Fake Codec is Mac OS X Trojan

Kenny A. writes "Multiple news organisations are reporting on an in-the-wild Mac OS X malware attack that uses porn lures to plant phishing Trojans on Mac machines. The attack site attempts to trick users into download a disk image (.dmg) file disguised as a codec that's required for viewing the video. If the Mac machine's browser is set to to open 'Safe' files after downloading, the .dmg gets mounted and the Installer is launched. The target must click through a series of screens to become infected but once the Trojan is installed, it has full control of the machine."

Comments

It begins

[JohnPnP]

Am I the only one to think 'finally'?

Re:It begins

[Anonymous Coward]

And by finally I assume you mean that Apple finally has succeeded in luring the coveted dimwit market to its products.

Re:It begins

[ByOhTek]

There are dimwits and every market. If you think otherwise, it's because you are amongst the ranks...

Re:It begins

[Jennifer York]

You are not the only. It's nice to have company.

The question for me is this: Are Mac Users smarter than Windows users? These Trojans, on both platforms, require the user to click through and actively install it. PC users are so numerous a large portion must be this gullible. History shows us it is true.

But what about Mac peoples? They often look down on us lowly MS folks, this will finally test to see if they are, in fact, superior...

Re:It begins

[Anonymous Coward]

finally what?

Are you suggesting that this puts Mac OSX in the same league as Windows? Think again. This requires a lot of help from the luser behind the keyboard to get installed.

Having spent the entire weekend cleaning up my girlfriend's computer as the result of a drive-by download from a questionable web-site (IE and XP) that didn't even hint that anything was downloading, then downloaded and installed a whole bunch of its spyware buddies, again with no hint that anything was downloading or installing, I still have to think that OSX is much, much better than the steaming pile of feces that is Windows.

Re:It begins

[cromar]

Actually, there was the "MacMag" HyperCard trojan from way back in 1988...

Re:It begins

[LWATCDR]

Not really. Is it a security exploit if the user must type in a password and install the program to make it work?
Sorry but there is nothing that an OS can do to prevent someone with admin rights from installing and running a program.
I am not a Mac User but anybody that installs a codec to view porn that they get from the porn site...
As the Honda motorcycle safty ads put oh so well.
Stupid Hurts.

Re:It begins

[edwardpickman]

Suffering a little Mac envy? This trojan requires some serious effort to install. Yes you have to install it. The Mac OS is doing exactly what its supposed to do, requiring you to authorize the installation of a piece of software, its software not a codec you are installing. Its easier to install Vista on a PC than this trojan is on a Mac. It depends more on ignorance of users not Mac security short comings. If this is the best theyve been able to do after all these years I feel better about OSX not worse.

Re:It begins

[superbus1929]

I don't think one or the other is "superior", but what worries me about Mac users is that they're so unused to stuff like this - security through obscurity, if you will - that they start to think they're invincible. Your average Macintosh luser is more likely to get hammered than your average Windows luser if you take into account a set control number of malware infections that require user interactivity; if you get the same trojan on both OSes, the average luser on Mac is more likely to go through the steps than a Windows luser with the same experience and training because the Windows guy is more likely to be paranoid and ask questions.

One would expect one to automatically question stuff like this, but when you've told yourself "this stuff doesn't apply to me because I'm different" for so long... what happens when that's no longer true?

In a metaphorical sense, it's like a country that's been peaceful for a long time, and has not had the need, means or motivation to keep the knowledge of how to defend itself getting overrun with barely any resistance by a more aggressive neighbour.

Re:It begins

[jgarra23]

Are Mac Users smarter than Windows users?
No, they only think they are. I'd put them both on par with each other. Though the hippie lady down the street from me w/ a Mac somehow figured out some bash :)

As malware in general (f*ck the nitpickers, it's all malware) proliferates through non-MS OSes I'm sure we will see a median level of gullibility and stupidity rise to the surface across all platforms. Those geeks that have nothing better to do than post flashy Beryl & Compiz videos to youtube and then digg them will be just as vulnerable and idiotic as those kids who have 40 toolbars on their ie and wonder why it runs so slow.

It is this point the saturation of malware across all platforms, not virtualization, which will render OS choice a moot point.

Re:It begins

[sgant]

"finally"....what? That a trojan is on an OS? Every OS can have a trojan on it.

A "virus" takes advantage of flaws in the OS. A "trojan" takes advantage of flaws in the user of the OS.

You could have the most secure, bug free OS in the world and still a trojan could bring it all down like a house of cards. All it needs to do is fool the user/admin into giving it root access and WHAM, you're system is compromised. It's not the fault of the OS or any inherent flaws in the OS.

Hell, you could have a sheet of paper laying next to computer that itself is a "trojan". All it has to say is "To fix this problem, bring up Terminal, type "sudo rm -rf /" and all your troubles will be wiped away". Someone that isn't totally computer literate may fall for something like this.

So before anyone jumps all over OS X or any OS as being vulnerable, think for a moment.

There is no "finally" to this. This isn't an exploit. This isn't a virus.

Re:It begins

[jackpot777]

Exactly. This isn't a computer virus. It's a social engineering virus.

Anyone that can write a keystroke logger program can also add wording that it's actually a codec for viewing videos. One more level of dishonesty's not going to stop them.

People often criticize Wiki, but seeing as the Wiki definition of a computer virus is "a computer program that can copy itself and infect a computer without permission or knowledge of the user", this is no virus.

Re:It begins

[LWATCDR]

Well as far as I can tell nobody has called this a virus.
This is a Trojan.
This is malware.
I don't know if this could be called an exploit since it only exploits the users stupidity.
I don't think that it is fair to blame OS/X for this. Heck it even asks you for your password to install!
I do find it amazing at times. The fact that people now expect their Browser to protect them from phishing attacks. What your too lazy to read the URL yourself?
Or that they expect your OS to protect you from installing a Trojan that you have decided to download from a porn site and then install with your root password.

Re:It begins

[Junior J. Junior III]

I am not a Mac User but anybody that installs a codec to view porn that they get from the porn site...

I'm baffled as to why a malware writer would think that a Mac user would want to jerk off to pr0n; it's all about Quicktime VR models of iPhones and WWDC Stevenote addresses if you really want to sucker a Machead into r00ting his box for you. If they put up a fake MacRumors site and post a fake rumor for QuickTime++, they'll get near-100% infection.

Re:It begins

[jackpot777]

I did! But only in the layman use of the word (should've said malware ...stupid Too Clever For Preview Button Syndrome) I'd certainly also call it an exploit too, as in a manipulation.

Re:It begins

[stewbacca]

Here's one story that believes Mac users are smarter than Windows users:

http://www.news.com/2100-1040-943519.html

I remember several studies during the Inernet boom that indicate the Mac user base is at least far more educated (if that makes one smarter) and have more income due to supposed intelligence. I think it is an interesting phenomena. Paradoxically, the smartest people I know are Mac users, but most of them are really dumb when it comes to using computers. There are very few real Mac Power Users out there.

Re:It begins

[stewbacca]

I'd put them both on par with each other.

I don't think Mac users think they are smarter; I think they don't care. This comes off as smug when dealing with insecure Windows lovers. To be fair to Windows though, their average intelligence is dragged way down because they have all the REALLY stupid people in their camp. I think the standard deviation with Windows users' intelligence is much broader than the Mac side. This glaring lack of bottom-dwelling mouth-breathers on the Mac side is what makes their intelligence numbers higher. So, like you said, we are on par with each other (and some of us use both), especially when you drop the all the riff-raff that is skewing the Windows mean lower.

Re:It begins

[dudacgf]

I'm sorry but - as social engeneering goes - a mac luser is just the same as a windows luser. They can both be deceived by a carefully crafted website or online offer. The problem here is not the security of the OS per se, but the user. and here goes the flame: you mac users all think you've got a superior product when it comes to security, but this has yet to be proven.

Re:It begins

[hairyfeet]

What worries me is it advertises itself as a codec needed for free porn videos. Most are going to figure that a codec install will need root, and I have seen many a man who otherwise would never click or install an attachment from an iffy source that will trip over themselves to install ANYTHING that promises "Free porn here!"

Re:It begins

[Macthorpe]

Someone who needs to reinstall Windows even yearly is exactly the kind of idiot that would fall for this same attack on Mac.

Good work on the hyperbole though - well formed, and hard to rebut despite being a load of absolute tosh.

Re:It begins

[PitaBred]

Meh. I have Compiz enabled on both my desktop and my laptop, because I like the feedback and more "natural" feel to using the GUI. I also have a Windows laptop that's been virus-free for a long time, with no performance issues (more than 2 years), and significantly more functionality than my co-workers. The IT guy here just leaves me alone to manage my own system, pretty much, and it makes it easier on the both of us. I don't think it's quite fair to denigrate all flashy GUI users as incompetents ;)

Re:It begins

[Daengbo]

That's a beautiful idea. I should start one of those sites, claim to have "found" a developers' version of QT++, and create a "video" of it in action, encoding the video with the new QuickTime++ codec. Offer the codec for download to view the new app, and PRESTO!

You are an evil genius.

Re:It begins

[prockcore]

The thing is, if it weren't for the DNS modifications, this wouldn't need a password.

Here's a basic outline of what could be a very nasty trojan for OSX:

A simple program that actually does something handy.. like fix the dock in Leopard. When you run it it also replaces Safari with a hacked version that sends all SSL traffic unencrypted to a 3rd party.

Any program you run on OSX can modify the apps in your /Applications directory *without* requiring a password.

Re:It begins

[webweave]

Yea finally. This just proves how Windoze is more intuitive and easier to use. On the mac you have to surf to some porn site run by crackers and manually download a disk image after setting your browser to launch downloaded files (not the default) and then you have to agree to the install and if the installer wants to modify files you don't have permission to change you have to type in your admin password. On the pc it's so much easier, all you have to do is turn it on.

Re:It begins

[LKM]

Finally what? Finally malware writers think that Apple's market share is large enough to warrant writing malware, even though they found no actual security issue to exploit, and thus rely on users installing the malware themselves?

Re:It begins

[LKM]

Being used to malware didn't seem to help Windows users any, so far.

Re:It begins

[LKM]

Buying a Mac requires the buyer to make a conscious decision about which computer to get. From this alone, you would expect the group of Windows users to have the largest amount of people who don't think, Linux to have the smallest, and Mac user to be in the middle. On the other hand, there are no really cheap Macs, so people who have small incomes due to their limited mental capacity can't have Macs. On average, I would guess Windows users are dumber than Mac users, and Mac users and Linux users are about on par, maybe with a slight advantage for Linux users :-)

Re:It begins

[Cro Magnon]

I agree. If somebody REALLY wants to see Naked Britteny Pictures, and has the root/admin password, they're going to get pwned, whether they're running Windows XP or Open BSD.

Re:It begins

[Lars T.]

And by finally I assume you mean that Apple finally has succeeded in luring the coveted dimwit market to its products. Gee, the s"switcheur" troll would be the perfect answer to your post.

Re:It begins

[Lars T.]

The whole thing sounds more like Mac.Simpsons

Re:It begins

[v1]

a trojan can be written for any platform where the user is:

(1) able to receive an executable (be it binary, script, or whatever) from an untrusted source, and

(2) able to launch an executable that either runs with elevated privileges by default, or can request privilege elevation from the user

(this is an "AND" - both conditions must be met) OS X is certainly no exception to that, only a fool would claim (or assume) so. Nothing new here. If I send you a script that says "click OK to format your hard drive" and you click OK, don't go blaming the computer. PEBKAC

Less secure operating systems have other qualifications. Here are the key ones:

(A) able to automatically run an executable received from an untrusted source (usually over a network) without user interaction

(B) execute a script with restricted privileges that can elevate its priveleges without user interaction or authorization

(C) ship with bundled software that performs (1), (2), or both

This is an "OR". Any system that meets any of the above requirements is inherently less secure. Windows being the notorious example, which has proven to consistently meet ALL THREE of the above. OS X does not meet any of these requirements.

