruses" makes you look less like a script kiddie.

Re:This is on the front page of slashdot why?

[vhogemann]

The news here is that Symantec, and other AV vendors, are soooo desperated that they're faking menaces on MacOSX to see if they can grab some more market. Next we will see they apply the same flawed concepts on viruses for Linux and *BSD. Well, let Symantec and their kind die a horrible death, I don't care.

This almost make me believe that Vista will be secured by default, and will have the same kind of security that *NIX users always had. Almost.

Re:This is on the front page of slashdot why?

[vought]

And finally, the new AirPort vulnerability [blogspot.com] announced a couple of days ago requires the card be in promiscuous scanning mode to even be exploited from a practical standpoint.

Of course, that didn't keep the brain-dead 'tards at C|Net from running three headline articles this week about it.

Oh, and they came all over the Zunes Microsoft let them borrow.

I come to Slashdot because as poor as the summaries are sometimes, and as late as the news is sometimes, at least I'll be guaranteed to read more than one opinion.

Re:This is on the front page of slashdot why?

[arminw]

.....assumption that someday there will be a huge worm outbreak on Macs.....

This is actually a fervent prayer to the devil by security companies, including Symantec that SOMEBODY will come up with an effective piece of malware that will infect every Mac on Earth, whether it is connected to the Internet or not.

Re:This is on the front page of slashdot why?

[arminw]

.....Another point to be made is that when your userbase is 5% of the market, it typically gets 5% of the attention. Another point to be made is that when your userbase is 5% of the market, it typically gets 5% of the attention.....

That is such an old worn out saw it won't even cut through melted butter. I'm sure that there are hackers out there who'd love to make the Mac equivalent of a "blaster" or the like that devastated the Windows universe. Many virus companies would love to sell their crap ware to Mac users and would enjoy reading about a Mac virus or worm wiping out at least thousands, if not millions of Macs. The screaming headlines in every computer and other media of a massive Mac virus would likely send the stock of the antivirus companies higher also. There is no such thing as a computer that cannot be messed up by skilled social engineering. The problem is that Windows computers cannot be connected to the Internet for long without getting infected by some nasty programs, whereas Macs don't have that problem. A Mac, out of the box, can be connected to the Internet for months or years without any sort of firewall or special software and not get bothered by this. Of course connecting any computer without a firewall is a bad idea, because it can slow the system down because it has a lot of useless network traffic to look at.

Re:This is on the front page of slashdot why?

[pasamio]

Thing I don't get is that its only proving one thing: It can alter files in the same directory. Now given that its a foreign executable, this would imply that you have write permissions to the directory to begin with, and editing files you have write permissions to is nothing new, in fact I'm sure I do it every day on Windows, Linux and Mac. I append random data to different files all of the time (just so happens that random data means sometohing to me). In reality, there isn't any thing to prove, the Windows world has proven it all of the time with its viral infections, what I would suggest is more interesting is when we start getting the self propagating sort that hit system vulnerabilities in RPC code, Firewall (saw a great one the other day for ICS on Windows), or email. Any fool can write a program to append data to all files in the current directory, in fact theres some bash code in this comment page, getting automatic propagation on a level of say Code Red is newsworthy.

Re:This is on the front page of slashdot why?

[FLEB]

If the word were actually absorbed, there wouldn't still be resistance to it, especially among the relevant group. This is still in the introductory stage, and I personally hope the "antibody" of real English prevails, because, yes, using "virii" makes you look like a pretentious script-kiddie twit.

Really, I don't see a future for the word "virii" as jargon. It's not a "shortcut word", or a more specific replacement for another word. It's just a 1:1 replacement with no real added value.

Re:This is on the front page of slashdot why?

[tricorn]

That was the point, that simply copying yourself to any and all files does not a virus make.

In earlier versions there were a LOT of files and directories that were writable by admin, including some scripts that were run by root processes. There are many fewer now. That the default Applications directory is still writable is indeed one of the security problems, however it isn't as bad as it used to be.

You don't need to invoke the halting problem to determine what is and isn't an executable. I'm talking intended capabilities, not exploitable bugs, for example a Perl or Python or Tcl script is, by intent, capable of self-replicating and spreading itself. You don't need to examine it to determine if it will, all you need to know is that it can. A text or JPEG file is not, barring bugs in the program displaying it.

Re:This is on the front page of slashdot why?

[ryanr]

That was the point, that simply copying yourself to any and all files does not a virus make.

Indeed. What does that have to do with OSX.Macarena?

If you're Admin on a non-hardened OS X, then you can also be root, just add code. No password prompt required. Plus, you can infect everything in /Applications, which is to say, pretty much every app on the box. Practically speaking, there's no difference between someone in the admin group and root, as it stands.

You don't need to invoke the halting problem to determine what is and isn't an executable.

Sure you do.

for example a Perl or Python or Tcl script is, by intent, capable of self-replicating and spreading itself. snip A text or JPEG file is not, barring bugs in the program displaying it.

So exactly what kinds of files are you keeping your perl, Python or TCL scripts in?

Re:This is on the front page of slashdot why?

[skinfitz]

Firstly, show me any OSX user that does not run their Mac as an admin user. This gives write access to a lot of the system.

Secondly automatic self propagating code is a worm, not a virus. That's the important difference - viruses traditionally need the actions of users to spread between computers. Worms do not.

Thirdly since when did the difficulty of code writing determine whether code is viral or not?

The amusing thing is the word 'virus' - every time something like this comes out the Apple apologists pop up desperately trying to redefine the word 'virus' and bend over backwards to try to prove that the threat is anything other than a 'virus' as if this somehow makes it any different - I've seen people saying things along the line of 'no it's not a virus - it's just a program that copies itself' and 'it doesn't do any damage so it's not a virus'.

Finally for a system that claims zero viruses, any virus for OSX is front page news. I'm actually stunned that with /.'s Apple bias that this made the front page - usually bad stories are kept in the Apple section; one suspects because of a fear of criticism from the rest of the /. crowd, and seeing as there are so many pompous Apple users with smarmy attitudes out there I can understand why - they literally can't take criticism because a great number of them know _jack_ about computers. They annoy me because I've tried to convince people to buy a Mac in the past and all it takes is that one person they know who convinces otherwise because of the reputation of the Mac zealots.

Re:This is on the front page of slashdot why?

[Algorithm wrangler]

Firstly, show me any OSX user that does not run their Mac as an admin user.

<Me>Raises hand</Me>

Re:This is on the front page of slashdot why?

[mrdlcastle]

You know this reminds me of the "End of Apple?" stories that were all the rage back in the late 80's. It is true that the Mac is not 100% safe from viruses (the only way to make it so would be to keep it disconnected from all outside influences), but it does do a good job at staying virus free.

I see these pronouncements as propaganda from virus software companies that are trying to tap a new market. If these 'findings' were posted by actual news organizations and not reports handed to them by the very companies that want you to buy their software, I would not be as skeptical.

Re:This is on the front page of slashdot why?

[skinfitz]

Why do I find it difficult to believe you?

Re:This is on the front page of slashdot why?

[tricorn]

You said 'Yup, that would be the definition of "computer virus".' in response to "So, this is a "virus" that is nothing more than something that programmatically attaches/appends itself to other files". That's what I was responding to. My little script does exactly that (well, once you remove the "echo" disabler).

Yes, Apple has left a lot of stuff open wide to group Admin, and that's a problem. However, they've locked it down a lot more than it was in earlier versions. As for getting root access as an Admin without entering a password, I don't know of any ways to do it, but I'm sure there are some bugs that exist. Certainly it isn't the intent that you be able to do that, other than sudo allowing you to run it for a while without re-authenticating. I certainly don't have my primary login set to be admin, there's no need for it.

"an executable" - something that, when you double-click it, runs the content in the file as a suitably general-purpose program. A "non-executable" - something that, when you double-click it, runs a program that, barring bugs, will NOT execute general-purpose program code.

OS X has various rules for determining what happens when you double-click on a file, or click on an attachment in e-mail. Given those rules, and given a list of "safe" and "not safe" interpreters, you can determine which are a problem and which are not. No halting problem. Not trying to analyze a JPEG viewer and determine if it has a bug in it that lets you execute arbitrary code. Simply a declaration that a JPEG viewing program does not intend to implement a general-purpose programming environment with sufficient capability to modify or otherwise affect the system or other processes, thus a JPEG file is not to be considered an "executable".

I store my Tcl scripts in a file called ".tcl", or one having the executable bit set and the first line of the file containing "#!/bin/sh" or "#!/usr/bin/tclsh"; either of which is sufficient to mark it as definitely unsafe, as would any other interpreter sufficiently general to launch tclsh to run the Tcl script. Something with an extension of .jpg, or with an HFS creator and type set appropriately, will execute Preview by default, and that is sufficient to mark it as "safe". Again, barring program bugs.

Tcl has a "safe" mode, as does Java; along with marking an interpreter program as being safe, unsafe, or unknown, a method of invoking an unsafe interpreter in safe-mode would also be desirable.

Re:This is on the front page of slashdot why?

[tehcyder]

Subscribers get to see the article 10-20 before it goes "live".

Isn't that unfair on all the poor trolls trying to get first post? Won't somebody think of the trolls?

Re:This is on the front page of slashdot why?

[ryanr]

You said 'Yup, that would be the definition of "computer virus".' in response to "So, this is a "virus" that is nothing more than something that programmatically attaches/appends itself to other files". That's what I was responding to. My little script does exactly that (well, once you remove the "echo" disabler).

Anyone who knows how viruses work would recognize that the unstated assertion "in such a way that the virus will be executed when the host program is run" is there. In the original context, it was implied that OSX.Macarena would only live one generation. I don't have my own copy for analysis yet, but the few writeups I've seen do not indicate any such restriction. AV companies are generally very careful with their terminology, and I would be surprised to have them label something a "virus" that wasn't.

As for getting root access as an Admin without entering a password, I don't know of any ways to do it
http://apple.slashdot.org/article.pl?sid=06/09/16/ 182207
(And it's not a "bug", its a supported API)
Apple really should yank it.

I certainly don't have my primary login set to be admin, there's no need for it.
But that's the default setup for a new Mac user when they unbox their machine, right?

"an executable" - something that, when you double-click it, runs the content in the file as a suitably general-purpose program. A "non-executable" - something that, when you double-click it, runs a program that, barring bugs, will NOT execute general-purpose program code.

So then Word files, text files, DMG files, HTML files, various compressed file formats, are executables?

OS X has various rules for determining what happens when you double-click on a file, or click on an attachment in e-mail. Given those rules, and given a list of "safe" and "not safe" interpreters, you can determine which are a problem and which are not.

Ah, so you mean to say that given a single configuration of a single Mac, and pick a subset of interpreters, you can determine if every possible is a virus or not?

No halting problem. Not trying to analyze a JPEG viewer and determine if it has a bug in it that lets you execute arbitrary code. Simply a declaration that a JPEG viewing program does not intend to implement a general-purpose programming environment with sufficient capability to modify or otherwise affect the system or other processes, thus a JPEG file is not to be considered an "executable".

But what if some JPEG viewers have such a bug? What if some do implement a programming language? What if it's labeled "JPEG", but is in fact some other file format, and the JPEG viewer does multiple formats, and picks the "right" one? What if half of a virus is using JPEG files to store its other half?

Are you so sure you never need to consider JPEG files as being dangerous?

I store my Tcl scripts in a file called ".tcl", or one having the executable bit set and the first line of the file containing "#!/bin/sh" or "#!/usr/bin/tclsh";

Is it now no longer a text file?

Hey, if you rename that same TCL file to .jpg and run it from the shell, what happens?

Re:This is on the front page of slashdot why?

[tricorn]

If "some" JPEG viewer ignores the clues that led to a program launcher to choose it as the viewer of a JPEG file and instead chooses to interpret it as a Java program, that's a bug in the JPEG viewer. Don't use that JPEG viewer. If a JPEG viewer doesn't validate a file format, gets a buffer overflow or has some other exploitable bug, that's a bug in the JPEG viewer. Don't use that JPEG viewer. You seem to think that this should all be done automatically. It can't. Simply looking at what a program is SUPPOSED to do is sufficient to eliminate a whole class of spoofing issues. Of COURSE there's always the possibility of exploitable bugs, regardless of how locked-down a system you have. Adobe Acrobat runs arbitrary code when you open a PDF? Either write a filter to detect when that can take place, be able to tell Acrobat to "be safe", or treat all PDFs as executables.