It's somewhat counterintuitive what happens when you try to go from being less secure to more secure. Vista has done the best job by far of any Windows release to curb A/B/C, but unfortunately the authorization model is set up in such a way as to require user authorization to access many common system features. This leads to conditioning of the user to smash the OK button every time they see an authorization dialog displayed by the OS, (or any popup with an "Allow" button in it) which in effect provides (B). Thus a secure OS must both provide manditory user authorization for privileged actions, and also be able to function to an acceptable and convenient level without requiring authorization.

Vista, for example, has a LONG way to go before it has that conquered. Many actions require you to log in as an administrator to perform the action, (and some software won't even run for standard users) and as a result, most users run as administrator all the time to avoid the inconvenience of logging out and in and out and back in again to do something, effectively providing a degree of implied authorization for any action they perform, (B). I won't even bother bringing up Explorer and (C), we all know how that goes. So for windows to become as secure as OS X it will need to conquer the problem of requiring authorization to play checkers, without allowing scripted attacks. OS X has done this since its inception and as a result it has the best of both worlds, resistant to (1) without yielding (A), (B), or (C) in the process.

It's easier to see if you ask a few simple questions to a mac user and a windows user. Give them both a new computer that's set up for them to use, and come back a month later and ask them how many times they have needed to authorize an action, or if they have had to have an administrator login to perform an action. The mac user will most likely say "once or twice the first few days, and never". The windows user will likely say "severeal times a day every day, and two or three times". (if you include having to dismiss annoying popups in the first question, the numbers go waaay up for Vista users) Solve THAT and you might put Vista on level ground with OS X, from a security standpoint.

Re:It begins

[MagicBox]

I do not understand your post's point entirely. Are you measuring the success of Apple's OS, by the release of a virus tailored for its OS? Because that would contradict all you zealot's barking over the years that popularity is not a factor in how many viruses are released for an OS. It's an OSes weakness that draws geeks to write viruses for it

I may have understood your sentence wrong though, in which case I take my point back....

Re:It begins

[superbus1929]

Remember, I'm talking about one specific malware that requires user interaction to install. This isn't volume based infections. Think of it as a science project; give the same trojan with the same requirements to users of two different operating systems, and have them be standard end users. I'm willing to bet the Apple user gets farther out of sheer habit.

Re:It begins

[aesiamun]

I'm not quite sure I understand where the security flaw in Mac OS X is. The problem is with users downloading anything they want and running it, typing in the administrator password just because an application asks.

I fail to see how this is Apple's fault any more than someone downloading a similar program in MS Windows is Microsoft's fault.

Re:It begins

[fatlaces]

We'll never know because the number of Mac haters on internet forums who have barely used a mac far outnumbers Mac lovers.

Re:It begins

[jgarra23]

I don't think it's quite fair to denigrate all flashy GUI users as incompetents ;)
I agree and apologize if that's how it was taken, I am merely discussing the people who spend ALL THEIR time dressing up their flashy platform to advertise *NIX while never actually learning or knowing what they (or their comp) is doing. Sounds like you have it done properly - I figure if you're going to be working on a machine all day you may as well have a nice desktop :)

Myself, I have Debian running w/ XP Pro virtualized. That way I have much more flexibility than my coworkers as well & can easily develop for both platforms concurrently. Works great, looks wonderful!

Keyloggers?

[C0rinthian]

In my Macintosh? It's more likely than you think.

Re:Keyloggers?

[Neanderthal Ninny]

If you go to those "special" sites then you can get infected, both the computer and you.

Re:Keyloggers?

[professional_troll]

Thats because you're using a mac you fag

Comment removed

[account_deleted]

Comment removed based on user account deletion

You get what you deserve.

[Pahroza]

If you're stupid enough to go through all of those steps, you deserve to be infected.

Re:You get what you deserve.

[C0rinthian]

Or smart enough. Stupid people wouldn't make it through the install process. "Next" buttons are hard.

Re:You get what you deserve.

[FauxPasIII]

> If you're stupid enough to go through all of those steps, you deserve to be infected.

And does everyone else that your zombied machine spams or DDoS's deserve it?

Re:You get what you deserve.

[Niten]

That's an interesting straw man you've drawn up. Personally, I don't know anybody who purchased a Mac because he or she thought it was somehow immune to all forms of malware.

I agree with the parent poster in a sense. OK, they don't really "deserve" to be infected, but there is a fundamental limit to what current computer security models are able to achieve. This infection doesn't occur through the exploit of some flaw in the web browser or OS X, it's pure social engineering. The malware gets installed just like any valid software package would; if the computer's administrator cannot be relied upon to intelligently differentiate between trustworthy and untrustworthy software, then all other technical countermeasures aside, there is absolutely no hope of keeping that system secure.

Re:You get what you deserve.

[fm6]

Techies are such an arrogant bunch. Knowing all the technical shit you need to know in order to avoid malware doesn't make you smart, it just makes you technical. On the one hand, I know lots of smart non-techies who managed to get their systems infected. On the other hand, I know techies who can't boil water without hurting themselves.

Re:You get what you deserve.

[LWATCDR]

Not really.
None of those attachments for windows Required you type in your password to install. And then you had the real exploits that just required that you looked at the email!

The only way to prevent this type of user installable trojan would be to require signed applications. And that opens up a whole new level of problems.

Re:You get what you deserve.

[djh101010]

Apple has used the "Macs don't have malware" angle in their own advertising.
I don't suppose you can provide a cite for that, can you? Also, I notice you use quotation marks, so that's an exact quote then is it? Or, is it perhaps your biased interpretation of something you want it to say so you can disagree?

Re:You get what you deserve.

[Rycross]

I probably shouldn't have used quotes, because I didn't mean to insinuate that they stated that exactly. Apple hosts the ads that they show on their site, and one is named "Viruses". I can't watch it at work, since I don't have Quicktime, but its probably the ad I remember that panned PCs for being more susceptible to viruses.

Re:You get what you deserve.

[russotto]

Techies who burn themselves boiling water don't curse the stove manufacturer, pot manufacturer, or water company for screwing things up. And they usually don't repeat the steps with which they burned themselves, over and over again, despite having it pointed out that this is what is causing the burns.

Re:You get what you deserve.

[zullnero]

Hilarious. When you install Divx, don't you ever have to go through a couple screens first? I recall going through an installer. Now some codecs just get automatically installed in some players, but some don't and don't install things for you. Codec packs also use an installer, as they just bundle several codecs together and install them for your players that don't install them automatically when needed. If the steps were 1. Touch both hands to the top of your head, 2. Jump up and down, 3. Make noises like a monkey, and 4. Have your best friend click the button "Install Virus"...then yes, that would take an idiot to go through that. However, most software out there has an installer. In fact, most companies take the time to develop installers because they make them feel like their software is more professional and legit.

Re:You get what you deserve.

[Stamen]

Which is true, PCs are. They don't claim to be immune to viruses, that would be silly. If a computer can run software, then it can run software which copies itself automatically (virally). The problem comes when an OS allows a virus or worm, or malware to install itself automatically with no user interaction. And yes, if you do the math, OS X and Linux are hugely less susceptible to these kind of attacks then Windows (older versions, I know Vista is better).

Of course, if the user gives software admin rights, that software can do anything. There is no OS on the planet that can stop that.

Re:You get what you deserve.

[Rycross]

More recent XP is also a lot better with this, although the admin by default aspect is an achilles heel. Its actually quite possible to run user-level in XP. I've made images for labs that ran about 95% of software out of the box under a user account (except for Macromedia stuff, DIE Dreamweaver!).

But yeah, older versions of Windows fast-tracks the installation of the nasties.

To address the great grandparent's point, Apples advertising specifically mentions viruses. So the fact that they don't advertise "malware" immunity is well taken. I fell into the common trap that your average user does, that is that malware = virus.

Re:You get what you deserve.

[djh101010]

I probably shouldn't have used quotes, because I didn't mean to insinuate that they stated that exactly. Apple hosts the ads that they show on their site, and one is named "Viruses". I can't watch it at work, since I don't have Quicktime, but its probably the ad I remember that panned PCs for being more susceptible to viruses.

This doesn't fit _any_ reasonable definition of a computer virus. It doesn't install itself; it needs you to use root access to install and run it. It's not something you can get from visiting the wrong website, or from just not disabling some port that's left open by default install of the OS, it's something the user has to manually do, as root, on a system.

Re:You get what you deserve.

[Rycross]

You're right, its a trojan not a virus. I associated "malware = virus" in my head and messed up. In my defense though, a lot of computer users do the same.

Re:You get what you deserve.

[Achromatic1978]

Wow, that's quite the superiority complex you've got going there. Us amazing geeks, huh? Smarter than the average mouth breather.

Re:You get what you deserve.

[rhakka]

I personally have gotten my grandmother a mac so she wouldn't have to worry about viruses and malware.

Luckily for her, she's not a porn fan, and so she is still, as of today, still 100% safe from viruses, worms and trojans, because she uses a mac.

Sorry to bust your arguement, but it's not only a reason to purchase a mac, it's a damn good one.

Re:You get what you deserve.

[HTH NE1]

I don't see why it's news at slashdot. It promised porn?

Re:You get what you deserve.

[fm6]

My "can't boil water" thing was hype not an example. A common example (one I've actually seen) is somebody who accidentally dyes all their clothes a funny color because they can't be bothered to read the instructions on the side of the detergent box.

Re:You get what you deserve.

[BotnetZombie]

You are right that this isn't a flaw in the browser or OS as many others have also pointed out. I don't have experience with codec installation on Macs, so I think it's a natural question to ask if other 3rd party codecs require administrator's password to install and run correctly. If that is standard procedure, then it's harsh IMHO to blame the users - if this however is something that users normally don't need to do, then I'm all for blaming the stupid end user...

Re:You get what you deserve.

[Crayon Kid]

And they usually don't repeat the steps with which they burned themselves, over and over again, despite having it pointed out that this is what is causing the burns.

That's the difference between the engineer and the scientist. The engineer won't get burned twice. The scientist will repeat it as many times as needed to establish the pattern, examine the outcome and draw up a theory.

Re:You get what you deserve.

[NemoinSpace]

Would everyone stop pontificating and please post a direct link? I RTFA and this one doesn't work.

Please u click here /u to download new version of codec

Great, my underlining code doesn't work either. I need that damn codec!

Idiocy cannot be prevented

[jeffasselin]

The only cure to stupidity is intelligence.

If someone is stupid enough to download something, run it and give it the admin password, it will obviously be able to take control of the machine. No operating system or security software will stop that.

Re:Idiocy cannot be prevented

[sqlrob]

Education is the cure for ignorance. There isn't a cure for stupidity.

Re:Idiocy cannot be prevented

[dnormant]

Microsoft Vista sure tried!

Re:Idiocy cannot be prevented

[sqlrob]

Considering everything splattered across the media about "don't run dodgy programs", ignorance is unlikely.

Re:Idiocy cannot be prevented

[Rycross]

Eh, Microsoft Vista tried to make it not so easy to get nailed by trojans downloaded off the internet. Its pretty much the same the same thing: if the user disregards the warnings and installs something, its their own fault. The OS's only responsibility is to warn the user and not to make it so easy to do something stupid.

Re:Idiocy cannot be prevented

[antdude]

Computer illiterates won't know what a plug-in and codec are.

Re:Hmm

[sogoodsofarsowhat]

Um they do. But if you decide to install malicious software on your system as the owner what can we do? What can anybody do? Seriously this is not a virus it is a human (id10T) user weakness...seen on ALL systems regardless of OS.

Macs...

[ZiakII]

I don't know anything about the Mac OS X but is all the extra steps the article points out. Are they normally needed to install lets say a normal codec? Vista reminds me of the same thing that while it may actually be more secure then previous versions users are still going to think that after seeing these screen after many times while trying to install other "normal" programs they will not take it as a caution any more but just enter in their information as soon as the login screen pop-up.

Re:Macs...

[aliquis]

Normal apps doesn't require a rootuser (thought I find it's weird and probably more insecure that they don't.)

Somehing like a codec or system utility does. Or well, actually I don't know what apps does or not, but a few does ;D

Re:Macs...