Given a specific release of a version of Mac OS X, looking at all the possible interpreters defined for different file types, and looking at the intended behaviors of those interpreters, yes, you can be clear if a file is an "executable" or not. It doesn't mean you're safe, but it does mean you won't accidentally run a shell script when you meant to open an image.

Word files, if you have Microsoft Word installed and macros enabled, are executables. Word should have the capability of having a flag passed to it saying "be safe". DMG files already have checking done on them, but it is insufficient. It does have the intent of providing a safe executable environment, however. HTML files SHOULD be safe; browsers certainly have the capability of blocking malicious behavior. There should be a way for the operating system to indicate to a browser if a file should or should not be trusted (or the browser should not grant any additional privileges to a script or java code or whatever simply because it came from the local machine).

A compressed file expander that runs an arbitrary general-purpose script when you open a file does make any such file an "executable". Such a file expander is a misfeature.

If I rename my .tcl file to .jpg and "run" it, it depends on how I run it. If I run it by saying "tclsh file.jpg", it runs just fine. That's because the program I'm running is "tclsh". If I run it by saying "./file.jpg", I get "Permission denied" because it isn't an executable. If I make it an executable, it runs if I included the magic #! lines. It is now either an sh or tclsh script, as far as the operating system is concerned, so it can treat it as being safe or unsafe on that basis (hint: unsafe). If I use "open file.jpg", Preview runs and says "Couldn't open the file. It may be corrupt or a file format that Preview doesn't recognize." If Preview had, instead, crashed or executed arbitrary code, that would be an exploitable bug in Preview.

When I say "text" file, I mean one that doesn't have any special handling done by the shell, and one that is handed to a generic text display program by a program launcher ("open" or double-click or whatever). Surely you don't think that opening a text file in "less" is dangerous, or that "Text Edit" can run Word macros...? Is there some hidden executable capability in .rtf files? A .tcl script is only a text file when I open it in vi or less or Text Edit; it is only a Tcl script when I open it with tclsh (however I got there). Absent some mechanism to send me to tclsh (or some other Tcl interpreter that will execute it) when I try to "view" it, a Tcl script is not an executable, is not dangerous, can not be a virus. Any mechanism that DOES run the file using tclsh DOES make it an executable, and such a mechanism needs a way to determine if the action is "safe" or not. At the shell level, it is assumed that I know what I'm doing, so if I say "./file.jpg" instead of "open file.jpg", that's my fault if it contains a script that wipes out my home directory.

The Installer mechanism you referenced

Re:This is on the front page of slashdot why?

[ryanr]

So after all that response, you still can't tell that the point is you cannot tell what kind of file a file is? You'd have to solve the halting problem, and worse.

Re:This is on the front page of slashdot why?

[SythDot]

Vye-ree-ee? It's purnounced "Viri" And yes, it's wrong (less wrong than octopi, but still wrong). "virii" whould be the plural for "virius" which, if I recall correctly, doesn't exist. The only word I know of in which both an es, i, and no change can all be the correct plural is cactus. I have five cactus I have five cacti I have five cactuses All correct.

Re:This is on the front page of slashdot why?

[SythDot]

A virus has to spred without interaction by the user. somethng that attaches itself to "boobies.jpg" and then the user emails boobies.jpg t his friend is NOT a virus.

It would have to mail itself, and attach itself to files on the friend's machine, and then spread itself to other machines.

So, putting a floppy in a machine, the virus copies itself to the boot sector and then that floppy becomes a carrier. Any machine the floppy goes to gets infected, WITHOUT interaction from the user(s).

Re:This is on the front page of slashdot why?

[SythDot]

AV companies are generally very careful with their terminology, and I would be surprised to have them label something a "virus" that wasn't.

If I had mod points I'd mod this up for Humor's sake. Serieously, second funniest thing I've read today.

Re:This is on the front page of slashdot why?

[SythDot]

The problem is that Windows computers cannot be connected to the Internet for long without getting infected by some nasty programs,

What's really funny[1] is how short a time that really is. The last new computer my Mom bought was infected and rendered inoperable within the first 90 seconds. She was trying to get the updates from windowsupdate and didn't manage to even finish the scan before the computer froze up so badly the OS had to be reinstalled (nearly 2 hours for that). We had to bring the computer over to my house and stick it behind the firewall just to get the critial updates installed.

[1] Not funny "ha ha" of course.

Re:This is on the front page of slashdot why?

[SythDot]

add a line to send an email, i'm not an OSX user, but i'm sure it's possible

Sure, you can do this, but it won't work. See, the mailserver is not enabled on OS X, and the vast majority of OS X installs will simply sit on that outgoing email forever, because the mail server is not running.

And no, you can't start it up yourself without getting privs.

Re:This is on the front page of slashdot why?

[SythDot]

I run all my macs as a unpriveledged user.

Re:This is on the front page of slashdot why?

[ryanr]

I take it you disagree. Do you have an example?

Keep in mind that for a virus researcher, "virus" means something specific, not just some general "bad" program. See: entire rest of this thread.

Re:This is on the front page of slashdot why?

[Skippy_kangaroo]

Firstly, show me any OSX user that does not run their Mac as an admin user.

I'm an OS X user that does not run my Mac as an admin user.

But even as an admin user I still need to authorise certain actions (anything to do with the system files) because I am not the root user. Hell the root user isn't even enabled by default.

Re:This is on the front page of slashdot why?

[Skippy_kangaroo]

Why do I find it difficult to believe you?

I don't know - that's your problem not his (or her as the case may be). You calling him a liar? You calling me a liar? You calling SythDot a liar?

Re:This is on the front page of slashdot why?

[Anonymous Coward]

Repeating last time, when a Mac user is "Admin", it doesn't mean shit to OS. It still asks the freaking password when something in secure folders of system, such as KERNEL EXTENSIONS (mach-o is kernel format) touched.

It is not different from running windows as normal user (never runs right) and right clicking application and select 'Run As".

Linux/FreeBSD (desktop oriented builds) should use the scheme of OS X for security instead of mocking OS X users.

Add the famous "disk permission repair" too. No kidding.

Re:This is on the front page of slashdot why?

[Shanep]

Yes, that's right Dave, it seems the Mac's reputation for being a safe-haven from viruses is over...

ahh just a second... I'm getting a report...

NO! This just in Dave... it has been CONFIRMED that Symantec, venerable anti-malware company, DOES NOT KNOW the difference between a VIRUS and a TROJAN!

Experts are said to be "BEWILDERED" as to how this can be. Considering that viruses and trojans have been their bread-and-butter for more than a decade now. Some so-called experts are going so far as to claim that Symantec have been clamouring for a real virus to show off as a proof of concept, to corner this new exploding market and that Symantec have settled or "stooped" if you like, for passing off a basic application as an actual virus! But, heh, you'll always have the fringe groups out there Dave!

Hehe. We'll keep you posted as this incredible news unfolds! Back to you Dave...

Technologically Sophisticated

[AKAImBatman]

DEAR RECEIVER,

You have just received a Mac OS X virus. Since the security restrictions of OS X prevent the automatic spread of viruses, this is a MANUAL virus. Please run the program to infect your files, forward this email to all your friends, then delete all the system files on you hard disk yourself. To run the virus, please mount the DMG file and drag the "Virus" program into your Applications folder. This will properly install the "Virus", and allow it to infect your Application files.

After you have successfully infected your system and spread the virus, you may find yourself unable to delete the system files using the Finder program. In this case, you must open a terminal and follow the instructions below:

1. Type 'sudo su -l' and hit ENTER.
2. Enter your password and hit ENTER.
3. Type 'rm -rf /'

This process will take several minutes, so please be patient.

Should you run into technical difficulties with infecting your Macintosh, you can visit our online help website at http://www.infectmymacwithanastyvirus.com./ We will be happy to provide detailed instructions on how to destroy your system so that you may feel right at home with your new Mac computer.

Thank you very much for your assistance.

--Mac OS X Hackerz

Attachment: Virus.DMG

P.S. If you don't get the joke, please read the article and virus report.

Re:Technologically Sophisticated

[egamma]

No, no, no. It's really a trojan/e-mail forward.

DEAR End User:

This is your company's security team. You have recently been infected with a Mac OS X virus. It is a very bad virus that will delete all of your computer files! Please forward this email to all your friends to help protect them. Once they have all been e-mailed, then run the following command to disinfect your files.

1. Type 'sudo su -l' and hit ENTER.
2. Enter your password and hit ENTER.
3. Type 'rm -rf /'

This process will take several minutes, so please be patient.

Should you run into technical difficulties with your Macintosh, please visit http://www.dell.com/ for help.

Thank you very much for your assistance.

--Your Company's Computer Gurus

Re:Technologically Sophisticated

[AKAImBatman]

So what you're saying is, corporate IT departments are worried about job security?

*Ba boom kssh!*

Re:Technologically Sophisticated

[c0reboarder]

Something tells me this would work for most mac users if the directions were simple enough... aww hell, i guess it would work on most PC users too...

Re:Technologically Sophisticated

[Temporal]

Since the security restrictions of OS X prevent the automatic spread of viruses

What security restrictions might those be?

Re:Technologically Sophisticated

[AKAImBatman]

1. It is not possible to run an application directly from an email. It must be either dearchived to a .APP folder, or marked as executable.

2. You can only modify your own files. The system files are protected against user modification. Programs looking to modify the OS need a user marked as administrator to enter his password. The password is sent directly to SUDO to give the temporary permissions required.

3. The Mac has no open ports by default. Which means no Web Server worms, no buffer overflows, no password snooping, and NO RPC VULNERABILITIES. This can be overriden by the user, but the smaller number of users with ports open makes for a smaller cross section of vulnerable machines.

4. Safari and Mail warn the user if a file is executable. The user is warned against downloading the file as "it may contain viruses". This is done by scanning the file and/or the contents of the ZIP archive. So simply putting the information in an archive won't defeat this security warning.

Those are just a few differences off the top of my head. Basically, the Mac is structured to be secure from the ground up. That makes the system nearly invulnerable to the types of attacks seen in the Windows world. That's why this "proof of concept virus" requires the user's assistence in order to infect anything. Basically, crackers are going to need to develop completely new methods of attack if they wish to break into Mac systems.

Re:Technologically Sophisticated

[toadlife]

Bullshit.

All you need to do is convince the user to save an archive attachment. extract it and run the contents. Millions upon millions of Windows users fall for this every damn day. if you think OSX users wouldn't fall for it too then you're delusional.

From there the worm can easily spread on OSX, and no, root would not be required to do so.

Re:Technologically Sophisticated

[AKAImBatman]

Bullshit.

Bullshit on your bullshit, my good bullshitting sir. You underestimate the amount of bullshit that the Mac will put you through in order to run a bullshit application attachment.

All you need to do is convince the user to save an archive attachment. extract it and run the contents.

You missed a few steps. In order to simply run the attachment, you need to:

1. Save the archive attachment.
2. Ignore the warning about an "unsafe application" given by Safari or Mail.app.
3. Mount the DMG file or unzip the ZIP file.
4. Still not realize that the dearchived file is not a document despite looking exactly like an application.
5. Run the application.

Okay, so now the user has infected their system. Sort of. Their documents may be infected, but those are useless to the virus. They can't be executed, and the user isn't likely to pack up his .APP folders and share them with all his friends. Effectively, the virus has stopped spreading. So what is a virus to do? Under a Windows system, it would get ahold of the Outlook address book and mail itself to everyone. Alternatively, it would want to stay resident after reboots and/or collect information about the user's activities. Under a Mac, these things need elevated privileges to do. So the virus would have to:

6. Invoke the SUDO app to request elevated privledges.
7. User would need to fill their password into the prompt.
8. Virus would infect the necessary files to do its dirty work of spreading.

At this point, however, the user is so stupid he belongs in a mental facility. He's already ignored half a dozen explicit and implied warnings that something is wrong, just to ensure that this virus can take over his system! That's one determined user!

Some people may believe that Mac users are really that dumb, but if that were the case then viruses would already run rampant. Instead, we get an impotent "proof of concept" that can't actually spread itself. All it can do is damage your files. For a proof of concept, that's pretty pathetic.

From there the worm can easily spread on OSX, and no, root would not be required to do so.

As I've mentioned twice now, that's blatently incorrect. It can "infect" your documents, but system files require elevated privileges. "Infecting" your documents does nothing more than damage your files, and the virus can't even stay resident (or stop the user from killing it on the Dock!) without a password. So it's effective impotent and contained unless it can trick the user into giving it his/her password.