[plasmacutter]

not quite, the only player i've come across which needs root access for install was real player (assumably for the DRM)

mplayer, vlc, and even flip4mac wmv codec do not require root permissions.

the reason this is not required is the way mac apps access libraries.

the codecs in mplayer and vlc (much like the libraries in most other mac apps) are combined into the app, and therefore not shared among all users. each user has his own set (and configuration) and they operate in user space.

quicktime works similarly. While you can drop your components (codecs) into the root library directory, each home folder has one of its own, again allowing each user to customize the codecs used.

Re:Macs...

[aliquis]

So when I drag an application to /Applications all its libraries aren't copied there but instead into my home dir to prevent users from changing/messing them up against each other?

Or are they still just copied to /Applications and all users can do whatever they want with them?

I'm a new mac user ;D

Tagging

[Anonymous Coward]

Where is the "haha" tag for this post? WHERE?!

DNS

[Anonymous Coward]

The summary is misleading, it does not give full control of the computer to the attacker, but changes the DNS server for phishing.
It could just as easily install a VNC server I suppose.

Re:DNS

[emj]

You can do an awfull lot when you change someones DNS, it's not like people notice that they aren't using HHTPS. So they might not control the machine but they control everything the user does on the net.

Re:DNS

[Poppler]

VNC? Nah. If the attacker wanted control, they'd just replace the ssh server with one that gives them a backdoor.

Re:Hmm

[gorgonite]

It seems that the installation of the trojan requires that the users type in their password. Then, the Macs are supposed to do what their users ask for, even if it's the installation of a Trojan.

Full Control?

[yroJJory]

Full control of DNS, yes. As far as I've seen, it's not a remote root exploit or anything. It just installs global DNS servers that cannot be easily removed or even noticed.

Lame excuse for a "trojan"

[monkeyboythom]

the Mac machine's browser is set to to open 'Safe' files after downloading, the .dmg gets mounted and the Installer is launched. The target must click through a series of screens to become infected

That's like saying that Troy had to put their enemies in the horse, then drag it up to the gate, drag it through and then offer a soft cushy landing spot for warriors coming out of the horse.

Re:Lame excuse for a "trojan"

[joeytmann]

Ummm, I disagree. Troy was presented with a gift, so they thought, and then dragged it into the city. Then when the people of Troy got bored with it, and left it in the middle of the city, probably saying something along the lines of "ehhh lets trash it tomorrow", and went to bed for the night. Little did they know of the nasty little bits inside that would come out at a predetermined time that would royally fuck them up, big time.

Sound kinda familiar doesn't it?

Re:Lame excuse for a "trojan"

[DCstewieG]

At least they got a big-ass horse. With this, you don't even get the porn!

Re:Lame excuse for a "trojan"

[Strawser]

That's like saying that Troy had to put their enemies in the horse, then drag it up to the gate, drag it through and then offer a soft cushy landing spot for warriors coming out of the horse.

Work just one day on an ISP's tech support line, and this will seem like a realistic expectation by the time your lunch break starts.

Re:Nothing to see here...

[FSWKU]

No one uses the internet for porn, so we're all safe, right?

"Why you think the net was born?" _________________

Five points for finishing the line, an extra 10 for naming the reference (and no, a certain MMORPG does NOT count).

isn't this kind of old news?

[limeman]

I saw this posted on security focus like hours ago..

Re:fanboys unite

[Anonymous Coward]

Name an operating system that can't be infected when a user gives an admin password.

Steps to get infected

[giminy]

To get infected, you have to:

1) Go to a porn site
2) Download a plugin from the porn site
3) Click "OK" that you are downloading a .DMG file.
4) Mount the .DMG
5) Go back to the Finder
6) Double-click the installer
7) Type in your account password
8) Click next a few times

Calling this, "In the Wild," is laughable. How did the porn site "get infected"? I'll bet anything that the porn site(s) in question know exactly what they are doing...

Re:Steps to get infected

[QuantumG]

How did the porn site "get infected"? I'll bet anything that the porn site(s) in question know exactly what they are doing... Uhhh, no shit.

What were you thinking?

Re:Steps to get infected

[advocate_one]

and with windows... 1) Go to a porn site....

Re:Steps to get infected

[Rob T Firefly]

3) Click "OK" that you are downloading a .DMG file. But I thought Macs had no step 3!!

Re:Steps to get infected

[mhollis]

You are assuming something here: There is no incentive.

Lots of Mac users are looking for the ultimate codec toolkit. Apple's Quicktime comes with a number but there are more out there and many are really hard to find and/or are Windows-specific. I downloaded and installed Divx and the Divx encoder for some things I do. I use Flip4Mac's WMV codec as well as their professional tools (for things like MXF files). And lots of Mac users have as well to get Quicktime to work with .WMV files as Microsoft stopped supporting us with their .WMV player.

So, if one fools one's dupe with the come-on: "It's a codec you need to view these files," it's a pretty good scam. All of the additional clicking and password-entering will be motivated by the same reason why the user downloaded and installed the codecs I mentioned above.

I suppose the moral of this story is that one should not trust anything on a porn site. But in the Mac user environment where Mac users usually struggle to keep up with the proprietary Microsoft stuff, a codec download "to see this" is not too far off-base.

Re:Steps to get infected

[aberkvam]

To get infected, you have to:

1) Go to a porn site
2) Download a plugin from the porn site
3) Click "OK" that you are downloading a .DMG file.
4) Mount the .DMG
5) Go back to the Finder
6) Double-click the installer
7) Type in your account password
8) Click next a few times

Calling this, "In the Wild," is laughable. How did the porn site "get infected"? I'll bet anything that the porn site(s) in question know exactly what they are doing...

If the user is using Safari with the default settings, steps 4-6 aren't needed (which is mentioned in the article summary).

"In the wild" means that it isn't limited to just researchers' labs. Of course the porn site knows exactly what it's doing. That's not the point. The point is that an average user has a chance of encountering this trojan.

Re:Steps to get infected

[eli pabst]

Calling this, "In the Wild," is laughable.

The fact that it is not exclusively found in a restricted lab setting is the definition of being "in the wild". Very likely that the porn site knows what they are doing, porn sites are notorious for hosting malware as visitors are likely to click on links.

Re:Steps to get infected

[Llywelyn]

Does the installer launch automatically when the DMG is mounted? If not then all that is removed is step 4.

Re:Steps to get infected

[Neanderthal Ninny]

This similar to getting infected by other "diseases" this way. Go to an house of ill repute. Find anyone there to have coitus with you. Ensure you don't use any form of protection. Tada! You get infected by some form of VD.

Re:Steps to get infected

[Naviztirf]

Well that's not exactly true, since by default Safari "opens safe files" when they are downloaded. So the steps are more like: 1) Go to a Mac user forum (from TFA) 2) Click on a video link 3) Click "OK" that you are downloading a .DMG file. 4) Type in your account password 5) Click next a few times Still tough, but not quite so...

Re:Steps to get infected

[jtroutman]

I'd also take into consideration how much impact the oft-sited idea that Mac has no viruses will have on people's decision to go through those steps.

"Hey, it can't hurt me, there aren't any viruses on Macs..."

Re:Steps to get infected

[Ice Station Zebra]

How did the porn site "get infected"?

Duh, they didn't use a trojan and you'd better install that trojan on your mac or you won't be safely surfing for porn.

Re:Steps to get infected

[Frogg]

On a Mac, i believe you can get the Quicktime engine to have all the codecs you'll ever need by installing the free open source package Perian and the free (closed source) Flip4Mac WMV, which covers the last few.

Arguably, Apple should pre-install both of these packages - or variants thereof.

Now to get back onto the main topic..

One could also argue that the Apple-provided Quicktime player sucks ass big-time - and of course that is very true - but that's easily fixed by installing NicePlayer (also FOSS) - the other route is to ignore all the Quicktime-based solutions, and use something like VLC.

None of the above will stop an uneducated and/or unsuspecting user from clicking their way through an installer (and giving up an administrator password) believing it to install something great/fun/useful. If you try too hard to protect the naive and/or foolish from their own actions when administering the system then you end up taking the route Microsoft have with Vista (and their earlier Windows, each to a lesser extent) -- Are you sure? Are you really sure? Are you really really certain? Can i get a password with that? -- Ah.. Mac users are getting used to giving passwords during installs - bummer. (Mind you, they don't do it as quickly as the average Windows user/administrator can click Ok, Ok, Ok, Ok)

Being honest though, i don't think naivety or foolishness really enter into the equation - after all, it's a social engineering trick driven by the simple male quest for boobies - a somewhat unstoppable force!

Re:Steps to get infected

[Psarchasm]

More bullshit from zealots... For the vast majority of OS X users the steps would be:

1) Go to site (only reason porn is used is due to effectiveness)
2) Get told you have to install something to view content ... agree to download (never seen that before? laughable.)
3) .dmg will auto mount/installer will auto-play (For the vast majority of Safari users)
4) Get told to that it needs admin privileges to install... give credentials (never seen that before? laughable.)

So, I guess OS X users don't download, nor install software. Even more telling, by your logic, there must not be any dumb OS X users.

Its "in the wild" because its being publicly distributed (read: not a proof of concept.) And, of course the operator of the page in questions know what they are doing.

Re:Steps to get infected

[Grail]

That would be funny if it wasn't true.

I used to work for a small retail telecommunications provider, and the saddest case I can remember is some guy who racked up $650 in on phone call, because he simply opened up a web page for an "adult services" company. The web page included some VB Script or an ActiveX control which downloaded (and ran) a dialler application, which hung up the customer's existing connection and dialled a "premium rate" number (charged at $5.50/min). The user didn't even know this had happened.

Re:Steps to get infected

[SuperSneaks]

Perian anybody?

Re:Steps to get infected

[mpfife]

Yeah, well how come I'm still getting 50 "send your credit card and password to us today for your free viagra".

Tells me somebody is stupid enough to be doing it...

Re:Steps to get infected

[CtrlShiftEsc]

But I thought Macs had no step 3!! That tickled me a little... Only time will tell whether this trojan manages to infect large numbers of Mac users. It's inevitable that they will be subject to more attacks as they become more popular. It doesn't matter how smart the average Mac user thinks he/she is. Far too many do not have any malware protection installed, much like the blissfully unaware Windows 98 users of old. For many, it will be like turning back the clock 10 years...

Re:Steps to get infected

[MeNeXT]

http://www.videolan.org/

Stoped for me a long long time ago. But the point is you need to trust where you download from!

Re:Steps to get infected

[XNine]

"To get infected, you have to:"

1) Go to a porn site CHECK
2) Download a plugin from the porn site CHECK
3) Click "OK" that you are downloading a .DMG file. CHECK
4) Mount the .DMG CHECK
5) Go back to the Finder CHECK
6) Double-click the installer CHECK
7) Type in your account password .... thinking. thinking... I can always remember my porn site passwords, but never my admin password.... shit....

Re:Steps to get infected

[lazyforker]

So, if one fools one's dupe with the come-on: "It's a codec you need to view these files," it's a pretty good scam. All of the additional clicking and password-entering will be motivated by the same reason why the user downloaded and installed the codecs I mentioned above.
You can avoid using the porn^H^H^H^H media site's codecs if they use one of the more common formats such as wmv, divx/xvid/3ivx, mpeg4/mp4. There are excellent open source media players and codecs available for Macs.

I use the Perian codec http://www.perian.org/ and the VLC player http://www.videolan.org/. Both are FOSS and both work very well for me on Tiger (Intel and PowerPC). I haven't looked through the source code; so I don't know if they built in a keylogger etc.

Re:Steps to get infected

[Farmer Tim]

I suppose the moral of this story is that one should not trust anything on a porn site.

What, you mean teen lesbians aren't hot for me after all? I'm flabbergasted!

Re:Steps to get infected

[pcgabe]

2) There's no step 2.

There's no step 2!