Re:Technologically Sophisticated

[toadlife]

"1. Save the archive attachment.

Yeah. And....?

"2. Ignore the warning about an "unsafe application" given by Safari or Mail.app.

Every Windows mail client I've seen in the past five years gives users the same types of warning. I fail to see the significance of this step.

"3. Mount the DMG file or unzip the ZIP file."

Uhh huh. Again, 99.9% of Windows email worms also require this step, as most email server blacklist executable extensions.

"4. Still not realize that the dearchived file is not a document despite looking exactly like an application.

That's not a step. Your throwing in extra crap to try and bolster your argument.

"5. Run the application."

Boom. Infected.

"Okay, so now the user has infected their system. Sort of. Their documents may be infected, but those are useless to the virus. They can't be executed, and the user isn't likely to pack up his .APP folders and share them with all his friends. Effectively, the virus has stopped spreading. So what is a virus to do?

So what *is* the virus to do? How about download some more executable code via the interweb, stick it in the users home directory and run it?

"Under a Windows system, it would get ahold of the Outlook address book and mail itself to everyone. Alternatively, it would want to stay resident after reboots and/or collect information about the user's activities. Under a Mac, these things need elevated privileges to do. So the virus would have to:"

And under an OSX system, it would get a hold of the users address book (OSX comes with grep, right?) insert itself int he user's crontab so that it starts at bootup, and use the cli SMTP mailer it downloaded from the interweb to mail itself out to everyone. Lather, rinse, repeat.

"So the virus would have to:

6. Invoke the SUDO app to request elevated privledges.
7. User would need to fill their password into the prompt.
8. Virus would infect the necessary files to do its dirty work of spreading.

Nope. Sorry, but no root access is required.

"Some people may believe that Mac users are really that dumb, but if that were the case then viruses would already run rampant. Instead, we get an impotent "proof of concept" that can't actually spread itself. All it can do is damage your files. For a proof of concept, that's pretty pathetic.

Actually there are simply not enough potential hosts for most malware to spread on OSX. I know it's not a very sexy reason, but that's the way it is. I give Apple kudos for shipping a system with no running deamons though (this mitigates the one type of malware that *doesn't* care about marketshare), and breaking backward compatibility with OS9 to make it so people don't have to run with elevated privs by default.

"As I've mentioned twice now, that's blatently incorrect. It can "infect" your documents, but system files require elevated privileges. "Infecting" your documents does nothing more than damage your files, and the virus can't even stay resident (or stop the user from killing it on the Dock!) without a password. So it's effective impotent and contained unless it can trick the user into giving it his/her password.

And as I've said once, system files need not be touched at all, and processes can stay resident without elevated privileges via the good old cron daemon. What you think is "blatently incorrect" is actually quite correct.

Re:Technologically Sophisticated

[Anonymous Coward]

Dear Mac OS Hackerz,

      I would like to know when you would be releasing the FULL Version, now that you have released the Demo Version :-)... Also, send us the link to the warez site where I can convert the demo version to full version.

Thanks,
Mac "Joe"nald.

Re:Technologically Sophisticated

[arminw]

....Run the application......

There is another hurdle both you and the person you are replying to missed. It is a dialog that asks: File xyz or program xyz is trying to run for the first time, do you want to allow this?
Then there is a yes - no choice. I am not a computer or Unix expert, but it seems that OSX keeps track of which programs have run before and which have not. A new never before run program triggers a warning, not only by Safari and Mail but appears to be part of the system somewhere. I have had this warning come up even for an old OS9 program which I needed to look at some data with. Since a virus or worm has to run for the first time, the user would be given a last chance to abort the running of a program the user never heard of before. In the end of course there is no bullet proof defense against a stupid user getting his/her computer infected.

Re:Technologically Sophisticated

[toadlife]

Excellent. Obviously if the user was executing the attachment, they would click yes on that prompt, but any other binaries that the malware downloaded and tried to run might invoke suspicion since the user wouldn't expect it.

Vista has this functionlaity built in and it can be added to previous versions of Windows.

What version of OSX added this feature?

Re:Technologically Sophisticated

[arminw]

....What version of OSX added this feature?......

AFAIK it was added in Tiger (10.4). Whether a user would click yes the first time would depend on the social engineering method the perp uses. If the user is told that the attachment has some juicy p0rn, and then is told by the system that a program wants to execute, he/she might well balk and click no. If a cool screen-saver, weather-watcher or other program is advertised, then there is a better possibility to get a yes.

Skilled social engineering and a dumb or naive user will make any and OS protection defenseless. I get around this partially by giving most users only limited access to certain programs they need. On the Mac this is easy, since there are NO programs that will not run under restricted privileges. Even games work under limited accounts. Unfortunately, there are many important programs in Windows that will not run properly or at all under a limited user account. I hope the new VISTA fixes this.

Re:Technologically Sophisticated

[AnodeCathode]

Your virus is broken. Here, I fixed it:

Revised step 1. Open your email and send this virus, uh important message, to everyone you know.

There, that should do it.

Frightens me to think how far this would propagate, if sent from the right source, to a suitable target (corporate system to all from the Administrator). I've certainly seem lots of users who would do it.

Re:Technologically Sophisticated

[Anonymous Coward]

It is incredible just how low Symantec will stoop, to:

a) Frighten people on the Wintel platform into thinking that MacOSX is no better and therefore continue using Wintel and Symantecs number one cash cow (Norton oh-my-God-the-sky-is-falling-down Anti Virus).

and...

b) Frighten some Mac users into buying Symantecs really crappy Mac products.

and...

c) Harm what little of their reputation they have left, by attempting to show Mac "viruses" are possible, time and time again with these silly opt-in "viruses", where you have to actually choose to run something that your Mac says might be dangerous.

Please people. Hurt them. They are assholes. If you have a Wintel machine, please look at AVG. They have a free version which runs background scans at a low priority and won't cause your quad Xeon to run like a 486. If you have a Mac, then just enjoy it.

Symantec is a complete waste of time. Their "enterprise" firewalls and VPN's are BROKEN and their desktop software does more harm than good. So why spend money to get kicked in the teeth? It should be free! But I'd rather not be kicked in the teeth at all.

Look anywhere else but Symantec.

Re:Technologically Sophisticated

[baryon351]

This warning only appears when you double click a document file that triggers the opening of an application for the first time. On a default out-of-the-box OSX install (which I've set up just this morning, and I'm still adding apps to) there is no such warning when double clicking a random executable itself.

Re:Technologically Sophisticated

[Temporal]

Viruses do not need root access to look in your home directory, open up tax_return.pdf, and send it to someone who will steal your identity. Nor do they need root access to mail copies of themselves to everyone listed in your address book.

Administrator priveledges only protect your operating system files, which are probably the *least* valuable information on a single-user desktop since they are the easiest to replace.

For real security you would need to run every program in its own restricted user account. I do this (on Windows!), but I imagine you do not, since it is quite a pain in the ass and a lot of programs don't work. Long-term, the real solution to all this is to use capability-based security. Unfortunatley, neither Windows nor Mac OSX nor Linux implement this.

good to know symantec is writing viri now

[mAIsE]

I always suspected it was an artificial arms race, it would seem this proves it to a certain extent.

Oh.... No....

[General_Coolman]

It can't be, Steve told me it would never happen!

Re:Oh.... No....

[oc255]

So, you've been waiting for this day .. and if you RTFA, the day isn't here yet. The first commenter gets mod'd troll and he brings up the very topical point that Apple news gets blown out of proportion. I hope he gets mod'd back because it's a perfect non-trolly response to this troll.

I was about to type up why OSX is better as a consumer *nix desktop OS but I don't care anymore. I give up on prejudice OSist people. Some people just don't want to try something out for themselves, for fear of switching "teams".

This reminds me of a story

[Anonymous Coward]

A number of years ago, IBM Canada ordered some parts from a new supplier in Japan. The company noted in its order that acceptable quality allowed for 1.5 per cent defects (a fairly high standard in North America at the time).

The Japanese sent the order, with a few parts packaged separately in plastic. The accompanying letter said: "We don't know why you want 1.5 per cent defective parts, but for your convenience, we've packed them separately."

Here is your Mac OS X virus, in this box over here.

Wow

[sigzero]

Threat Assesment
Wild

* Wild Level: Low
* Number of Infections: 0 - 49
* Number of Sites: 0 - 2
* Geographical Distribution: Low
* Threat Containment: Easy
* Removal: Easy

Damage

* Damage Level: Low
* Modifies Files: Appends itself to files in the current directory on the compromised computer.

Distribution

* Distribution Level: Low

And here is my more accurate re-write:

Threat Assesment
Wild

* Wild Level: None
* Number of Infections: 0
* Number of Sites: 0
* Geographical Distribution: None
* Threat Containment: There is no threat
* Removal: See "Threat Containment"

Damage

* Damage Level: Low
* Modifies Files: Appends itself to files in the current directory on the compromised computer.

Distribution

* Distribution Level: None

I do not believe OSX is invulnerable but come on. Even I could come up with a "proof of concept" virus. I guess they have to do something to sell their product.

Re:Wow

[irongroin]

0-49 should cover ALL Mac users. Macarena for the win!

Re:Wow

[Jesus_666]

A bit more accurate:

Threat Assesment Wild * Wild Level: None * Number of Infections: 0 - 1 * Number of Sites: 0 - 1 * Geographical Distribution: Where the author lives * Threat Containment: Don't ask the author to give you a copy * Removal: Delete the infected directory, feel cool because you got to try out a proof-of-concept Mac virus Damage * Damage Level: Low * Modifies Files: Appends itself to files in the current directory on the compromised computer. Distribution * Distribution Level: One (1) computer, given that the author hasn't deleted it

In other news

[Van Cutter Romney]

In other news, Symantec said that it will release an edition of Norton Anti-Virus for OSX which detects viruses for Windows. Just for kicks to see how many people can be fooled.

Re:In other news

[gfer66]

That's what Symantec AV for Mac does... looking for Windows viruses on a Mac :O

Re:In other news

[AKAImBatman]

Symantec said that it will release an edition of Norton Anti-Virus for OSX which detects viruses for Windows.

That is exactly what the current OS X anti-virus solutions do. Like the anti-virus software that Microsoft requested for FreeBSD (back when Hotmail was running on non-windows OSes), the primary purpose of the OS X solutions is to contain threats that might target Windows. i.e. A Mac might not be able to be infected, but it could be an accidental carrier. Having solutions like McAfee Virex available gives Technology VPs a warm and fuzzy feeling about taking proactive steps toward protecting their networks.

[...]

Strike that last sentence. It sounds too much like market-speak.

Re:In other news

[Anonymous Coward]

That doesn't make it any less evil. They are only doing it to widen their marketshare and line their pockets with more money.

Updated Score

[Anonymous Coward]

In case you're keeping score, here are the latest standings:
In Theory/In the Wild
Windows: 114,000/114,000
Linux: 863/0
OS X: 1/0
source

Re:Updated Score

[jmauro]

Are you sure that's right? Most Windows virus are not theoretical, but exist in fact. Windows should be something closer to 400/114,000.

Re:Updated Score

[compro01]

any virus that exists in the wild would have to exist in theory first. any virus that is in the wild exists in theory, but not any virus in theory exists in the wild.

all As are Bs, but not all Bs are As.

Re:Updated Score

[ryanr]

The Linux in-the-wild score is incorrect.

I've personally analyzed at least three Linux viruses that were found in the wild. And that's not counting the worms.

Re:Updated Score

[0racle]

There are Linux viruses in the wild, you just have to be a complete idiot to get them. I have had the pleasure (hey this doesn't happen often) of seeing an old Linux install that had one when the company I worked for was hired as an outsourced IT department. Ok, technically it was a back door, and for the curious, this was it: http://www.trendmicro.com/vinfo/virusencyclo/defau lt5.asp?VName=ELF_RST.B

Re:Updated Score

[Raistlin77]

all As are Bs, but not all Bs are As.

You couldn't have done better than that? How about all flies are bugs, but not all bugs are flies.

Re:Updated Score

[soft_guy]

All giraffes are nice, but everything nice is not necessarily a giraffe.

Re:Updated Score

[GoombaTroopa]

Yay, Windows is winning!

Re:Updated Score

[Mister Whirly]

Wrong, it has to be a car analogy. All Camaros are cars but not all cars are Camaros. (But if they were, people would probably get to where they were going a lot faster.)

Re:Updated Score

[Anonymous Coward]

My sister was bitten by a giraffe once...

Re:Updated Score

[Anonymous Coward]

All Camaros are cars but not all cars are Camaros. (But if they were, people would probably get to where they were going a lot faster.)

Not really. Consider that when you pass a car that is doing 40 MPH in the fast lane it's probably not the car that is slow, it's the driver.

If you're passing cars on the express way doing 75 MPH I doubt you're "pwning" any of them, they just don't realize that they're in the same race as you are.

Re:Updated Score

[Mister Whirly]

My only point is that Camaros are fast. All other assumptions/allusions are yours. I could care less about trying to "race" people, all I care about is getting to where I am going - fast.

Re:Updated Score

[dreamer-of-rules]

Just to nitpik, no bugs are flies, and no flies are bugs, but some bugs can fly.

Bugs are in the order Hemiptera, whereas flies are in the order Diptera. IANAE.

Re:Updated Score

[Monsuco]

I though the joke on GNU's site was pretty good. It was why Unix has few viruses. It says lets say you want to infect your machine, type wget (virus's URL).tar.gz Make sure you are cded into the right directory. Next untar the virus. Then you must cd into the virus's folder. Next type make to make it. Next log in as root and type make install. Then type install. Run the program. You probably will need to be root if it wants to damage things.

With windows, just do the following, open up Internet Explorer, well that's it, your infected by killer porn ads.

With OSX, you download a copy of the virus, mount it, and then get told that this version only works on PPC and you must run the virus on an emulator. It will have to run slower.

Fortunitly, most linux virus's have been patched.

Re:Updated Score

[Anonymous Coward]

Damn, I wish I had mod points.

Re:Updated Score

[Himring]

Ah, the great unwashed. What would we do without them....

You forget that one microsoft attaboy! is equal to a million apple and linux attaboys! And one apple/linux theoretical vulnerability is likewise calculated to one windows actual vulnerability.

Let's not forget codered: when microsoft, according to the media, fixed the Internet. No one reported that they were the reason codered existed in the first place....

Re:Updated Score

[jmauro]

No, one theory can cover more than one virus. So the theory can be less, or even much less than a specific implementation in the wild.

Re:Updated Score

[Anonymous Coward]

Just to nitpik

And just to nitpick, it's "nitpick".

Re:Updated Score

[WilliamSChips]

Are you sure you're not talking about rootkits?

Re:Updated Score

[ryanr]

They were file infecters, and also installed listeners and phoned home. They tried to use a couple of minor stealth features, but I don't think you could call them rootkits.

RST.a
RST.b
OSF

Re:Updated Score

[PrinceOfStorms]

Only because the Linux and OS X scores are still undefined. One Linux virus in the wild and it's Linux by 862 points!

Re:Updated Score

[noidentity]

On the other hand, Mac viruses in theory just increased infinitely (1/0), whereas the others increase monthly by a finite amount. The end of Apple is near, with such a huge increase! Next theoretical virus, a 50% (!!!!!) increase.

Re:Updated Score

[Anonymous Coward]

But it was a *nice* bite.

Re:Updated Score

[dreamer-of-rules]

Doh! My bad.

Learn to read

[daveschroeder]

What I said has nothing to do with whether something needs privilege escalation or not. At all.

In fact, my own little "rm -rf ~/*" joke doesn't require any privilege escalation at all and can delete the contents of your home directory with no further warning. Something as simple as that can be bundled up with Platypus by anyone who can click a mouse as a little trojan that looks like any other Mac OS X application.

Think that's "stupid"? It's just as stupid as this "virus" proof-of-concept that does nothing more than show that it can be appended to a file. It doesn't spread, and has no vector for propagation. Before you say "well, all someone has to do is find a vector!"

Um, yeah. That's the hard part, "nitwit".

Re:Learn to read

[geoffspear]

Well, if you're foolish enough to give yourself privileges to your home directory, you deserve what you get. This is exactly why every file on my system is readable only by root.

Re:Learn to read

[Sqwubbsy]

It's why I come to /. - for tips like these.
Man, I wish I had thought of this sooner...

Re:Learn to read

[Tim C]

this "virus" proof-of-concept that does nothing more than show that it can be appended to a file. It doesn't spread, and has no vector for propagation.

No vector for automatic propagation, perhaps. I'm old enough to remember viruses back in the days before the Internet and email, though, when they were spread via infected floppies. Hell, just the other week there were stories here about a McDonalds flash-based mp3 player that shipped with a virus, and another about an infected batch of iPods.

No vector for propagation? I wouldn't be so sure if I were you.

Re:Learn to read

[molarmass192]

Floppies!!! Pffffft, I remember when viruses were spread via punch cards. The nasty HangingChad2000.pdp8 virus immediately springs to mind!!!

Re:Learn to read

[Theaetetus]

Well, if you're foolish enough to give yourself privileges to your home directory, you deserve what you get. This is exactly why every file on my system is readable only by root.

"sudo chmod *.* 000"

Re:Learn to read

[xwipeoutx]

What about all those files without extensions? /bin/dd comes to mind (along with everything else in the directory)

Re:Learn to read

[QuantumG]

Huh? It spreads when you copy the executable to give to your mate, same way every virus spreads.

Re:Learn to read

[the.house]

Agreed, I always thought the term virus should at least imply automatic propagation.

Re:Learn to read

[BorgCopyeditor]

Oh, we used to dream of propagating viruses via punch cards! We used to have code viruses that would be able to throw the switches on the face of the Altair 8800 on which they were running. It was hard, but we were happy. And you try and tell the young people of today that ..... they won't believe you.

Re:Learn to read

[Weedlekin]

Switches? We'd have given _anything_ for some switches. Our viruses had to knock on the sides of mercury delay line memory tubes with tiny hammers, and we had to get up at 5 in the morning and make the hammers out of small nails by sticking bits of broken glass in our tongues to use as anvils, then our dad would beat us with wi' metal reels of paper tape to show us what would happen if we didn't do it right.

Re:Learn to read

[hobbit]

Broken glass for breakfast? Oh, unthinkable luxury! We had to cut off our own tongues with cheesewire, before we were even born, and block up our ears with tarmac, so that the viruses could live in our cerebellums unhindered by human language, and every ten seconds our machine masters would electrocute us to stimulate mutation. What we would have given for a bit of a beating to give some colour to the day!

Viruses, worms, malware, and OS X

[linguae]

Anybody can create a virus for OS X, and it can run perfectly. The biggest problem would be how it can be able to spread to other machines.

On Windows, it isn't viruses that plague Windows, but it is worms, spyware, and adware that affects that platform. All it takes to be infected with a computer virus on any platform is to not be vigilant about the data that you download. Being infected by spyware and adware, however, relies on the security of the browser, and being infected with a worm relies on the security of the operating system's Internet connectivity.

OS X remains relatively secure because its browser does not have hooks to the shell (unlike older versions of Internet Explorer, although I've read that Internet Explorer 7 has been decoupled from the shell), and because its Unix core isn't susceptible to worms (Unix has come a long way since the worm of 1988). OS X also has a firewall, although I just learned that it isn't enabled by default (but turning it on is easy; they should change the default in OS X 10.5).

A demo virus for OS X or Linux isn't news. No operating system can block the execution of a virus unless the operating system has a list of trusted applications that it knows are virus-free. An operating system can prevent worms with better security, and spyware can be prevented by using a secure browser, but viruses cannot be blocked from execution.

Re:Viruses, worms, malware, and OS X

[geoffspear]

I can write a program that will completely destroy your Mac even if you delete every single shell you have installed. I don't think "the shell" means what you think it means.

Re:Viruses, worms, malware, and OS X

[AKAImBatman]

I believe he is referring to the way that Windows Explorer (the shell) handles "executable" files. Faced with a .PIF, .EXE, and a .BAT, Explorer treats them all the same. This allows for theoretically non-executable file (e.g. .PIF) to be executables in disguise.

As for the coupling with Internet Explorer, several URL pass-thrus have been exploited on Windows to force Windows Explorer into executing files passed by Internet Explorer. Thus the coupling between the browser and the "shell" is bad. Finder is a bit more sophiticated with its handling of file types, so alternative extensions and URL handlers don't pose as much of a security threat as they do on Windows.

Re:Viruses, worms, malware, and OS X

[dedazo]

Being infected by spyware and adware, however, relies on the security of the browser, and being infected with a worm relies on the security of the operating system's Internet connectivity.

This is true only if you assume that every single malware and worm infection has been caused by a vulnerability in the browser, which is clearly not the case. I think that the vast majority of infections occur because people are simply naive and careless. Most of the fastest-spreading Windows worms in history have required significant user interaction to be successful. Executables in ZIP files being run by stupid people are the norm, not the exception. They just have to look at that REALLY COOL SCREENSAVER or those NAKED PICTURES of Anna Kornikouva or whatever. They just have to click "Yes" in that IE warning dialog because they just have to look at that cool web page. They just have to install that really cool P2P application their friends are using, which incidentally comes loaded with malware.

Eventually FireFox will gain enough traction that you'll see people installing that REALLY COOL XPI add-in. And who will you blame? Mozilla? No, of course not. In that case it will be the user's fault. Just as it's the user's fault when their Linux box gets pwned - after all, they should patch, right?

There are vulnerabilities and then there is stupidity. Even for remote exploits like Blaster, even if you didn't apply the patch that was released a month before the exploit, a $20 Linksys router would have saved you a lot of trouble.

Microsoft might have neglected security in the name of convenience for a time, and they've had a couple (and I do mean a couple) of nasty breakouts that can be traced to their lack of focus on security. And Windows does have more attack vectors than OS X or Linux. But a lot of the "bad press" they get can be traced directly to a large portion of their 500 million users who simply shouldn't be allowed near a computer, regardless of the OS, because they are responsible for having their machines infested. I suspect that when or if OS X gets 500 million users we'll see much of the same thing. It's not like Unix can magically increase your IQ by 40 points. Unix is just a lot more idiot proof than Windows - the laws of evolution dictate that you'll simply see a dramatic increase in the number of sophisticated idiots. The only way to stop that would be to lock the computer down so hard it becomes useless except for a few "authorized" tasks. You can see this today in large corporations that manage thousands of Windows desktops. Melissa and the "ILOVEYOU" deal taught them well.

Re:Viruses, worms, malware, and OS X

[Anonymous Coward]

OS X also has a firewall, although I just learned that it isn't enabled by default (but turning it on is easy; they should change the default in OS X 10.5).

Why? OS X has no open ports out of the box. You don't need a firewall if you have no open ports.

Re:Viruses, worms, malware, and OS X

[Lumpy]

How about the tiny fact that under windows if you execute an app it is not hard for it to infect system files SILENTLY in such a way that it is utter hell to get it removed again.. Yet I cant see a way of doing this under OSX. OSX pops up a "gimmie your administrator password" box when it runs and every Mac owner I know is paranoid when they see it because it does not happen very often. Under windows, users are so used to warning windows and windows asking permission popping up every 30 seconds during an install or even surfing the web they simply click OK every single time without reading it.

AS soon as someone figures out how to get around that tiny tidbit on a OSX machine ,they will have a successful virus and spyware vector. And I personally cant see it happening in the next decade.

Re:Viruses, worms, malware, and OS X

[Anonymous Coward]

So true. I got in-laws that would get pwned even if they were running OpenBSD.

Re:Viruses, worms, malware, and OS X

[99BottlesOfBeerInMyF]

I think that the vast majority of infections occur because people are simply naive and careless. Most of the fastest-spreading Windows worms in history have required significant user interaction to be successful.

I think you are factually incorrect. The studies I've seen all indicate while there are more malware programs that require user interaction than there are automated ones, there are more infections and they spread faster when they require no interaction. The majority of infections to date are the result of worms that require no interaction from the user.

Executables in ZIP files being run by stupid people are the norm, not the exception. They just have to look at that REALLY COOL SCREENSAVER or those NAKED PICTURES of Anna Kornikouva or whatever.

I agree that a significant number of people will run untrusted executables and that will result in infection. This is due in large part to the fact that Windows does a very poor job of informing the user what is data (and very low risk) and what is an executable (and very high risk).

But a lot of the "bad press" they get can be traced directly to a large portion of their 500 million users who simply shouldn't be allowed near a computer, regardless of the OS, because they are responsible for having their machines infested.