Re:Steps to get infected

[bobinabottle]

Lots of Mac users are looking for the ultimate codec toolkit. Apple's Quicktime comes with a number but there are more out there and many are really hard to find and/or are Windows-specific. I downloaded and installed Divx and the Divx encoder for some things I do. I use Flip4Mac's WMV codec as well as their professional tools (for things like MXF files). And lots of Mac users have as well to get Quicktime to work with .WMV files as Microsoft stopped supporting us with their .WMV player.

All you need to do is install Flip4Mac and Perian. That should be all you need.

Re:Steps to get infected

[Just Some Guy]

On a Mac, i believe you can get the Quicktime engine to have all the codecs you'll ever need by installing the free open source package Perian and the free (closed source) Flip4Mac WMV, which covers the last few.

Thanks! Please excuse me while I go download these codecs.

Oh, wait...

Re:Steps to get infected

[PineGreen]

Wait a minute! Isn't it true that with macs "everything just works"? Why do you need codecs then?

Besides, I am shocked that Mac users look at porn...

Re:Steps to get infected

[clf8]

First, not sure why this is ranked categorized as funny, since it's true.
You don't even need step 1.
Step 0: Connect to the Internet

There was a day that if you took your Windows pc out of the box, put it on the internet, it would be infected before you could even download a service pack to patch the holes (assuming the service pack covered those). I realize this is an OLD article, and I have no experience with Vista, but I would be curious to see what the latest metrics are.
http://www.realtechnews.com/posts/1511

If I buy XP today or have it pre-installed, is SP2 now there by default?
Have there been any studies like this for Vista?
    And, at risk of being obnoxious, does it matter WHICH version of Vista?

Re:Steps to get infected

[sid0]

First -- it isn't true anymore.

1. Yes. And SP2 doesn't get owned on the internet.
2. I remember at least one, and haven't heard of *any* "true" viruses on Vista so far. Whatever I've seen has been social engineering, similar to this OS/X malware.
3. No.

Re:Steps to get infected

[vertigoCiel]

Have you heard of Perian? It's a quicktime plugin that provides support for Divx, Xvid, Avi, FLV, MKV - pretty much everything but Real and WMV. I've barely had to use VLC since I installed it.

Re:Steps to get infected

[mhollis]

Ditto!

I have worked for the past 20 years with video, everything from shooting speeches and events to working at a national network and I have never heard of Perian. I have heard of Flip4Mac (as I mentioned before) and I'm really happy I started this sub-thread now because of the Perian mention. Look for their website to be slashdotted for a while as I place information about their codec package on an Avid-based user list.

And, of course, the malware is the result of social engineering and boobies! (Where would the Internet be without boobies?)

Re:Steps to get infected

[mhollis]

I should not answer this because you've posted as an "anonymous coward." It's my policy to not respond to ACs.

However, I do know of one Aussie chemistry student that was infected because, he says, he was following the article on McAfee's website that provides a link to the malware.

In that McAfee is providing a link, it seems to reinforce my notion that the companies that provide software to fix these problems may be involved in the creation of malware.

Re:Steps to get infected

[lucas teh geek]

Massive thanks to you for mentioning Perian and NicePlayer. I'd not heard of either of them before so I grabbed them to try them out. I've been using niceplayer for the last few days now, and it's fantastic. I think VLC may no longer be my primary video playing software.

Now I dont suppose you know of an equally great music player that isnt itunes? There's often stuff I want to listen to but dont want littering my library. I use VLC for this, but it's by no means perfect

First Remedy Apple Should Implement

[Apple Acolyte]

If Apple really wants to continue to provide users with the "Open Safe Files" option in Safari, it would make a whole lot of sense to associate that feature with a white list of approved domain names like apple.com, adobe.com, etc.

Re:First Remedy Apple Should Implement

[znu]

As a result of "Open Safe Files" in this instance, the user has to perform something like six manual steps instead of eight. Anyone gullible enough to go through those six steps would be gullible enough to go through eight, so "Open Safe Files" isn't really making anyone less safe here.

Re:First Remedy Apple Should Implement

[css-hack]

I believe this is partially addressed in Leopard. Authors can sign their programs with their key (I forget the exact mechanism), and you can accept certain authors as trusted.

It was detailed in the review article from the other day.

Re:First Remedy Apple Should Implement

[Llywelyn]

If you have open safe files, it mounts the disk image and then you have to run the installer.

If you do not have open safe files, you have to double click the disk image before you can run the installer.

If you have been so thoroughly tricked that you will run the installer, whether "open safe files" is checked is irrelevant.

In the world of "my codec is better than yours"...

[TofuMatt]

Ultracodec1000 > all your base.

Comment removed

[account_deleted]

Comment removed based on user account deletion

It begins?

[znu]

Your subject seems to suggest that you believe that now that there's actual a piece of Mac malware in the wild, things with snowball, and there will be more and more. Is there any logical reason to believe that this is the case? In the latter days of pre-X Mac OS, there was some malware program or other released every year or three, but the rate never seemed to climb.

Any Mac haters gleefully hoping that this is the start of a Mac threat environment similar to the Windows threat environment is probably going to be quite disappointed.

Re:It begins?

[Americano]

Hell, for all we know OSX is just as insecure if not MORE insecure than Windows...people just haven't been making the effort to discover flaws because it wasn't worth the time. With the number of Macs in households growing every day (especially in light of Vista), it is becoming more and more worth the time of malware developers to target Mac systems...

I like your FUD... where can I get some?

Seriously, dude. I'm not going to claim that Macs are somehow magically "totally secure"... but given that Unix operating systems have been around for many years, and they are still nowhere near as rife with exploits, malware and other crap as the Windows ecosystem... don't you think you're overstating the case a bit?

And if you think you're not, then what's your response to all the Linux users who claim that their Unix underpinnings make them much more secure than Windows?

Re:It begins?

[Pojut]

I never said it was more insecure, I simply hinted at the possibility of it...and, as someone above already pointed out, if you have a group of people whose operating system was designed to be "user friendly" (i.e. generally made for less technically inclined folk) they are less likely to pay attention to the possibility of an infection.

I'm not saying that it is so. I'm saying that it's possibly so. PEBKAC and all that, but regardless of the reason, it is possible.

Re:It begins?

[heinousjay]

what's your response to all the Linux users who claim that their Unix underpinnings make them much more secure than Windows? They're wrong too, mostly. The problem is the word "much."

The fact that someone screams the loudest is in no way related to how correct they are.

Re:It begins?

[BarryJacobsen]

Hell, for all we know you're a pedophile, if not MORE of a pedophile than (insert famous pedophile, I can't think of one). I never said you were a pedophile, I simply hinted at the possibility of it.

There's just something about that wording that seems like it does more than hint.

Re:It begins?

[Pojut]

Take it however you like...the simple truth is that the more people that own a Mac, the more likely malware is to be written for it (which is what the actual point of my OP was, as opposed to what people have latched onto instead.)

Do you disagree?

Re:It begins?

[Americano]

No, you never *stated* that it was more insecure. What you stated was misinformation and uncertainty intended to imply that Mac OS X is just as insecure as Windows, perhaps even more so.

This is a textbook example of FUD in action -- criticize Mac OS X based on data you don't have, but which "may" someday be shown to exist. If you make a statement about the security of a system based solely on uncertain speculation, expect to have it called out as FUD, because it is.

Re:It begins?

[bkr1_2k]

"people just haven't been making the effort to discover flaws because it wasn't worth the time."

You do recall the "month of OS X bugs" right? To say that people haven't been making the effort to discover flaws is not only wrong, it's worse than your previous statement that OS X may be more insecure than windows.

Apple is not perfect and OS X is far from 100% secure, but to imply, without any corroborating data that it even hints at being less secure than windows is pure FUD.

You're right about one thing though, the more people start using Macs (10% market share now, ~6% 3 years ago) the more likelihood that we'll see more attempts at malware. I think you'll see already (if you read the article), though that it takes far more user stupidity to infect a Mac (as it stands today) than it does a Windows machine. Windows isn't horrible, OS X isn't perfect, but given the data currently available there simply is no comparison.

Re:It begins?

[mstone]

---- as someone above already pointed out, if you have a group of people whose operating system was designed to be "user friendly" (i.e. generally made for less technically inclined folk) they are less likely to pay attention to the possibility of an infection.

You haven't used OS X much, have you?

There's a difference between what you refer to as 'user friendly' and what Larry Wall calls a 'well Huffman-coded system'. I.e.: it makes common and safe things easy, while making the rare and risky things more difficult. Want to save a copy of an image you saw on a webpage? Just click on it and drag the semitransparent proxy to the desktop. The OS handles the logic necessary to create a file of the appropriate type with an appropriate name. Simple.

Want to download a piece of software from the internet? That takes more steps. First you have to download and open the disk image. Now, I agree with pretty much everyone with a mind to security that the 'Open "safe" files after downloading' option in Safari should be eliminated, or turned off as the factory default at the very least, but even if you do let the thing open automatically, the OS identifies it as code which has never run on the system. It pops up a dialog explaining that you've never run this piece of software before, tells you where it came from, and asks for confirmation. If it tries to install anything outside the user's home directory, you get another dialog that asks for an administrator password.

That's a lot more complicated than most interaction people have with OS X. The design team made the good decision to keep challenges for the admin password rare, and to restrict them to "you do know you're tinkering with the guts of this machine, yes?" events, so the system doesn't encourage users to get into a habit of blindly punching in the admin password and clicking 'Okay'.

Now, the trojan under discussion admits to being an installer, it just lies about what's being installed. If more third-party developers embraced the "To install, drag the icon from this disk to your desktop" model of installation, instead of clinging to the idea that they have to spray files to hell and gone throughout the file tree, even that vector for social engineering would be harder to exploit.

Re:It begins?

[Americano]

Actually, yes, I do disagree. A successful malware attack requires two things:

1. A large enough install base to make the return worth your while. Macs are certainly reaching that point.
2. A piece of software that's easily exploitable to get privileges that are worthwile.

By your reasoning, Linux, Mac OS X, and commercial Unix variants should be seeing an ever-increasing load of threats and exploits in the wild, and that's simply not happening. Of course there will always be malware produced for any OS... but Unix is *harder to attack* in a way that will give you complete admin control of a system to use for sending Spam, starting DDoS attacks, etc.

No rational person would claim that it's impossible to attack any Operating system. But your claim that "macs becoming more popular" will cause more malware to be written for it is logically inaccurate, because you're claiming that the only thing causing the creation of malware for Windows is a large install base, and that if the situation were reversed, and Unix-based OS'es had 90% of the market, they'd be rife with malware and viruses as well.

Re:It begins?

[Pojut]

Have you ever heard the saying "if it was engineered by a human, it can be reverse engineered by a human"? That saying applies here as well. True, it may be more difficult to muck with OSX, but that doesn't mean it couldn't be done on a large scale...there just hasn't been the incentive to try to find ways to do so. There are things in place that make Unix inherintly more secure, sure, but that doesn't mean there isn't a way around them...they just haven't been found yet.

The more people there are concentrating on the "problem" of bypassing Unix security, the more likely exploits are going to be found and exploited. As the userbase grows, more and more people are going to be looking to OSX for malware...it's going to happen.

And yes, if Unix-based systems had the same market share as Windows, they would have the same malware problem that Windows has. Again, more people working on the same "problem", the more likely a "solution" will be found. Two heads are better than one, and all that noise.

Re:Hmm

[sm62704]

This is neither a virus or a worm; it's a trojan. A trojan is a program that does or claims to do something useful, which gets you to install it. Once installed, it does something else in addition to or instead of what you installed it for.

No OS is foolproof, and even Mac and Linux users can be fools. Mac and Linux machines can be broken into, can get trojans, theur users can be tricked into giving out passwords, but there are no Mac or Linux viruses in the wold.

Re:Nothing to see here...

[Applekid]

porn, porn, porn
Avenue Q

What do I win? Do you really have to ask?

What goes through the mind of the designer - ?

[Anonymous Coward]

"Sure, Russian porn site offering me 'free' videos ripped from US porn producers ... I trust you to give me software to install in order to watch your video. Wait, I'm using a Mac - which ships with nearly every conceivable video codec I'd ever need to produce and edit professional video because It Just Works. What are the chances that Russian Mafia are one-up on Apple for a video codec I'd need?"