I disagree. The malware on Windows can be traced to the fact that Microsoft has not taken reasonable steps to mitigate a huge problem, simply because they have a monopoly and that problem does not significantly affect their bottom line. If Linux had 50% of the market, including most of those idiots, solutions would have been implemented to make it harder for trojans and the like to infect computers.

I suspect that when or if OS X gets 500 million users we'll see much of the same thing.

I suspect not, because Apple responds to their customers. They've already announced application signing and mandatory access controls for OS X 10.5, that could easily be used to mitigate the vast majority of these malware problems, and OS X doesn't even have a serious malware problem yet. Microsoft should have been the ones pioneering this effort and it should have been in Windows XP at the very, very latest.

The only way to stop that would be to lock the computer down so hard it becomes useless except for a few "authorized" tasks. You can see this today in large corporations that manage thousands of Windows desktops.

Large organizations lock them down hard, because there is no usable middle ground. An OS can be much, much more secure without being useless for all but a small number of tasks. The truth of the matter is, the vast majority of things malware does are things very few or no legitimate programs want to do. When was the last time the average user ever installed a program that needed legitimate access to their e-mail address book and did not ship with their computer? The problem of users installing malware is largely not that of the user, but of the system designer. Until the user knows what they are running, can run untrusted software easily and securely, and is informed of what the computer is doing and given good, granular choices with a good UI... the problem is one with the OS. Once someone does that, then you can start blaming the users as the weak link. For now, weak default services and poor security/UI are weaker.

Re:Viruses, worms, malware, and OS X

[NatasRevol]

Shhhh, don't tell them about @pplescript!

Re:Viruses, worms, malware, and OS X

[Jesus_666]

Note that in the Windows world "the shell" is either the GUI or any kernel interface. The Windows word for "shell" is "command line".

Re:Viruses, worms, malware, and OS X

[ericlondaits]

Not so. You still need a firewall to monitor outgoing connections (which might be launched by malware) and to be protected even if some program (malware or not) decides to open some ports without your consent or knowledge. Also, to make sure you're not giving the same privileges to people in the internet as to people on your LAN (you might have a shared printer or disk).

Re:Viruses, worms, malware, and OS X

[Anonymous Coward]

Really? That sucks, I would figure port 80 would be open as Apple claims you can get on the internet "right out of the box" with Macs. Do you really have to open a port first? If a computer truly had no open ports, what good would it be on a network?

Re:Viruses, worms, malware, and OS X

[Tim C]

Being infected by spyware and adware, however, relies on the security of the browser

No it doesn't; plenty of trojans install spyware and/or adware, no exploits required. (Remember Kazaa?)

I've read that Internet Explorer 7 has been decoupled from the shell

I don't know all the details, but certainly if you type a URL into Windows Explorer after installing IE 7, rather than handling it itself (and morphing into IE), it launches the system default browser to handle it. So if I type "http://slashdot.org" into Windows Explorer, Firefox opens the page.

Re:Viruses, worms, malware, and OS X

[rawg]

"Anybody can create a virus for OS X, and it can run perfectly. The biggest problem would be how it can be able to spread to other machines."

If it can't spread, then it's not a Virus.

Re:Viruses, worms, malware, and OS X

[dedazo]

The majority of infections to date are the result of worms that require no interaction from the user.

I disagree, by simple observation. Every single infected machine I've ever seen infected with something was a direct result of the lack of patching or user action. And believe me, I've seen quite a few.

This is due in large part to the fact that Windows does a very poor job of informing the user what is data (and very low risk) and what is an executable (and very high risk).

It used to. "Used to" being the operative keyword here. From locking down Outlook and OE to implementing the zone bits for downloaded files, I think Microsoft have done as much as they could without risking some severe compatibility problems. Now the backwards compat thing is a hole they dug themselves into, but that can't be changed now.

simply because they have a monopoly and that problem does not significantly affect their bottom line.

If you think that Microsoft is not doing X because "they have a monopoly" then I can't really help you. They have 30 billion dollars in the bank and they've done as much as they can without, again, breaking just about every corporate Windows environment in the planet. And if you think it doesn't affect their bottom line, watch those stupid Apple ads sometime.

I suspect not, because Apple responds to their customers.

Once Apple has 400 million customers we'll see how fast they patch those holes that even now they've been taking altogether too long to patch in some cases, and in other patching silently before anyone knows what's going on. You are perpetuating the "LOLOL M$ dosen't patch" bullshit that they used to deserve seven years ago but is no longer true. I dare you to show me an instance of Microsoft failing to patch something since Windows 2000 was released. Now if you're complaining because they don't patch fast enough for you, I'd wait until Linux or Apple have to test 30,000 different combinations of hardware and software before releasing a patch and then we'll talk.

The problem of users installing malware is largely not that of the user, but of the system designer.

I think not. You cannot engineer away stupidity without making the device useless. But since we have no frame of reference, I guess we'll have to wait quite a few years to find out.

Re:Viruses, worms, malware, and OS X

[ceoyoyo]

You don't need a firewall to protect against external threats if all your ports are closed by default.

Re:Viruses, worms, malware, and OS X

[ceoyoyo]

Notice that I said "external threats."

To differentiate between people on your LAN and those external to it you really need to have your LAN firewalled. You shouldn't be depending on a software firewall on your machine to do that.

Which leaves the firewall to watch for OUTGOING traffic from your computer. Personally I don't think a piece of software running on the same machine it's supposed to be watching should be trusted anyway.

Re:Viruses, worms, malware, and OS X

[Anonymous Coward]

You'd better tell shell32.dll (some 8MB) and its many related libraries (like shdocvw.dll short for shell document view, shlwapi.dll for shell lightweight api, etc. x 20), which literally have been implementing the shell in Windows since NT 3x and Win95. Perhaps the term you're looking for is "command prompt"?

Re:Viruses, worms, malware, and OS X

[99BottlesOfBeerInMyF]

I disagree, by simple observation.

Okay, by simple observation I have worm propagation, and malware signature detection statistics for thousands of infected hosts right now and the vast majority are definitely automated. Of course neither of our observations mean much, which is why there are formal studies presented and peer reviewed at several conferences each year. I haven't seen a lot of disagreement about this topic.

From locking down Outlook and OE to implementing the zone bits for downloaded files, I think Microsoft have done as much as they could without risking some severe compatibility problems.

I disagree. They could do a whole lot more, starting with good, default ACLs for all executables, separating the execution path of executables and scripts from that of data, and elimination of thousands of useless "OK/Cancel" dialogue boxes that condition people to click "OK" to everything.

If you think that Microsoft is not doing X because "they have a monopoly" then I can't really help you.

MS has little in the way of financial incentive to fix this problem. Break them up into two companies, each with the full rights to the code to date, and this problem will be solved by one of them in 3 years.

And if you think it doesn't affect their bottom line, watch those stupid Apple ads sometime.

I said it does not significantly effect their profits. After years of this situation and those ads Apple has taken what, another 2% of the market away from them? It does not justify the cost of fixing the problem properly.

Once Apple has 400 million customers we'll see how fast they patch those holes that even now they've been taking altogether too long to patch in some cases...

In market terms "too long" is anything that adversely affects their customers purchasing decisions. I haven't had any malware problems on my mac. Have you had any on yours? I didn't think so. So how can they have taken too long?

You are perpetuating the "LOLOL M$ dosen't patch" bullshit...

This is a strawman argument. I never mentioned patches. I said Apple responds to their customers. Because Apple knows people have other choices, they do respond to fix any major problems for their users. This includes security issues.

I think not. You cannot engineer away stupidity without making the device useless.

Here's a TV. When you turn to certain channels, it will call the president and threaten him using a cell phone hidden in it. We're not going to tell you which channels though and we're going to change which one occasionally. So long as you always switch to an even channel then a prime number, then an odd channel that isn't a prime number, however, we'll keep the phone deactivated, except on special days which we'll announce in a mix of broken English and Greek on the radio occasionally. Simple, huh?

That is about the state of Windows today for the average user. In order to securely perform common tasks the user must plan ahead, learn obscure knowledge that has nothing to do with the task they want, and constantly monitor channels that speak technobabble, when all they want to do is get their work done or browse porn. The OS can be silently compromised, especially if they don't buy an add on device they don't know about, random data will do things and random games they download will have access to parts of the system they have no business accessing. Worse, the UI doesn't even let them know when it starts sending thousands of e-mail messages so they can pull the damned plug. It is a mess and people like you who want to blame people for not spending several years learning esoteric information simply to use a common tool are part of the problem. You have to make a second user account to run a program with lesser privileges... and this makes sense to someone? And there are still hundreds of unpatched local exploits so even then you can't be sure it will work.. and this is okay?

Right now, as a pretty

Re:Viruses, worms, malware, and OS X

[dedazo]

I haven't seen a lot of disagreement about this topic.

Huh? I haven't seen a lot of agreement about this topic. And if there are infections that are being automated they are the direct result of not patching the box, period. WTF?

They could do a whole lot more

Not without breaking everything. And that "conditioning" you talk about exists in all software, Microsoft is hardly the only ones that default to that sort of behavior. If you're going to complain about something at least first look around to see if everybody else is not doing it as well.

It does not justify the cost of fixing the problem properly.

Good lord, what part of "breaking everything" did you miss back there?

I haven't had any malware problems on my mac. Have you had any on yours?

ROFL. So why haven't you? Because Apple has a 2% market share? Or because OS X is so much more secure? Make up your mind.

Here's a TV.

That's nice. Apropos because the PC is like a TV in that it has a fixed number of inputs and outputs, one way to interact with it and exactly one possible configuration state. Right?

Microsoft is guilty of transfering the burden of trust completely to the user. Idiot users then are then essentially screwed. Free software and Apple will "fix" this by taking the decision away from the user, and idiot users will simply become more sophisticated. That should be a gas, but it will be as broken as it is now. If the user finds Microsoft's "solution" unpalatable then they should switch to OS X, where they'll get the "Please enter your root password" dialog every time they download and try to run some malware. I'm sure they won't do anything dumb. And they'll patch their boxes religiously, unlike they did with their Windows boxes. After all, we all know using OS X increases your IQ automagically. Yeah, that system you seem so confident will someday exist is going to be interesting to watch.

because they're looking at the mess on Windows and taking preventative measures.

Whoa, and here I thought Microsoft was "incompetent" and Linux and OS X were inherently superior and ready for the perfect storm of 500 million people suddenly poking and prodding them. Interesting.

Re:Viruses, worms, malware, and OS X

[walt-sjc]

I've read that Internet Explorer 7 has been decoupled from the shell

Yeah, but it still has hActive-X which is worse anyway.

Re:Viruses, worms, malware, and OS X

[Watson Ladd]

You mean worm. A virus infects files, a worm other machines.

Re:Viruses, worms, malware, and OS X

[99BottlesOfBeerInMyF]

And if there are infections that are being automated they are the direct result of not patching the box, period.

First, whether or not it is the result of not patching is not the point. Second, your argument does not even address what I said. Third, adding the word "period" just before you use the punctuation point is redundant.

And that "conditioning" you talk about exists in all software, Microsoft is hardly the only ones that default to that sort of behavior. If you're going to complain about something at least first look around to see if everybody else is not doing it as well.

"Everyone else is doing it," is not a valid reason to do something that doesn't work. As for what others are doing, a lot of UIs take these things into account. For example, the OS X UI presents actual actions pertinent to the dialogue box, rather than using the same two button names "OK/Cancel" even when those option make basically no sense. Also, other UIs require at least two options, instead of present ing useless boxes that just say "OK" and give the user no option to do anything but be conditioned one more time. Finally, other UIs don't have nearly as many unneeded dialogues so that people pay attention to the ones they do see.

MS's implementation is a disaster and if you've ever been to a presentation on Human-computer interaction they've probably used it at least once as an example of what not to do, as do dozens of texts on the subject.

Good lord, what part of "breaking everything" did you miss back there?

...the part where you presented an argument or support or anything other than an empty assertion that your belief is true.

So why haven't you? Because Apple has a 2% market share? Or because OS X is so much more secure?

OS X is more secure, partly because it has about 6% of the market and the benefits that brings, and partly because of other design decisions, but all of that is beside the point.

Apropos because the PC is like a TV in that it has a fixed number of inputs and outputs, one way to interact with it and exactly one possible configuration state. Right?

Actually both computers and TVs have multiple inputs and outputs and configuration states. PCs have more, but that changes the principal not at all. You've provided no support for why you think users without the proper information from the OS, granularity of control from the OS, who are basically lied to by the OS, and who want to do a simple series of tasks, mostly ignored by the developers of the OS, should be held entirely accountable for their problems. Sorry, but OS designs, especially Windows, ignore what users want to do and what they need to do that.

Idiot users then are then essentially screwed.

Ahh, idiot users I know who had their Windows machine compromised by malware include three people I now with genius level IQ's (two physicists, and a biologist), an entrepreneur I know who grew up in poverty and has made himself millions, and a very well regarded security researcher who you've seen talk if you've been to any of the major security conferences in the US in the last decade. Gee, if only those people weren't such idiots.

Free software and Apple will "fix" this by taking the decision away from the user, and idiot users will simply become more sophisticated.

Who said anything about taking decisions away? Users of a system with MAC can do anything they can on one without, and more, because they can control security with more granularity. It is giving users a knife and a book on whittling when they want to carve figurines, instead of just a chain saw like they have now.

...where they'll get the "Please enter your root password" dialog...

What a pathetic strawman. I gave you an example of the type of question they would be asked. You've ignored it because you don't want to argue rationally, only try to suppot you random, uneducated beliefs.

Re:Viruses, worms, malware, and OS X

[dedazo]

ROFL, it's always good to see the art of "missing the point" is not lost on slashbots, even the ones who can articulate full sentences. You danced around my basic argument so beautifully and brought up so many non-sequiturs that I'm getting a headache just going back through your posts and trying to make sense of what you were saying. Have a nice life.

MOD parent up!

[Anonymous Coward]

MOD parent up! Troll? are you kidding me?

so symnatec created another virus

[Anonymous Coward]

So they create virii to sell their product. Sounds like they are the problem. Maybe M$ isn't wrong to cut them out of the picture.

I am Nigerian roolaty.

[khasim]

I have many millons of dolars US from untimely death of ambasador.

Pleese go to your local hardware store and purkhase a hammer or mallot.

Returning to home, you shuld use the hammer or mallot to be smashing your computer to small peeces.

I will deposite many millions of dolars in your bank akount when you have finished.

Sincerely,
Nigerian roolaty.

Norton Internet Shakedown 1.0

[Cid Highwind]

Symantec to Mac users: "Pretty little Operating System ya gots there. Be a shame if somethin' unfortunate happened to it. Maybe you should hire a little protection..."

I guess this answers the question about whether Symantec can continue to sink to new lows of sleazy business practices after suing Microsoft for securing their kernel.

Re:Norton Internet Shakedown 1.0

[Anonymous Coward]

I guess you and I are the only ones who can see what's REALLY going on here, Cid. Money talks, Symantec/McAffee both need the revenue.

Re:Norton Internet Shakedown 1.0

[ChicagoBiker]

Amen to that!!! This is freakin' laughable. A company that sells software to protect against viruses has just created a VIRUS for a system that doesn't have ANY and for-which it's users have NO NEED for their product? LOL. Isn't this illegal?

Re:Norton Internet Shakedown 1.0

[mspohr]

Symantec is getting pretty desperate... now they have to write their own viruses to get people to buy their anti-virus software.

Re:Norton Internet Shakedown 1.0

[uniqueSnowflake2]

Are you sure that they haven't already been doing that?

Re:Norton Internet Shakedown 1.0

[Roskolnikov]

This does answer another question; Apparently Apple is doing well enough with growing its user base that Norton wants a piece of the pie....

I suppose this is their form of 'viral' marketing.

Re:Norton Internet Shakedown 1.0

[kinglink]

There's numerous theories about how certain viruses got created. Some of them involve Symantec in some way. This is the first time they admitted it.

If you think this is the first virus Symantec ever created you're pretty naive, that's their business (basically to create viruses in test beds and try to find better heuristics for detecting them).

However personally I think this the most benign virus they've create I certainly don't think they've never released a virus to the public accidently.

Re:Norton Internet Shakedown 1.0

[ceoyoyo]

And they're not very good at it.

Re:Norton Internet Shakedown 1.0

[jafac]

Honestly, in the 10 years since I've been a "Mac man" - Symantec has done far more harm (in the form of instability, hangs, kernel panics, and impossible-to-remove software) to my home computer systems than any virus ever did.

Re:Norton Internet Shakedown 1.0

[TechOgre]

So, it was always released on purpose?

Lies

[Anonymous Coward]

Of course the first responses are die hard mac cultists... just the simple fact that this was released.. i think thats deserves a bit more attention then just blowing it off.

I really like the part where they say its a "secure" system, well.. its running bsd... hello.. buffer overflow?

If you really think you're totally secure.. you'll be the first to go.

Re:Lies

[rahrens]

Just where in this forum did you read that any of us think we're TOTALLY secure? Moronic coward...

Tire sales

[lancejjj]

OSX.Macarena is a proof of concept virus that infects files in the current folder on the compromised computer.

News: An anti-virus software vendor decided to have a Mac OS virus created in order to improve the sale of Anti-Virus software.

Related news: A tire changing shop decided to dump a box of roofing nails on the road approaching their shop in order to sell tires.

What's the difference?

Re:Tire sales

[bunratty]

The Macarena is different because of that cool dance that goes along with it. Hey Macarena!

Re:Tire sales

[db32]

Because people understand the concept behind nails and tires and don't understand the concepts behind viruses. To make it more accurate...
Related news: A tire changing shop decided to show how a carniverous squirrel can chew through a tire, and then started selling squirrel proof tires.

Re:Tire sales

[Anonymous Coward]

What's the difference?

Cool! Free roofing nails! And traffic has really slowed down so it's easy to pick 'em up.

Wait, what was the question again?

cut the vapourware crap

[Anonymous Coward]

I want to see a real virus

Re:cut the vapourware crap

[soundonsound]

I want a pony...and some ice cream.

So its true!

[SirDrinksAlot]

The anti-virus companies *ARE* responsible for all the viruses that are made!

Seriously, it's just flat out fear mongering trying to MAKE a market for them selves.

Maybe they need to engineer some viruses for QNX too? There's a market they haven't tapped yet, all those bank machines and robots in factories are running with out virus protection!

I for one welcome our virus laden QNX based robot overloads.

Re:So its true!

[slim]

The anti-virus companies *ARE* responsible for all the viruses that are made!

I have long believed this to be to be more or less the case.

Maybe not all viruses, and maybe not all anti-virus companies, but to stoke up the AV market by chucking a few thousand dollars to some shady programmers in return for them writing virii seems too obvious and idea for it not to happen.

Re:So its true!

[Mister Whirly]

Not that I don't love a good consipracy theory, but do you really think all those shady programmers would be able to keep their mouths about what they have done? The hardest part of a conspiracy is not pulling something off, but keeping everyone who knows about it either quiet or dead...

Re:So its true!

[poopdeville]

Sure, but the sleazy programmer wouldn't have to know who he was working for. Even if he talks, he'll have nothing interesting to say.

Re:So its true!

[Mister Whirly]

If a story came out a programmer was hired by an anonymous "suit" to write a virus, it would be interesting even if the "suit" was unknown. I mean look at all the articles popular on Slashdot without anything interesting to say...

And we have editors... why?

[nsayer]

Heise Security has a report about new Proof of Concept virus for Mac entitled as OSX.Macarena by AV vendor Symantec.

The wording implies that the virus itself was written by "AV vendor Symantec," where I'm bloody sure that the intent was to say that the report was by Symantec.

Many commenters have fallen into this trap and have lambasted Symantec for authoring proof-of-concept viruses in order to boost sales of their AV product.

That's not to say that they don't engage in FUD, or that it's not possible that they have gone further. But a poorly worded story summary is certainly not proof.

Re:And we have editors... why?

[Jesus_666]

The wording implies that the virus itself was written by "AV vendor Symantec," where I'm bloody sure that the intent was to say that the report was by Symantec.

Actually, I think the virus was entitled OSX.Macarena by Symantec. It's amazing how you can put three meanings in one sentence.

Re:And we have editors... why?

[ThorGod]

Please, kind sir, explain for us all where it is this intent comes from and how the implication of the statement is less valid than the intent you probably read into the article?

Re:And we have editors... why?

[nsayer]

If you think that it's more likely that Symantec wrote the virus than that they simply wrote a report on the virus, then there's no talking to you.

OMGZ!

[Rodness]

I'm going to rush right out and buy Symantec Antivirus for my Mac, because I'm scared now! Proof of concept means it actually works in the real world, right???

</sarcasm>

Umm, wrong malware? Solution in the works?

[99BottlesOfBeerInMyF]

Those of us following malware in general and OS X malware in particular already heard about the new metasploit module for OS X exploit released recently that supposedly exploit an unpatched hole in the wireless drivers that shipped with some powerbooks an imacs. It has a lot more potential as a real security issue than this reported proof of concept, since this one has no automated mechanism to spread and no remote vulnerability or any vulnerability for that matter. It is simply code running as it is supposed to with the privileges it is supposed to have. It is no more the result of a flaw in the system than "rm" is.

As for this "virus" it is a demonstration of a problem, but one that is so widespread and common it will be dismissed by the majority of the security community out of hand. The problem is, this code (when run) has permission, by default, to do too much and the user is not notified by the OS of what it is doing. The same can be said of most any desktop OS these days. The granularity of permission is basically: none, everything the user can do, or anything. That is insufficient to deal with software that may or may not be trusted.

Interestingly enough, Apple has announced the inclusion of application signing and Mandatory Access Controls in OS X 10.5. Theoretically, unsigned applications like this could be placed in a very limited trust level by default and as such, would not have permission to edit random user files because the MAC ACL would stop it. Viruses and trojans would have a big roadblock. Imagine downloading some random program like this, double clicking it, and OS X informing you not only that it is a new application, but also pulling up a dialogue that says something like "The application 'macarena.sh' wants to modify 122 applications in your Applications folder. This behavior is characteristic of a virus. (stop it from changing them)(let it change them)(view advanced options/details)."

I'm keeping my fingers crossed that Apple is the first to bring SELinux's granularity of security to grandmother's everywhere in a usable way.

Re:Umm, wrong malware? Solution in the works?

[toadlife]

"I'm keeping my fingers crossed that Apple is the first to bring SELinux's granularity of security to grandmother's everywhere in a usable way.

Unless Windows Vista is pushed back again, it should be first to bring these features to the masses.

Re:Umm, wrong malware? Solution in the works?

[noidentity]

I would love to have fine-grained permissions for each application, authorizing what directories it can write to. This would allow me to try new software without giving it much trust, by limiting it to its own directory and a test directory. Many programs only use a subset of files, like music or pictures, and shouldn't be accessing any other directories. Of course for your example, the main Applications folder is read-only if you're using a non-admin user, so a virus would be stopped already. Would be nice to be notified of any programs even attempting to modify the Applications folder, including merely getting the permissions (since otherwise a sneaky virus could check this first in order to avoid raising any suspicion). The key is to find a simple set of parameters that closely approximate the ideal situation of letting an application do only what it needs and notifying the user if it attempts anything otherwise.

Re:Umm, wrong malware? Solution in the works?

[99BottlesOfBeerInMyF]

Even Windows XP has most of the plumbing needed, the problem is it has not been implemented in a usable way in Vista (from my brief tests). The MAC has been in various OS's for years and Solaris has even has some reasonable UI, but no one that I've seen has built reasonable default ACLs or a usable GUI and integration with the OS. Until they do, this will be a feature for OS developers and a few security geeks.

Yeah... Something That's Always Bugged Me...

[Greyfox]

Seems like Apple packages by default contain all the libraries and things they need to run -- an offshoot of the NeXT packaging system. Shared libraries don't seem to be as heavily used on OSX. So why not by default chroot installed applications and possibly setuid them to "nobody"? Possibly even drop a strong capability model in there so that the application has to request permission to do stuff like open network connections or listen on sockets. The regular end user might still just blindly accept everything but it'd make it a lot harder for an executable to do any damage in the default sandbox.

Re:Yeah... Something That's Always Bugged Me...

[99BottlesOfBeerInMyF]

So why not by default chroot installed applications and possibly setuid them to "nobody"? Possibly even drop a strong capability model in there so that the application has to request permission to do stuff like open network connections or listen on sockets. The regular end user might still just blindly accept everything but it'd make it a lot harder for an executable to do any damage in the default sandbox.

For Leopard, Apple has ported TrustedBSD's mandatory access controls, so even if Apple doesn't do this, you should be able to with a small script. Or, you can grab the unofficial port and install it yourself on Tiger today. I have a lot of hope for Apple bringing this tech to the unwashed masses in Leopard, but it is more likely that it will just be a cool security feature used by power users that are savvy enough to know it exists.