Re:What goes through the mind of the designer - ?

[spud603]

"Sure, Russian porn site offering me 'free' videos ripped from US porn producers ... I trust you to give me software to install in order to watch your video. Wait, I'm using a Mac - which ships with nearly every conceivable video codec I'd ever need to produce and edit professional video because It Just Works. What are the chances that Russian Mafia are one-up on Apple for a video codec I'd need?"

"Every conceivable video codec I'd ever need" except the few doozies: wmv, realplayer, and divx. Like it or not these are widely used, and not just for porn.

Re:What goes through the mind of the designer - ?

[cromar]

Like it or not these are widely used, and not just for porn.

Yes. They area also used for grey market fansubs and pirated DVD rips ;)

Re:What goes through the mind of the designer - ?

[iowannaski]

"Wait, I'm using a Mac - which ships with nearly every conceivable video codec I'd ever need to produce and edit professional video because It Just Works."

With the exception, of course, of obscure codecs like MPEG-2, Flash Video, and WMV9.

Macs can be great for video editing and production, but if you want to use anything other than DV and h.264 you are going to have to add third party codecs.

Re:What goes through the mind of the designer - ?

[spud603]

and BBC video and Democracy Now! video

of course a lot of the news sites are switching to flash video, which also doesn't come "standard" on macs. These are all really easy to take care of (though I think realplayer should be banned from the internets), I just thought it was silly to toe the "it just works" line of apple.

This is not a virus, it's a "wetware" exploit.

[plasmacutter]

Malware does not equal virus, iit does not "break" into a machine through security holes, it hacks the wetware between the monitor and the seat, convincing them to consent to the install.
It's impossible to make a machine fully idiot proof, but in the past couple versions apple has added 3 new "nag" boxes to safari in attempts to warn people.
Anyone who goes through that many screens deserves to have it installed.

I don't install any media player or codec if it asks for root permission.

even flip4mac doesn't require full permissions.

you drop the free component into your home's library folder and it runs in user space when websites call for wmv decoding.

Re:This is not a virus, it's a "wetware" exploit.

[eli pabst]

Malware does not equal virus, iit does not "break" into a machine through security holes

Actually a worm is the only type of malware that exploits are security hole. Trojans and viruses really only differ in that a virus is a file infecter, ie it's going to append its code to legitimate executable file(s) existing on the system. A trojan is just malware pretending to be something it's not, much like the real trojan horse. Granted, much of the malware today are blended threats with some aspects of each, so the distinctions are somewhat blurred. But IMO, the original distinctions very accurately described how each malware functioned, like how floppy disks used to be notorious vectors for transmission of viruses similarly to how a real virus would spread in the community.

Re:Hmm

[djh101010]

Looks like the Mac fanbois are abusing the moderating system again. And the terminology is semantics. Mac users have been exclaiming that there Macs are immune or resistant to malware for years now and saying that Macs are better than Windows because Macs don't get infected.
Actually, the only people claiming that Macs are immune to malware, are people like you claiming others are doing so specifically so you can say these mythical people are wrong. This is a case of a program not being what it claims to be, and using social engineering to get someone to install something, make it executable, authenticate as root, and run it. No different than a year or three ago when someone came out with a fake Office for OSX package they shared on the P2P networks which was really a shell script that removed files. Not a virus - this doesn't install itself.

A "virus" with an install procedure which includes "and then become root and run it" isn't going to have legs.

Re:Nothing to see here...

[rizzo420]

15 points... duh.

But does it matter?

[khasim]

Right now you have to convince people to install the trojan.

Okay, that will give you X% of all the Mac users out there.

Then what? How do you increase X?

With Windows, the trojans scan the hard drive for email addresses and send out links to every address it can find. That depends upon unpatched exploits in IE or you having friends who are as dumb as you.

If the same happens here ... I don't see the growth rate being above the disinfection rate.

Re:But does it matter?

[Vancorps]

Trojans don't rely IE vulnerabilities to get email addresses after infection. They can do the exact same thing they do on Windows on an OS X box once infected.

It sounds like this trojan comes with a local privilege escalation vulnerability otherwise this also depends on users on Macs having root level access.

It was only a matter of time before someone would target it. Whether more and more people target it is a completely separate issue.

As a cross-platform user of all sorts of systems I generally prefer that things aren't targeted at all. I do enjoy the people saying OS X was inherently secure based on absolutely no knowledge of OS X's foundation finally being hit with the clue-by-four. Now they can actually start learning what it is they are spouting about and present intelligent arguments which are always better than empty ones.

Of course that may just be a tad bit optimistic on my part. No system connected to the outside world is 100% secure, does this in any way change my thoughts on OS X security? Nope, not at all because I always understood this problem as it exists on any platform which lets the user download and run software.

Re:But does it matter?

[heinousjay]

I consider trojans like this to be Darwinian. Anyone who gets hit with it deserves it, basically. If it happens to be one of the loudmouth braying donkeys who scream about how the Mac is immune, all the better.

Re:But does it matter?

[Vancorps]

I couldn't agree more. Darwin is everywhere and on everything. There are bad drivers of the safest cars out there that still get in accidents.

Re:But does it matter?

[Matey-O]

FWIW, I discoverd Parallels incudes a demo of Kapersky's virus scanner. Installing it on a lark, it discovered a 'proof of concept bluetooth stack' exploit when scanning the folders that Parallels shares with the guest OS.

I have no idea where it came from, and it looks like it didn't activate (the vector is, apparently 'you've received an OOBEX file exchange, do you want to accept it?' at which point it infects the system.

I think our days of blissful ignorance are drawing to a close. That said, I don't believe a Mac virus solution needs to be as overbearing and draconian as the ones I've seen for the PC (Symantec, Norton, etc.)

Re:But does it matter?

[Heembo]

But with Darwinism, if you screw up you are dropped out of the gene pool. If you are dumb enough to get a Virus you start doing damage to everyone around you. Ech.

Re:But does it matter?

[bloobloo]

It's on a Mac. Of course it's Darwinian.

Re:But does it matter?

[XHIIHIIHX]

Why exactly would your pwned Mac be resistant to having the thunderbird address book scanned and having the trojan delivered to all your friends that think you're smarter about computers then they are, and would quickly install whatever you have recommended to them. I was on a mailing list one time where someone recommended that everyone on the list should download "antivirus product X" which most people on this list (not computer related) had never heard of. I got flamed for pointing out that this looked very much like an email that a very cunning virus could have crafted, being as how it had proper punctuation and spelling. They users were very emphatic that "they trusted Dan" and I shouldn't be "using scare tactics." Funny stuff indeed. The antivirus company btw was Panda security who actually make a fine product (for those that need it).

Re:But does it matter?

[I'm Don Giovanni]

"With Windows, the trojans scan the hard drive for email addresses and send out links to every address it can find. That depends upon unpatched exploits in IE or you having friends who are as dumb as you."

You're showing your ignorance. It's incredibly easy to scan AddressBook.app's contacts list and send emails via Mail.app as both apps provide an AppleScript api for that very purpose!

Similar can be used to propagate malware via iChat.

So once a user installs this trojan, it can easily propagate itself. And no "exploit" holes are even required. BTW, this is the same as for the overwhelming majority of Windows malware. They generally don't rely on "unpatched exploits in IE" or anywhere else, not anymore.

Re:But does it matter?

[iluvcapra]

It sounds like this trojan comes with a local privilege escalation vulnerability otherwise this also depends on users on Macs having root level access.

Mac OS X has no root user by default, and as a potential victim you need to type in an admin password in order to install the trojan. Even if "open safe files" was turned on (which it isn't any more), it won't install until you double-click on the package installer, click thru the installer, and type in an admin password.

Re:But does it matter?

[architimmy]

I used to work mac phone support at a private university. At least amongst the student user population X% is definitely a two digit number (also, not a small two digit number). Even if this is only a first person infection enough people (we'll call them unsophisticated users) eager to view a video would just install what they are told to to get things to work. I think we forget that most people have this perspective when it comes to computer use. They just want it to work so they will take the easiest path.

Re:But does it matter?

[mollymoo]

From the point of view of avoiding accidents, the safest cars aren't generally the ones considered or rated as "safe". Avoiding accidents ("active safety") is an entirely different ball game to surviving crashes ("passive safety"), which is what most people think of when they talk about safety. If you want to avoid an accident, you want lots of grip, good brakes, minimal mass, good visibility and small size. In other words, you want a sports car. If you want to survive an accident, you want large size and high mass. In other words you (theoretically) want an SUV (theoretically because SUVs are not all built to the same standards as cars).

Re:But does it matter?

[Crayon Kid]

I think our days of blissful ignorance are drawing to a close. That said, I don't believe a Mac virus solution needs to be as overbearing and draconian as the ones I've seen for the PC (Symantec, Norton, etc.)

That's because PC antivirus systems are based on hopelessly outdated concepts: enumerating badness, blacklists, default permit and so on. Same goes for antispyware and so on.

But from what I've seen in Leopard, Mac engineers are already on a much better track. It will always be 1000 times easier to determine what is goodware on a computer than what is malware. That's where they're going with sandboxing and Mandatory Access Control and kudos to them.

Re:But does it matter?

[drsmithy]

Mac OS X has no root user by default, and as a potential victim you need to type in an admin password in order to install the trojan.

OS X most certainly does have a root user, it's *interactive* logins by root that are disabled by default. Every time you type in your "admin password" or run 'sudo somecommand', those things are being run as the root user.

Re:But does it matter?

[iluvcapra]

The GP:

It sounds like this trojan comes with a local privilege escalation vulnerability otherwise this also depends on users on Macs having root level access.

Stare argumentum; this executable in question makes no use of an exploit, the OS behaves exactly as the user commands.

OS X most certainly does have a root user, it's *interactive* logins by root that are disabled by default.

Not just interactive logins, logins period. There is no process you can undertake by which you will be recognized as real user 0 without setuid(), thus you already need to be euid 0, and thus you must be either a sudoer and recently authenticated or running a binary owned by root. I think the distinction is semantic and doesn't advance on the original point the poster made. "Users" on Macs don't have root-level access, they only have the privilege of running a program with euid of root, given they enter their password. That's very different from the implied "they all run in admin mode" of the parent.

Re:But does it matter?

[cheater512]

This trojan doesnt use any exploits. Its purely a social engineering attack.

For it to work you need to be going to a porn site with the trojan, download the fake codec and then be stupid enough to enter in your root password.

Completely different to Windows trojans which automatically install.

Re:But does it matter?

[Daengbo]

This post is slightly off the topic of OSX, but on the topic of general security. The new concepts for Ubuntu 8.04 include single click addition of third-party repositories, which just scares the shit out of me because it will make trojans that much easier. If Ubuntu ever picks up enough steam, that'll be hell waiting to happen.

I was all for the addition of the apt: link (if you don't know what that is, click on my signature) because it only installs software from current repositories, but adding repos willy-nilly (and even gdebi) just seem the wrong way to go.

About half the stuff I deal with on the Ubuntu forums equates to "I installed unsupported-app-foo and changed config-file-bar and now my system doesn't work the way it's supposed to. Meh. Kill security AND stability in one shot.

Re:But does it matter?

[steeviant]

It sounds like this trojan comes with a local privilege escalation vulnerability

Yes, it does doesn't it. In their quest for a sensational front-page headline, the authors of the blurb forgot to mention that you need to enter your root password in order for it to work.

Obviously someone out there was dumb enough to actually do just that, resulting in the discovery of this malware.

Re:But does it matter?

[krunk7]

Trojans don't rely IE vulnerabilities to get email addresses after infection. They can do the exact same thing they do on Windows on an OS X box once infected. It sounds like this trojan comes with a local privilege escalation vulnerability otherwise this also depends on users on Macs having root level access. It was only a matter of time before someone would target it. Whether more and more people target it is a completely separate issue. As a cross-platform user of all sorts of systems I generally prefer that things aren't targeted at all. I do enjoy the people saying OS X was inherently secure based on absolutely no knowledge of OS X's foundation finally being hit with the clue-by-four. Now they can actually start learning what it is they are spouting about and present intelligent arguments which are always better than empty ones. Of course that may just be a tad bit optimistic on my part. No system connected to the outside world is 100% secure, does this in any way change my thoughts on OS X security? Nope, not at all because I always understood this problem as it exists on any platform which lets the user download and run software.