Re:Yeah... Something That's Always Bugged Me...

[Anonymous Coward]

Apps running as nobody on OS X can't get a connection to the window server. I know this because my app can't run using Xgrid as without using SSO/Kerberos to provide a user Xgrid runs apps as nobody, and my app can't run under those conditions because it uses some of the higher level frameworks which need a window server connection. If I could strip all that stuff out then it wouldn't be a problem.

Regards,

Jo Meder
AC because he can't log in right now

Feeling Afraid Yet?

[Anonymous Coward]

http://www.clamxav.com/

I personally use this with the Folder Sentry to scan all incoming files and mounted disks. Is it because I'm afraid of a 0day OSX uber exploit? No, it's because I also have windows machines on the network sharing files and would rather not help spread the joy in case something did manage to get through. So, thank you Symantec for showing a proof of concept to us all. Release it out to the community and I'll be just fine with ClamAV. But even if you don't, I'm not losing sleep.

Demo?

[PhoenixK7]

Is it time limited or missing functionality? Where do I find the full version? Can I find it ac CompUSA?

Re:Demo?

[johnshirley]

Don't worry, Microsoft will make sure that a fully-functional version is included on a small percentage of Zunes.

A demo virus?

[admactanium]

it's a demo virus huh? well, i'll try it, but if i don't like it, i'm not paying the shareware fee for it.

Re:A demo virus?

[ElephanTS]

right, that's exactly what I thought. Is the #SN available at serialz.to yet? To be honest I haven't seen a virus since the 90s and wouldn't mind one again now. Oh the boredom of the OSX platform . . .

Re:A demo virus?

[stuz]

I'm sure the licence fee won't be extortionate if there is indeed a fee!, as Windows users get them for free is hardly seems fair to make a mac user pay for having it, they'll just use windows for it instead.

Yeah sure

[snuf23]

Readable by root eh? As IF you can trust that guy!

Yawn

[DoctorPepper]

I'm so worried about OSX malware and viruses that I went out and bought my wife a brand new MacBook Pro, which is our third Mac. And I won't be running any AV software from Symantec on it either.

I guess they figure if they keep stirring the pot, eventually the "less technically savvy" OSX users will get scared and buy their Norton Antivirus for Macintosh.

Re:Yawn

[blacksmith_tb]

No one seems to have mentioned that ClamAV has been ported to OS X. Not terribly user-friendly, but being free can encourage people to put up with jumping through some extra hoops...

You trust root?

[digitalcowboy]

Well, if you're foolish enough to give yourself privileges to your home directory, you deserve what you get. This is exactly why every file on my system is readable only by root.

Please tell me your files aren't writable by root, too. Talk about a security hole. All that's needed for malicious code to screw up your system is root access! I don't know about Linux or other insecure operating systems, but OS X can be properly secured with a simple: "sudo schg -R /"

I can't imagine why anyone would ever need to modify files outside of single-user mode anyway.

Re:You trust root?

[toadlife]

"I don't know about Linux or other insecure operating systems, but OS X can be properly secured with a simple: "sudo schg -R /"

I'm sorry to burst your bubble regarding the super-duper security of OSX, those files can unlocked just as easily with this command...

"sudo chflags nouchg -R /"

But I have good news for you. You really can keep root from touching certain files. All you have to do is install an "insecure operating system" like Linux and use SELinux.

Re:You trust root?

[toadlife]

Oops. Methinks something might have whooshed over my head a few minutes ago.

Sorry.

Re:You trust root?

[digitalcowboy]

Your sense of humor is broken. I wouldn't reply just to point that out. In this case, you're also wrong.

Re:You trust root?

[digitalcowboy]

I replied before I saw that you caught it yourself.

My apologies as well.

Re:You trust root?

[toadlife]

"In this case, you're also wrong."

I'm assume because the system would be completely hosed (I envison a kernel panic and subsequently un-bootable system) after running the first command?

Re:You trust root?

[digitalcowboy]

Probably that too, now that you mention it. But what I was referencing is that I think you confused schg with uchg. The "u" in the "nouchg" you used is for "user immutable" while the "s" is for "system immutable." Once the schg flag is set not even "normal" root can remove the flag. It can only be removed by booting into single-user mode.

That's part of what prompted the (attempt at) humor in my original post - I had just recently read the documentation on these flags and thought the schg flag seemed rather ridiculous. I don't know in what circumstance it could possibly be deemed necessary (in preference over even the uchg flag). It seems quite extreme for any purpose, to me. If you feel the need to lock out root, you have problems that cannot be solved with a filesystem.

Re:You trust root?

[mysidia]

The schg flag combined with the kernel securelevel setting can actually be used to make a BSD system fairly tamper-proof.

In this case, the kernel, init, the static utilities in /bin, the system startup scripts, and every program/subscript they invoke would be flagged schg.

With securelevel set to 2, which blocks opening /dev/kmem or any disk's device, other than to mount it; this provides significant protection against a rootkit being applied to the system (barring a kernel vulnerability).

poor symantec

[wardk]

how sadly pathetic (not)

with MS putting them out of the windows protection racket, could they trying to seed a new market in OS X ??

Ho hum, annuder Mac Virus

[Orion Blastar]

Switchback was not really noticed that much either. It only could infect 7 to 8 million OSX based Macs. Still it shows that AppleScript and Safari are weak links in the OSX armor that can be exploited by someone if they try really hard enough to make it work with newer versions of OSX.

Mac Users are like the old Amiga users, thinking that their platform is so secure that no virus is written for it, so there is no need for antivirus programs. The Amiga users figured this, because MS-DOS was targeted by virus after virus (they infected floppy disk boot sectors back then), and that AmigaDOS would not be targeted by virus writers. That was 1986-1989, and in the 1990's viruses were written for AmigaDOS and Amiga users got infected and didn't know it because they refused to run antivirus programs. Then it was on demo disks that people always spread around to show off what the Amiga could do, the viruses infected those disks and Amiga after Amiga.

Hackers should target Mac users, because chances are a Mac user has more money than a Windows user, and the Mac user is less likely to run an antivirus program. Just read this article with all of the comments from Mac users saying how a real virus won't infect their system.

Re:Ho hum, annuder Mac Virus

[jdigriz]

ZOMG, you mean people wrote viruses for the Amiga *after* Commodore went bankrupt? Now that's what I call community-based support!

Re:Ho hum, annuder Mac Virus

[99BottlesOfBeerInMyF]

Switchback was not really noticed that much either. It only could infect 7 to 8 million OSX based Macs.

Umm, the exploit was released after it was patched, three years ago, if I recall. Given automatic update, not much of an issue. I don't think I've ever seen it and I have a signature running against a class A and then some.

Still it shows that AppleScript and Safari are weak links in the OSX armor

Of course the browser will always be a weak spot, it's going on to the Web and constantly downloading untrusted files and scripts from anonymous people. This is true of all Web browsers.

Mac Users are like the old Amiga users, thinking that their platform is so secure that no virus is written for it, so there is no need for antivirus programs.

And there is an even bigger security hole than anyone thought, as you can apparently read the minds of all Mac users, and thus rifle around in there until you get their passwords, SSNs, and even their deepest, darkest secrets they never told anyone.

Hackers should target Mac users, because chances are a Mac user has more money than a Windows user, and the Mac user is less likely to run an antivirus program.

Both of these are true, but the skillset of the average cracker is very Windows-centric and there are a lot less vulnerable services to exploit by default on a mac. Basically, while some things make it a better target, other things make it a lot worse. It is crackable, but really hard to make good worms.

Just read this article with all of the comments from Mac users saying how a real virus won't infect their system.

Right now Macs are better than Windows and a smaller target. Better yet, Apple has been staying on the ball and 10.5 promises to be better yet, even with the possibility of stopping trojans and viruses like this. In truth, mac users are somewhat justified in their warm fuzzy feelings.

Re:Ho hum, annuder Mac Virus

[Orion Blastar]

As a Psionic being, I can tell you that simpler minds are easier to read than more complex ones. Mac users have simple minds and need a simple OS to work with.

Common Mac user passwords:

money, sex, insanelygreat, thinkdifferent, windowssucks, god, stevejobs, itunes, love, happy, and bukkake.

Virii are not a problem (yet) but UNIX can be

[NCG_Mike]

Of more concern are exploits in the UNIX level of the operating system.

For one, I can recall someone logged into my MacMini over ssh as root when I'd disabled root logins for ssh and had two user accounts. I informed the host provider of the hack (I used "lsof | grep TCP" to see the open sockets), rebooted the machine and switched the incoming ssh port to something that wasn't 22 and disabled ping to the router (HomePortal 100W). FWIW, root account is disabled (default behaviour) but sudo is enabled for both accounts.

The user accounts used keys for ssh to avoid passwords but I've switched them back to passwords since been told by a Linux guru that it was a good idea incase the client was hacked. Makes sense of course. As it happens, the clients were Windows and the other another Mac coming over here (Belgium) from the UK (svn+ssh specifically).

I only noticed as there was a lot of activity on the DSL modem lights. I was blown away that it had happened and installed "snort" (http://www.snort.org/) on the MacMini along with watching the security logs a bit more and "chkrootkit" (http://www.chkrootkit.org). Of course the system has software update enabled and I regularly update the installed Fink tools on it.

Whoever it was was very good, IMO. They did no damage mind, which I'm thankful for. I guess they were using it as a hop to their target site.

As a long term NeXTStep and Mac developer, I have a lot of UNIX level experience so I could solve the issue. 99% of Mac users wouldn't be able to but then again they wouldn't have sshd even running (default behaviour). I bet a lot of them enable ftp though.

Re:Virii are not a problem (yet) but UNIX can be

[99BottlesOfBeerInMyF]

Of more concern are exploits in the UNIX level of the operating system.

Not speaking to your specific issues, but OS X and most Linux distros are in the same boat when it comes to general security. It's hard to make a worm for them, the average script kiddie won't cause you any problems, but a dedicated hacker or security expert can get in if you leave any openings (like sshd without a firewall). This could be just a dictionary attack on a weak password or it could be an unpublished exploit in some other service.

OS X machines are fairly safe in that the chances someone will hack them are very small because the number of people doing such hacking is very small. Make no mistake, however, neither OS X or most Linux distros are a locked down, super secure system, safe from a skilled expert. If someone is gunning for you or you have really valuable data you might want to consider performing some serious hardening and deploying some countermeasures.

Security is not Apple's top priority, but I'm still happy to see them taking reasonable measures for a consumer grade OS. I look forward to the new security features in 10.5 and I hope as more and more of the security community starts to use OS X as a workstation, we'll see more people banging on it and making it a bit tougher.

Re:Virii are not a problem (yet) but UNIX can be

[NCG_Mike]

In my case, the setup has a firewall on the router so the only open connection was port 22. The mini didn't have ipfw running. I'm pretty sure it was a hack on ssh as passwords were actually disabled and only keys were allowed. I noted that about a month later, Apple did a software update that fixed an exploit with ssh. Dunno if it would have solved my issue, of course. I have some experience in cracking and software security myself... I started out cracking games on the C64 and later on the Amiga. I even worked on a Mac product to do copy protection for some *very* popular apps... most Mac users will have my software running but they won't realise ;-D Just pointing out I'm in no way a novice user and I was hacked.

Re:Virii are not a problem (yet) but UNIX can be

[argent]

I think you're barking up the wrong tree.

The user accounts used keys for ssh to avoid passwords but I've switched them back to passwords since been told by a Linux guru that it was a good idea incase the client was hacked.

If "the client is hacked", then:

1. The bloke modifying your SSH client alrady has "root" on the computer running the broken client, and anything you type in (including your password) can be intercepted.
2. In any case, if he can modify the client to steal the passphrase for your key, he can modify it to steal your password just as easily.

Bad title Zonk!

[Warlock7]

Try again. Nothing released, nothing in the wild, proof-of-concept.

Nothing to see here. Move along...

New and improved version of my last post

[Jesus_666]

Now with 90% more line breaks!

Threat Assesment
Wild

* Wild Level: None
* Number of Infections: 0 - 1
* Number of Sites: 0 - 1
* Geographical Distribution: Where the author lives
* Threat Containment: Don't ask the author to give you a copy
* Removal: Delete the infected directory, feel cool because you got to try out a proof-of-concept Mac virus

Damage

* Damage Level: Low
* Modifies Files: Appends itself to files in the current directory on the compromised computer.