Let me clarify: There is no OS ever made that is immune to user stupidity. I could have an installer for any *nix based OS authenticate then run rm -rf /* or "take over a system". This is a given. It's not a security flaw, it's a user stupidity flaw. When windows is appropriately bashed for its poor security record, it is due to unavoidable holes and exploits that allow escalation of privileges. IE has had a particularly horrid record in this area. Further, remote exploits impact on windows systems are aggravated by having said services enabled by default ready and willing for any network probe from an infected computer.

I suppose we could go

Re:But does it matter?

[fractoid]

If they automatically install, wouldn't they be viruses / worms? I thought the defining feature of a trojan is that it's a malicious piece of software masquerading as benign software, thus fooling the user into running it?

Anyway, the term 'Trojan' is annoying. In fact 'Trojan' should refer the compromised computer, and 'Trojan horse' should refer to the malicious software. Anyway... THIS IS MADNESS. >.>

Re:But does it matter?

[Allador]

Completely different to Windows trojans which automatically install. Actually, no. The trojan being compared (Storm Worm) functions exactly as you describe. No exploits, no vulnerability, pure social engineering. And thats the big one in the windows world right now.

Re:But does it matter?

[cheater512]

Its *one* of the many big ones in Windows at the moment.
This porn trojan is the *only* one for Mac OS X at the moment.

Slight difference.

Re:But does it matter?

[mcmaddog]

the local privilege escalation is of the social engineering type. The person is going to a porn site and being told they need to install a 'codec' in order view the movie. The trojan is downloaded and then asks for the password in order to be installed.

Whats the likelyhood...

[mrdoogee]

that this will move from the pr0n sites into the mainstream video sites?

Insecure settings

[xouumalperxe]

We're simply talking about social engineering. Windows, OS X, *BSD, Linux (and probably most other operating systems out there) are all vulnerable to this sort of attack, there's just little in the way of motivation to actually do it.

The part where the dmg is automatically opened is the only thing that even resembles a vulnerability as such, though it should actually be filed under "insecure default settings" rather than a vulnerability per se. This said, both linked articles are quite sparse with information regarding the actual installation. From my experience Safari should say something about the archive/disk image containing an application before actually mounting the dmg, and then prompting for an administrator password for the package to be installed. If either of these steps are compromised, you can call this interesting, because there's an exploit at work. If not, then it's a bog standard social engineering attack, to which every platform is vulnerable. The only news here are that you can't browse the web with your Mac in a completely carefree manner anymore, because there are some Bad Things out there targeting you.

Re:Insecure settings

[legirons]

"We're simply talking about social engineering. Windows, OS X, *BSD, Linux (and probably most other operating systems out there) are all vulnerable to this sort of attack, there's just little in the way of motivation to actually do it."

it seems like more of a proprietary/free thing, than an OS-specific one.

for example, if you 'accept' that you need to run programs from many different people (because they don't share code with each other, e.g. realplayer don't share code with ubuntu or apple) then you're more vulnerable to these types of social engineering

on a free system, you might just say "well if this codec was so good, surely debian would have packaged it". You might look for the codec on apt-cache instead of downloading software from a previously-unknown website.

and if you're still undecided at that point, you have the additional security layer of saying "well if debian don't want to package it, then maybe I don't want to run it" -- after all, they're usually pretty good at identifying good software and evil software.

so while this is a social-engineering exploit, it doesn't necessarily follow that free software users are vulnerable.

Re:Insecure settings

[p0tat03]

I don't think mounting DMGs automatically is necessarily insecure. There's nothing a malicious DMG can do even up to that point, and any user who was tricked into downloading this DMG will SURELY mount it for themselves and double click on the installer, even if Safari didn't do it for them. We're not talking about running an executable without user permission, we're talking more along the lines of extracting the contents for you.

Re:Insecure settings

[xouumalperxe]

for example, if you 'accept' that you need to run programs from many different people (because they don't share code with each other, e.g. realplayer don't share code with ubuntu or apple) then you're more vulnerable to these types of social engineering

But I *do* run software from a ton of people on my free software based systems. Desktop by GNOME, office suite by OpenOffice.org,mp3 and ogg codecs by... someone else I don't really know. I have more than once need packages that are not in the basic Ubuntu repositories, like strange sets of patches for nethack, Mathematica, etc etc.

on a free system, you might just say "well if this codec was so good, surely debian would have packaged it". You might look for the codec on apt-cache instead of downloading software from a previously-unknown website.

and then

and if you're still undecided at that point, you have the additional security layer of saying "well if debian don't want to package it, then maybe I don't want to run it" -- after all, they're usually pretty good at identifying good software and evil software.

Except that repositories are great with popular or semi-popular packages. Obscure packages are not necessarily in the repositories. Hell, last time I checked ubuntu didn't have decent support for midi out of the box.

More directly at your arguments, "well if this codec was so good, surely debian would have packaged it" and "well if debian don't want to package it, then maybe I don't want to run it", at this point the social engineering aspect of the attack has already failed. You, the user, are doubting the origin of the package, or the need for it. You're being technologically savvy. And free software has nothing to do with that (well, it does because it's mostly a geek thing -- for now).

Re:Insecure settings

[xouumalperxe]

I agree it's not a particularly grievous offense in the grand scheme of insecure settings, but I was being a fair, balanced guy, and enumerating what I thought might be Apple's fault in this issue, despite being an Apple user.

Re:Insecure settings

[Ash-Fox]

There's nothing a malicious DMG can do even up to that point, and any user who was tricked into downloading this DMG will SURELY mount it for themselves and double click on the installer, even if Safari didn't do it for them.

People say the same about displaying pictures and so on, but we all know there have been a tonne of exploits that proved these people wrong.

Re:Insecure settings

[p0tat03]

Why then we might as well just pull the network cable out of your machine then. DMG is a format that has been *widely* used for a number of years now. By your logic we should also prevent your browser from showing images (might be exploits in there!), or running javascript (that too!), or heck, we shouldn't even let you display HTML, 'cos who knows, there might be a buffer overflow vulnerability in your HTML rendering engine!

Automatically opening a file format that has no known exploits, and in fact has been devoid of exploits for the past... God knows how many years now... is really not a security risk, any more than showing a JPEG in your browser is.

Re:Insecure settings

[Ash-Fox]

By your logic we should also prevent your browser from showing images (might be exploits in there!)

I didn't express a opinion on what todo. I merely stated the fact that there can be a vulnerability.

That said, minimizing the risks by 'automatic execution' such as requiring one to click 'open' on the download box is a lot safer than having the browser automatically download the file and automatically executing it (tricking a browser to download a file is trivial in this case).

Automatically opening a file format that has no known exploits, and in fact has been devoid of exploits for the past... God knows how many years now... is really not a security risk, any more than showing a JPEG in your browser is.

I think the last JPEG exploit I heard of was in 2004 (Google 'jpeg exploit toolkit') and that was one that had a lot of press. There likely have been others since.

You put too much faith in the security of your system and that may cause your downfall.

Re:Hmm

[Penguinisto]

Well, let's see...

You find this "movie codec thingy" at a shady pr0n website (alarm #1), and it asks you to specifically download a .dmg file (alarm #2), install it with admin/root permissions (alarm #3) just to play a non-standard codec (alarm #4).

Meanwhile, by comparison, there are a whole host of Windows nasties you can get just by, say, visiting a website with a rigged IFRAME in the page.

QED: It's not a question of fanboys pooh-poohing something because it's their pet OS - it's a question of simple fucking logic.

Come back and tell us about it when OSX (eventually) has an attack vector that doesn't require the user to be a complete and utter dumbass, please.

/P

Re:fanboys unite

[MyDixieWrecked]

I've seen this story on several Apple/Mac related news sites yet, and the majority of the comments consisted of Apple apologists telling each other "nothing to worry about, because you still have to enter your admin password".

The type of people who will be infected by this will be similar to the types that get caught up in the 419 scam.

The only real reason this is news is because it's the first occurrence of an OSX trojan in the wild. Much like Crispus Attucks, it's only getting exposure because it's the first.

This really isn't any different than someone creating an applescript called FreePr0n.app that erases a user's harddrive, and as other commentors have pointed out, it requires a bit of user interaction to actually get itself installed. Although I'm sure people who jumped ship to OSX thinking that the mac is virusproof are going to run anything and everything they come across on the internet thinking their safe.

Good thing Leopard adds an extra layer of protection.

and why does safari have the Open "safe" files on by default, again? I don't get that.

mod parent up

[Werrismys]

The well-written parent message sums it up.

Re:Hmm

[binary paladin]

Oh come on. The only thing worse than the fanboys are the haters that think this is the beginning of Apple becoming like Microsoft in terms of malware and security.

If this was something that could, more or less, install itself purely by going to a website then I'd be worried and wonder what was up with OS X. Seriously though, if I download an rpm or deb in Linux and sudo to install it, there is nothing to stop that program from causing massive havoc if the author was malicious. The only way to secure a machine against this kind of attack is to make sure that you can't install software. That's it.

You can't secure someone's account who freely gives out his password. At some point in any security system, people can and often are the point of failure.

No machine and no OS is immune to someone with admin or root privileges installing bad software. Not Linux and not OpenBSD.

And frankly, anyone who installs any kind of executable from a porn site deserves whatever they get. If you decide to take off your condom and have unprotected sex with someone KNOWN to have herpes and you get herpes... whose fault is it? The condom's? Gimme a break.

Re:fanboys unite

[falcon5768]

there is a distinct difference between Apples administrator authorization, and Vista's prompt. Vista has a habit of prompting for even innocent non-vital changes that could in no way damage the system, while Apple's prompts only when something that is trying to access the System library directory.

You misunderstand what "in the wild" means

[KWTm]

"In the Wild," is laughable. How did the porn site "get infected"?

I don't think "in the wild" means that the porn site accidentally got infected. "In the wild" means that it is not within a controlled experiment or was not created specifically to be used within a controlled environment. The opposite would be a "proof of concept" trojan that someone might use to demonstrate at a computer security conference.

If it's possible for a Mac to get infected without the user's knowledge, then that qualifies as "in the wild".

It's not a virus .

[plasmacutter]

malware does not equal virus.

virii exploit security holes to install themselves forcibly and covertly.

malware exploits the gullibility of users to gain access to a machine.

virii hack the software or firmware of a given machine
malware hacks the wetware between the monitor and the seat.

Re:It's not a virus .

[El Lobo]

And your point is Einstein....? Both Malware, viriii, worms , trojans can these days (and often will try) spread by sending themselves via network connections or attachments , irc, and even simpleftp. The key words hera are CRITICAL MASS. If the Mak would have 92% of the desktop market, do you think malware and virii writers would ever botter to write for Windows?

Re:It's not a virus .

[plasmacutter]

the point is this:

this application requires you to:
a - go through the "you're downloading an application" nag screen
b - go through the "you are opening an application from the internet" nag screen
c - provide the root password

in windows you have to A - click on the link/attachment or merely open one directory with write permission to a network, B - run your virus scan months later and discover the worm installed itself through IE.

additionally, most of those circulation methods dont work on mac, the permission system prevents anything but voluntary downloads unless explicitly allowed otherwise, and access to each user's encrypted "keychain" where contact information and passwords are stored also requires a separate root authorization at least once, even for applications in administrator space.

Re:It's not a virus .

[El Lobo]

Hmm,,, when was the last time you used Windows? The same steps are requited in XP/2003 and Vista. ANS there is one more step: the file is marked with an alternated stream as downloaded from the internet, so you get a extra nag screen. Of couurse this won't stop the /thousand/ of users that will go through the 5 steps and get infected anyway.

Re:It's not a virus .

[Thundersnatch]

If only "virii" was an actual word, you'd have me conviced.

Too much security can breed complacency

[Shivetya]

One thing I noticed was that the more times a user has to enter their security password the more likely they become complacent and assume that any install is going to require it and any install that occurs is going to be safe.

Basically what sunk later attempts by Microsoft to patch security. As soon as they added "warnings" (aka popups) people got into the habit of clicking yes and thereby undoing any chance the programmers had at protecting users from being stupid. You can even blame this behavior on EULA's which require click through - people do this automatically.

As the Mac gains in popularity the numbers of careless people will go up and infections like this will occur more often. The key is finding a way to train the user that its WRONG. That or finding a way to have the OS run objects installed in some form of "safe mode" for a time without letting the user in on it.

Re:Too much security can breed complacency

[KDR_11k]

We've been taught in Human Computer Interaction that the more often an event occurs the less likely the user will care. It's stupid to ask the user "are you sure", he's always sure when he's doing that. He's probably no longer sure a few minutes later so it's more important to let him undo rather than asking him every time he does anything.

Re:Too much security can breed complacency

[L0rdJedi]

As the Mac gains in popularity the numbers of careless people will go up and infections like this will occur more often. The key is finding a way to train the user that its WRONG. That or finding a way to have the OS run objects installed in some form of "safe mode" for a time without letting the user in on it.

The people that recommend Macs can start by telling people that you're less likely to get infected by viruses and spyware, but that you still need to be diligent and not type your root password at every prompt. This blatant "Get a Mac and you'll never have to worry about viruses again!" crap has to end. That alone makes people drop their guard and just type their password whenever they're asked because "I can't get a virus, I have a Mac!"

You're an idiot.

[Americano]

If you're stupid enough to go through all of those steps, you deserve to be infected.

One more time. You're an idiot.

1. This is an *insecure* default setting. I don't care if it asks you for an admin password, automatically running things downloaded from the internet shouldn't ever be a "default".
2. This is not a NEW "exploit", I remember hearing about this same exploit in a different form at least a year and a half ago. Apple had plenty of time to disable this feature (or at least turn it off so people would HAVE to do the "dumb" thing and re-enable it) and they have not.
3. The asshats who write these trojans cost EVERYBODY time, money, and effort. If it were limited in effect to the dumb user, a la "oops, I deleted some files I didn't want to delete!", it would be *slightly* better. But identity theft, break-ins, DDoS attacks, spam, etc. are all costly effects of these "dumb" users "getting what they deserve."

I'm an apple user. I own several of their systems, and find them -- on the whole -- to be incredibly fun and easy to use. But Apple shouldn't get a free pass on this (nor should Microsoft, nor should Canonical or any other Linux distro). By setting this trivial "convenience" up by default, they've made their system more insecure. Yes, there are still people who will double-goddamn-click on anything and everything, but let's at least make it harder for the simpletons to inconvenience all of us. It would be a fairly simple fix for them to make, and one which they should have made a long time back.

Re:You're an idiot.

[marcello_dl]

> This is an *insecure* default setting. I don't care if it asks you for an admin password, automatically running things downloaded from the internet shouldn't ever be a "default".

If it asks for a password is not automatic.

Besides, when you have installed enough innocent stuff which windows frowns upon because it's unsigned you are not going to mind the warning dialog anyway. Are you sure that the problem between keyboard and chair will react differently on OSX vs. Windows?

Re:You're an idiot.

[plasmacutter]

I'm reading the list from the preference pane:
movies
pictures
sounds
pdf and text documents
disk images
other archives

nowhere does it "run" anything, it opens them in their respective application (stuffit, an extension of disk utility, preview, quicktime)
if the file is "disguised" the respective application will throw an error and refuse to open it.

this automatic feature actually prevents the "double clicking" which was supposedly how the "virus that poses as an mp3" installed itself.

Re:You're an idiot.

[That's Unpossible!]

I don't care if it asks you for an admin password, automatically running things downloaded from the internet shouldn't ever be a "default".

Careful who you paint with the idiot-brush.

This doesn't run executables, it displays media using the default player. In this case the media was a disk image, and the default player was Disk Utility. The password prompt came when the installation tried to do something naughty.

Seems like they found a good combination of ease and security.

Re:You're an idiot.

[Americano]

Besides, when you have installed enough innocent stuff which windows frowns upon because it's unsigned you are not going to mind the warning dialog anyway. Are you sure that the problem between keyboard and chair will react differently on OSX vs. Windows?

No, most probably won't react differently. But that's not a valid reason to ship Safari with a default setting that helps you along in the process of hosing your system. There are known issues in Disk Image (.dmg) handling on Mac OS X which can result in kernel panics and overrun scenarios... automatically opening every .dmg you download from the internet is an unsafe practice, no matter how you parse it, and regardless of how big or small your install base is. You've put a setting out there that people don't know about and which can surprise them in very nasty ways. Turn it off, and let *them* decide to take the risk if they choose to.

Re:You're an idiot.

[aarku]

A .pkg "Installer" is not an executable, it's the format that Installer.app works with. Nothing is run until you tell it to run. It's not executing random code like a Setup.exe.

Re:You're an idiot.

[Americano]

Uh huh.

Finish this sentence for me, please:
Defaulting to automatically opening disk images, when there are known instances of specially crafted .dmg files causing kernel panics and buffer overruns is considered a "secure" practice because . . . ?

Re:You're an idiot.

[plasmacutter]

more like a neutral practice because...

the user will end up trying to open them anyway
the security problem is not in the browser but in disk utility, which handles disk images

Re:You're an idiot.

[rhakka]

no, seriously, .dmgs are not automatically opened when you download them. You're first warned that it is an application, and then it asks you for an admin password in order to install. At least, that is what my mac does, each and every time I download an application from the internet, and that was a default setting.

exactly what else do you want?

The percentage of infections will be telling

[Colin Smith]

If it barely spreads then the security model is relatively successful. If it spreads like wildfire, creating a 50 million machine monster supercomputer at the hands of international criminal cartels, then the security model could be said to have been less than successful.

Re:The percentage of infections will be telling

[Jezz]

No it wouldn't. The security model isn't an issue. It is the effectiveness of the social engineering - no (mainstream) OS (yes, including all the Linux distros I can think of) does this anymore securely.

So no, the percentage of infections isn't interesting at all when looking at the security model of Mac OS X.

Of course, it might say something about the users of the Mac... but really, I don't see them as much different to Windows users (they just have nicer computers ).

Re:The percentage of infections will be telling

[Colin Smith]

No it wouldn't. The security model isn't an issue Bollocks. Of course it is. Effectiveness is the measure of a security model.

Re:The percentage of infections will be telling

[Jezz]

The security model of OS X isn't in question HERE. Simply put this is how computers work in 2007, you (the user) choose to download something, you the user choose to install it, the OS prompts for a valid admin password (to make sure you are allowed to do this) and then the software is installed. If that software chooses to do something "nasty" then it can, because the user has given permission. What do you want a computer that WON'T let you install things?

Sure there is room for technical change to address this, Leopard had the beginnings of some of these changes (sandboxes) but (Like Solaris Containers - but less fully baked, don't run away trusting Leopard's Sandbox technology quite yet, it still needs work. Really these problems are about policy not the underlying technology.). But really this is a case of the security model of a "modern" (if a Unix-a-like can be called that) OS doing exactly what's expected (what the user tells it, not what's best).

Actually having seen more about this, it really should raise alarm bells in any savvy Mac user's head - the message is hard coded onto the webpage and doesn't look at all like a Quicktime message, given this the decision to download, decompress, and install is even more questionable.

Really, if this were on Windows, it would be a total non-story. Of course, many versions of Windows wouldn't require the assistance of the users. You'd be better thinking of this as malware that requires the user to infect their own machine! I know that sounds funny, but this is social engineering, making the user believe they are doing something reasonable. It's only one step up from telling the user they need to change their DNS settings to view the content and putting screen illustrations on the site to "help them". This isn't a test of the OS, you might consider it a test of human nature (or more cynically a test of Mac users) if you want to.

I find the idea that OS X is the new Windows 98 rather amusing.

Intego

[eclectic4]

Yes, but hasn't Intego tried to scare Mac users into purchasing their virus protection before? In fact, they've done this quite a bit. Check out their report and pay close attention to the "Means of protection" paragraph at the end of the article.

The news is Intego attempting to scare up business, this is not a Mac virus, especially when you have to do quite a few stupid things along with giving permission to install from an admin. My goodnes...

Re:Intego

[Penguinisto]

If they're stupid enough to think their A/V product can stop $RANDOM_TROJAN which $USER has to explicitly install as root, why the hell would I want to rely on them to defend against a potential real virus?

/P

Re:Intego

[eclectic4]

Very true. I apologize for not having mod points ATM.

"Target" must have administrative rights...

[neuroklinik]

The "Target" here must be a user with administrative rights to the console. No admin rights, no install.

A simple question answers it all.

[kanweg]

So Windows fan-bois, ask yourself the question: Would Mac-users now want to switch with you when it comes to malware? 1 troyan versus tons of bad stuff? That is a no-brainer except for no-brainers. But is this troyan a problem for Mac-usin', Porn-surfin' slashdotters (now you know why Apple promotes big 30" screens, right? Never seen an add that bigger is better?)? No. When surfing for those pictures that sneakily attempt to promote that breast-milk is best, Safari's Private browsing setting can be used. No stuff is downloaded to the hard disk. That includes no malware.

Bert

Full Control of the Machine?

[His Shadow]

Bullshit. It appends the DNS servers to point the user to phishing and porn sites and runs a cron job to make sure the changes are modified. Does it then email everyone in your address book and infect every other machine on your network? No. It can't even install itself without the Admin password. It's a social hack.

Nice Try tho...

Re:Full Control of the Machine?

[Professional Slacker]

But you missed the point, they DO have full control over the machine. Sure, the current payload just doesn't make use of it's environment, OSX is BSD which is UNIX, which means... if you've got the security privileges to be changing around DNS servers, it's because you've got the keys to the castle. The attackers have a process running as root, simply because they don't exercise full control doesn't mean they can't.

It doesn't need to spread, it's a trojan not a worm, again it doesn't need to work without user interaction it's a trojan not a worm, and yes there is a degree of social engineering at play but (wait for it...) that just means it's not a worm, which we already knew because it's a trojan.

Re:Hmm

[Bill, Shooter of Bul]

Unfortunately with the rise in popularity of Macs, more naive users are adopting the platform. Three friends who used to get a virus weekly, by trying to look at "photos" people had emailed them are now on Macs. They won't give it a second thought, they could probably be conned into putting in their credit card number, social security number and sign over their firstborn, if the sketchy web site told them to.

Granted an OS can only do so much to protect such users, but people don't blame themselves when they do stupid things on computers they blame the computers.

Re:Hmm

[NatasRevol]

Trojan, that requires the admin password.

So much more user friendly

[blueZ3]

The Windows way. None of this download, mount, open, click, password, click, click nonsense.

Who says Macs "just work"? Obviously they don't for trojans!

Re:So much more user friendly

[Anonymous Coward]

On linux is
1.Goto a site
2.Download beta version of plugin which MAY work for linux.
3.Discover that you need to Install a version X of Y and related libraries before it works.
4.Configure the plugin
5.Compile
6.watch it crash after a hour and find bugs at the source code, hoping they are minor.
7.Tweak the code and compile it second time.
8.After that you can enjoy your new plugin.That if it doesn't leaks enough memory to make firefox unstable.
(obviously posted as anonymous)

Re:fanboys unite

[joeytmann]

But if you think what you are installing is legit software, most of the "stupid/gulible" users out there are going to type in the admin password. Social engineering is just as important as the trojan itself.

Intego at it again

[eclectic4]

Yes, but hasn't Intego tried to scare Mac users into purchasing their virus protection before? In fact, they've done this quite a bit. Check out their report and pay close attention to the "Means of protection" paragraph at the end of the article.

The news is Intego attempting to scare up business, this is not a Mac virus, especially when you have to do quite a few stupid things along with giving permission to install from an admin. My goodnes...