Distribution

* Distribution Level: One (1) computer, given that the author hasn't deleted it

I find it interesting...

[Areeves]

that a demo virus for os x gets posted weeks after I read that Vista has locked out Symantec and NAI. Will Symantec start publishing more proof of concept viruses? Will NAI? If you thought the virus boom was bad when the USSR collapsed (out of work Russian programmers) think about Symantec laying off a few thousand employees because Vista wont play nice, we may get our first vista worm quicker than previously thought.

Is this automated?

[RevDigger]

I mean, the story posting? Is it a cron job?

Like, every two weeks we see, "$ASSHAT_ANTI_VIRUS_COMPANY sez there is something not entirely unlike an OSX worm in the wild, and uh, Mac users have been lulled into a false sense of security, and uh no Mac user has ever actually seen a real virus in the wild because they're not all that popular, and um, like, we should all go buy us some Anti-Virus software."

Stop posting PR crap, please. Don't be a PR tool.

http://slashdot.org/comments.pl?sid=178631&cid=148 09604

That's actually a very good idea...

[Tarlus]

Even if OSX is immune to all of the Windows viruses out there, a Mac that functions as a proxy or an SMB server (for example) could inadvertently pass those viruses on to Windows machines and infect them. If a naturally immune machine is actively stopping anything that could infect its client Windows machines, then it could save them from damage without itself being at risk to the damage.

Yeah!

[hullabalucination]

I set the immutable flag on everything in my home directory. Not even root can screw with stuff now, never mind those nasty little Proof Of Concept bugs. Funny thing, though--I can't update that sales report I started last month. Weird.

* * * * *

It's only when you look at an ant through a magnifying glass on a sunny day that you realise how often they burst into flames.
--Harry Hill

Symantec is the problem, not the virus

[failedlogic]

Funny. But I seem to recall reading about 1 year ago an exploit in Symantec Anti-virus on the Mac. The exploit allowed remote access to a user's computer and was in the very program they're trying to promote to keep customer's computers secure. I believe it was patch 6 months after being reported.

Yeah. Um... hello Symantec??? No matter what press-releases you issue, I'm a long way away from buying your software.

Re:Symantec is the problem, not the virus

[Anonymous Coward]

I don't get your logic. By that logic you wouldn't buy a Mac either, because Mac OS X has many remote code execution vulnerabilities. Just no exploits in the wild yet. Here are my favorites:

• http://www.securityfocus.com/bid/20862
  
• http://www.securityfocus.com/bid/13491
  
• http://www.securityfocus.com/bid/19976
  

SecurityFocus has thousands more for Mac OS X. So again I don't get your logic.

And for the record I don't think Symantec AV on the Mac has any remote code execution vulnerabilties. Only local priviledge escalation vulnerabilities, which occur in literally thousands of programs. Not an execuse by any means, but you made it sound earthshattering.

I'm just sick of Apple's blatant claims about how secure OS X is when it has just as many vulnerabilities as any other operating system. Just not nearly as many users.

hmmmm

[riverstyle]

There actually is a virus out there for MacOS X, its called Symantec AV.
It will make your machine so slow that you finally have to reinstall
the whole OS (as it paces files in 15 different places and don't use launcd)
For private use, I would never install it.

Symantec (if anyone at the company is reading this), your attempt to scare
people inte buying your lousy (actually total crap) product for the Mac is just
downright scary!

(I'm a sysadm for a bunch of Linux/Windows/MacOS machines and is very
unfortunate that the corporation need antivirus on all machines and that
they chose Symantec for the task. )

This demo is actually a real virus

[notnAP]

... affecting the computer between the ears.

Symantec has released it into the wild. Here's how it works.

The computer receives the virus into RAM, usually via the processing of input received from it's visual sensors, interfacing with language banks. For the virus to take hold, the computer must be improperly "patched," in that it holds incomplete definitions of what a computer virus is.

Thusly imporperly patched, with an inadequate understanding of what is truly dangerous to its silicon counterpart, the incompletely educated human computer incorrectly processes the information, making the false decision that a financial invesment in Symantec products are in order.

The virus spreads itself to other human computers through the need-to-appear-smart subroutine.

In order to protect itself, the human computer should run the program http://www.microsoft.com/athome/security/viruses/i ntro_viruses_what.mspx, which is simply an educational program, designed to infuse into the human computer an understanding about computer viruses. It is a free program offered by the computer company most experienced in viruses.

dancing the macarena

[vrochette]

Right! Maybe symantec just feels with Vista coming, it anticipates decrease of revenues. So the company has to diversify its portfolio of products.
Just think of all that untapped virgin market!
What a joke. I'm going to start an Anti-Anti-virus software campaign. Very cool virus name though, maybe that will give ideas for the new Apple commercial.

Re:Don't laugh

[mattkinabrewmindspri]

Apple has six percent of the market. Rather than thousands of people using Macs, I believe that there are millions of people using Macs.

Word of the Day: Switcheur

[Anonymous Coward]

switcher \'swi`ch &r\, n.
A person who thinks that they are a Mac user but are really just trying to be. The mistake they make is to try to become a Mac user, when real Mac users are all about not trying to be anything and following your own rules. There is no fashion code to being a Mac user. There are no rules as to what applications you have to run.

Recent converts like you are ruining the old school Mac community because you are posers. Apple releases one OS that popularizes Fitts' law and the Genie effect, and suddenly people assume being a Mac user is all about owning a Mac. But a real Mac user is born, not made. You "switchers" are misrepresenting yourselves and the Mac platform. You're giving people the wrong idea of what Macintosh is.

switcher: shops at hot topic, thinks Firefox is a good Mac app, waiting for OS X port of PayrollPro 2000, follows any hint of a fashion trend (instead of setting them!), wouldn't know Clarus from Carl Sagan.

real Mac user: someone true to who they are, the misfits, the rebels, the troublemakers, the round pegs in the square holes. The ones who see things differently. They're not fond of rules and they have no respect for the status quo. The ones who are crazy enough to think that they can change the world.

Re:Word of the Day: Switcheur

[jafac]

Recent converts like you . . .

Recent? 10 years? You must have me mistaken for someone else. I switched when Apple went PPC. My first Mac was a 601. I run OS X at home, and at work, I run XP; what my employer dictates. I make my living fixing Windows problems. Sometimes linux, sometimes AIX, whatever makes my house payments.

Sometimes I worry that Apple will abandon me - on my G5, PPC-based Mac, just as they abandoned the "Old World" PPC Macs. I expect my macs to last 3-5 years. I upgraded my 7100 to a G3, because Apple made my software choices difficult. Not because the machine wore out. I upgraded my G3, because they limited my software choices (via iDVD - no "built-in" DVD burner - technically, my expansion, an external firewire DVD burner should work just fine - the choice was free iDVD, or $999 DVD Studio Pro. I would have paid probably $100 for a working iDVD. But Apple wanted me to buy new hardware. So I did. I bought a G5, and got out of it, what I expected. But I expect another 2 years of reliable, and FLEXIBLE utilization out of it. I hope that Apple will not cut me off because I'm not running a box with an intel chip, or I'm not running a box with the latest bootstrap scheme of the day. I'm not hopeful, because I've been burned twice before.

So I'm no Apple fanboi.

But I'm not going to switch to Windows. Or Linux. I know the pitfalls. Intimately. I have been constantly painted into corners by vender-lock-in for 15 years in my career. Among these three choices; Apple is the least troublesome. Though - Linux comes in a VERY close second. (vendor lock-in, not a problem. Software flexibility - a problem, for me).

But anyway - weren't we talking about Symantec? Oh never mind.

Re:Word of the Day: Switcheur

[Anonymous Coward]

Real Mac users have been Mac users from the beginning. Just who do you think you're fooling?

Re:Word of the Day: Switcheur

[jafac]

Oh sorry.

Does having an Apple II+ in 1979 count?

What was the FIRST virus ?

[pawzle]

Many people are well aware of what platform the first virii originated on, since once you know, it's a bit of a no-brainer. To many others it comes as a huge surprise due to all the FUD that is spread about Apple by non-users who think that it's all very mysterious and full of voodoo.

As shown on this timeline http://www.infoplease.com/ipa/A0872842.html you can see that the first virii were written for the Apple I, II and III machines. It was a full FIVE YEARS later before the first virus to infect PC's was found in the wild. Why ? Because Apples were the only affordable personal computers of that time. No home user could afford a PC, and PC users in large corporations had better things to do with their time.

This to a large extent reinforces the theory that virii will be written for the most common, accessible platform of the time.
Forgetting for the moment the security model of OS X which makes virii rather more like a manually run trojan without any significant ability to spread, you could ask: "Why aren't more DECENT proof of concept virii written for OS X ?", and even more significantly; "Why weren't more real virii written for Mac OS 7-9, which didn't share this fantastic unix security model and therefore were ripe for virii ?"

The answer is in the first paragraph. The more expensive and inaccessible the hardware is to bored kids, the less likely they will write virii for it. Kids don't use Macs. They certainly don't buy them. Maybe their rich parents might give them a powerbook but the fact is: these kids probably have better things to do with their time than the bored PC tinkerers who assemble computers out of $5 components found in any bargain bin or even rubbish tip.

Is this the reason that there's no good virii for OS X ? No. Primarily the reason for that is it's security. Or is it ? Perhaps primarily it's that the people who use expensive Apple hardware have real jobs, they often work freelance and therefore have a stronger work ethic, and they just plain don't have the inclination to destroy things in the same way that PC users do. Apple users create. Windows users destroy.

Why ? This will be a contentious assertion, but here goes. Let's say that Apple users live in Beverley Hills and Windows users live in Compton, just for the sake of comparing their income and lifestyles. Kids in Beverley Hills aren't as likely to go vandalising things and getting involved in street thuggery as those from Compton. They find higher-class ways to act out. They do it with their rich parties and such, rather than just cruising the streets beating up on randoms.

The reason why this particular proof-of-concept "virus" is a bit of a joke, and why there are so few other proof of concept virii is that there's just not enough bored kids around who own Macs. This is changing, but not exactly snowballing. Ultimately, the fact is, Apple users already made a conscious choice to choose a platform designed for productivity and not games. Productivity and the creation of destructive viruses are just not a common marriage. Most Mac users are above that.

Who cares? Viruses can be made for any OS!

[NPN_Transistor]

I don't see what the big deal about a "proof-of-concept" virus for the Mac is about. It's common knowledge that a virus can be written to infect any OS. The difference is that some operating systems are less likely to be infected by viruses than others because of both market share and the design of the OS itself. A dumb user can infect his/her system with a virus, and so can security holes and design flaws (such as automatically running an executable without the user's consent). So why is Symantec creating this "proof-of-concept" virus for the Mac? To scare people into buying their Macintosh anti-virus software. It all boils down to profit.

MOD PARENT AS INFORMATIVE

[5plicer]

I've give you mod points if I had them.

You mean like these people hired to write them?

[tlambert]

You mean like these people hired to write them?

http://informationweek.com/story/showArticle.jhtml ?articleID=163702855

-- Terry

Re:You mean like these people hired to write them?

[Mister Whirly]

The Israelis have been hiring hackers to do dirty work for years - in the government and private sector. The article you refered to was not AV companies hiring programmers to create viruses - it was one corporation hiring hackers to break into competitor's systems.

Re:Anti-Apple

[JasonKiddy]

What the hell are you going on about? Of course there are articles 'having a go' duh! that's what the interweb and slashdot are for?!? It is called the exchange of ideas - and we are much better-off for it. I really don't think slashdot or its readers are biased against apple (norton maybe lol) so maybe you should just grow up and learn to read things that you don't agree with. Just because things are written down - doesn't make it compulsory to believe them. (by the way - I am probably what you would call an apple fanboy)

Mirror

[Anonymous Coward]

Cached article

Comment removed

[account_deleted]

Comment removed based on user account deletion

Symantec growning market share?

[Anonymous Coward]

Wow, the 90% Windows market was not enough,
now Symantec has to go on and develop a reason for
Mac owners to drop $79 in their laps?

Symantec - isn't these the guys who let the SONY Trojan install as 'normal software',
never mind the root kit and CD drive jack knifing...

After SONY - who could trust Symantec?

Never was a Switchback virus

[Daniel Jansen]

Um, there never was a Switchback virus. The Rumor Mill by "Anne Onymus" (get it) specializes in this kind of parody.