Linux virus

[Nick_taken]

I created a virus for linux its gonna be on slashdot next week. (run as root please) #!/bin/sh sudo rm -r /

Looks scary

[wumpus188]

But easy to remove.

mod grandparent down

[sm62704]

What dumbass can't spell "wild"?

Oh hell I guess it's me... ;)

Re:mod grandparent down

[Thwomp]

Fortunately it's not too far from what you meant ;-)

wold noun. An unforested rolling plain; a moor.

Suck It, Mac Haters!

[CheeseburgerBrown]

No more shall we endure your taunts of being too obscure a minority to content with! Even the Russian Mafia thinks we're worth taking notice of now.

...Now we too shall now the bane of being pestered by colleagues and neighbours to help them score pirate software and to undo the embarrassing things they do their machines.

maximum .dmg

[digitaldc]

The attack site attempts to trick users into download a disk image (.dmg) file disguised as a codec

I always knew there was something phishy about a .damage file. They should have never named it .dmg, it just begs to be used to .damage something!

the .dmg gets mounted and the Installer is launched. The target must click through a series of screens to become infected but once the Trojan is installed

Lesson learned - NEVER mount a .damaged Trojan, or you may become infected.

Re:P0rn is FREE!!!

[Penguinisto]

BTW, I have an e-card for you at: http://127.0.0.1/ecard.htm and you will need to download a "special player" to see it...

Fix your website... it keeps giving me the default Apache test page for some reason.

(kidding!)

/P

Re:It's about CRITICAL MASS...

[Brainix]

Your argument isn't as original as you'd like. It's also flawed. Just compare Apache to IIS. Apache has much greater market share, but IIS get exploited like Swiss cheese. How do you explain that?

Another counter argument: Although Linux has a much smaller installed base than Windows, a cracker could stand to gain much more by exploiting Linux. Imagine the wealth of sensitive data hosted on Linux servers.

Indeed

[goldcd]

The effectiveness of this trojan is going to be how similar the above steps are to what you'd be asked if you were installing a legitimate codec.
If you thought you'd downloaded a codec and those are the steps required to install a codec, then people will do precisely that.
Not that I'm picking on Apple here, it's exactly the same on Vista. If you present some malicious code as something that requires root access to install, then people will blindy install it. Not quite sure what the solution is to this problem, apart from maybe an extension of the authorization process. Maybe instead of just asking for admin, it should ask "It looks like you're trying to install something to do with Networking -> DNS"... actually the more I read that I get vision of Clippy.

!=vulnerability

[xgr3gx]

Yeah, I agree with most posters. It doesn't really count if the user has to run it manually, and run as root to get it to work. It's a problem with the user, not the OS - any OS is vulnerable when the user is not privy to this kind of attack.

Not really

[ThirdPrize]

As a mac user user you normally end up downloading a load of shareware as there isn't much proper software out there. Certainly some of it require admin privileges to install and run. That dialog box asking for the admin password is NOT the same as a warning saying "do not install this". It just means you have to enter the password to continue. I can't remember, does Flip4Mac require a password to install? That is a codec and a good comparison.

Re:Not really

[Stamen]

load of shareware as there isn't much proper software out there. First off, shareware is a method of distribution, not a type of software. Most software that is called 'shareware' isn't. If being able to download and demo software for a period of time then unlocking it with a serial number is shareware, then Photoshop and Microsoft Office are shareware.

Second off, I assume you mean software from small independent vendors, I'm curious why this type software isn't "proper software".

Lastly, you rarely "install" applications in OS X, it isn't Windows. You can run them from your own Applications folder which requires only your own rights. The apps that do require admin rights, are modifying the system in some way, and those do require you to give the administrator password. Since this dialog is rare, people do pay special attention when it pops up. There's only so much an OS designer can do.

Re:Not really

[ThirdPrize]

Alright, a bit of a generalisation on my part but there are less programs out there for the Mac than for the PC. That is just stating a fact and lot is from independent vendors. These could be one person or they could be a small team. You can be pretty sure Adobe aren't gonna screw your machine but as a Mac user you have to trust these indepenent vendors.

Yes, some software you run directly from Applictions but some does use an installer. No idea why. If an installer asks for a password then you have to give it. You can't ask why, it's either that or nothing.

Re:Not really

[Stamen]

Unfortunately, this trend to use an installer is starting to increase, which drives me crazy. Most of it is ported apps, from people who just aren't familiar with the way OS X works. I guess this is the price you pay for increased popularity of your platform.

It's true that more software on the Mac comes from independent developers. I really like this, most of what I use is either open-source or from someone small; which I'm happy to give my money too. One nice thing is, OS X is a small community, and if an app is good people talk about it, and if an app is bad people really talk about it. It's easy to be a tiny developer, and still get a major right-up in a national magazine, or sell your software on the shelf in an Apple store. Reminds me of the Windows market 10 years ago; sad how that has all changed over in that community.

Re:Not really

[HTH NE1]

The apps that do require admin rights, are modifying the system in some way, and those do require you to give the administrator password. Since this dialog is rare, people do pay special attention when it pops up. There's only so much an OS designer can do. Speaking of which, is there a setting I can make so that the Details pane is open automatically on these windows? I want to be sure it's coming from the application I think it is coming from and don't like having to click the disclosure triangle every time to find out.

Re:P0rn is FREE!!!

[YukonTech]

Everything on the internet can be found for free somewhere / somehow but some people like to pay for convience, quality, or to support the "artists". Just providing the other point of view. Its pretty arrogent for you to sit there and think you know better than everyone else, and everyone who disagree's is wrong, what about people who have interests that can't be filled with WoW on entsity.net? :P

Re:Hmm

[JamesRose]

http://www.apple.com/getamac/viruses.html

And i quote "850 new threats were detected against Windows. Zero for Mac."

Yes, it admits it's possible, it doesn't however, admit there are any.

Re:Hmm

[Rycross]

If your Windows machine is unpatched, yep you can probably get hit with something via IFRAME. Up-to-date machines aren't quite that easy to hit with malware though. Most modern day Windows malware happens via trojans, just like this Mac trojan.

The steps are pretty much the same as the ones you gave above, except maybe #3. To be fair though, Vista tried to add #3 and its pretty much universally panned as being "stupid" despite being pretty much the same damn thing. Oh, and when its Windows, its never the user's fault; only Window's.

And yes, it was my personal experience that, as far back as 2003, most infected users explicitly installed the software that infected them. Cursor packs and custom themes, Kazaa, random P2P applications, wierd codecs, etc.

So basically, if people are whining, I'd imagine its because of the perceived double standard, wherein "Windows user does something stupid -> OMG WINDOWS SUCKS," but "OSX user does something stupid -> OSX is perfect, the user is just stupid."

Let's Recap

[MattPat]

I know it's been said before, but it bears saying again: this is considered "in-the-wild"?

When a virus has to ask a user to install it, it becomes purely a social engineering attack. In my opinion, if anything this says something positive about the security of OS X itself, in that is apparent weakest link occurs between the chair and the keyboard.

Re:Windows users are as bad.

[Sczi]

IMHO, that's the best way anyway.. "Once windows is busted, it can't be trusted".. I've cleaned my fair share of infected pc's, but they always get reinfected. So then the question becomes "did I miss something, or did the knucklehead just do it again?".. and of course there is no way to answer the question, but I'm sure there are cases of both.

That's how they spread.

[khasim]

Trojans don't rely IE vulnerabilities to get email addresses after infection.

I did not say that they did. I said that the trojan scanned the hard drive of the infected computer to find anything that looked like an email address so it could send links to those addresses.

If someone clicked on one of those links AND had a version of IE that was exploitable, then they were infected.

That is how X increases in the Windows segment.

They can do the exact same thing they do on Windows on an OS X box once infected.

Yes they can. But they still depend upon a browser vulnerability in that scenario. Microsoft's decisions with IE (ActiveX, "integrating" it into the OS) means that the exploits are worse with IE than with, say, Firefox.

It was only a matter of time before someone would target it. Whether more and more people target it is a completely separate issue.

Targeting it does not matter. What matters is how to increase X%.

If the infection rate is below the disinfection rate, the trojan dies "in the wild".

As a cross-platform user of all sorts of systems I generally prefer that things aren't targeted at all.

Yeah. You go with that.

I do enjoy the people saying OS X was inherently secure based on absolutely no knowledge of OS X's foundation finally being hit with the clue-by-four. Now they can actually start learning what it is they are spouting about and present intelligent arguments which are always better than empty ones.

Actually, it appears that your argument is the one that is empty.

Getting ONE person to infect his Mac is not much of an achievement. With enough users, eventually you'll find one dumb enough for fall for any scam.

What matters is how fast it will spread.

So far, this trojan has demonstrated that Mac's are extremely secure. The trojan is not spreading.

Compare that with the Storm Worm.

Of course that may just be a tad bit optimistic on my part. No system connected to the outside world is 100% secure, does this in any way change my thoughts on OS X security? Nope, not at all because I always understood this problem as it exists on any platform which lets the user download and run software.

And who is saying that 100% security is needed?

Security is a PROCESS. Not an end-item.

All that is needed is for Mac's to have an infection rate that is BELOW the disinfection rate. The the viruses and trojans and worms will all die "in the wild".

No need to make any claims about "100% secure" or not. It's the infection rate that matters. Does it spread faster than it is removed? If it does not, then it is not a threat. If it is not a threat, then the Mac is still considered "secure" by its user.

Re:That's how they spread.

[toadlife]

So far, this trojan has demonstrated that Mac's are extremely secure. The trojan is not spreading. It next to impossible to spread a worm when the potential hosts make up such a small percentage of the total population.

Compare that with the Storm Worm. When OSX and Windows have a roughly equal installed base, a comparison can be made.

Re:That's how they spread.

[Vancorps]

Actually you completely missed my point entirely. Congratulations on your poor reading comprehension.

No matter how secure your browser is you will still find people that download and run malicious software. That was my entire point. It is irrelevant what platform the user is running because it's the same problem whenever a user is allowed to download and run software.

You just seem eager to write this off trying to rely on OS X being magically secure when it does have its problems. I knew about this problem all along and so did most people that have any kind of security background. If you give the user freedom expect them to screw it up.

As for the infection rate, that does indeed matter but a trojan on a Mac is just as capable of scanning a Mac for email addresses and propagating further using the same mechanism as it would on a Windows box. There is nothing in OS X that magically protects the user from themselves. I've seen Mac users blindly click and even type passwords when it pops up on their screen. This problem is not unique to Windows users so matter how much you would like to blame Microsoft for this particular fault.

Furthermore, IE7 and even IE6 don't automatically install software from websites. IE 7 in particular is much improved in regards to security which is why it broke so many web applications. IE 6 you had to manually turn off ActiveX installations but you always had the ability, even in IE 4.

Last "argument", more of a question really, how in the world do you make the logical leap that this demonstrates that OS X is "extremely secure?" As I said in my post, this has absolutely no baring on how secure OS X is as its a cross-platform problem. It is merely an illustration of the same problem encountered everywhere in every aspect of society. You can be driving the safest car in the world, if you drive like an idiot you will still eventually get into an accident. The two are loosely related so I understand the confusion but I would expect someone commenting on the security of a product to be familiar and demonstrate that familiarity and realize that this problem will continue to exist, that it was always there and has nothing to do with this specific exploit as there are hundreds of other examples which don't propagate on their own. I monitor my network activity and I'm aware of trojans that crop up and over my admittedly not too many years of experience I've seen it on many more than a single occasion on OS X, Windows, and even various Linux distros.

Until humans stop trusting one another which will be a horrible day this problem will exist. It can be mitigated through education but the risk will always exist.

Re:That's how they spread.

[drsmithy]

Yes they can. But they still depend upon a browser vulnerability in that scenario. Microsoft's decisions with IE (ActiveX, "integrating" it into the OS) means that the exploits are worse with IE than with, say, Firefox.

While the ActiveX part is debatable, IE being "integrated" doesn't make exploiting it inherently any more damaging than Firefox. There's nothing IE can do that Firefox can't (and in many cases it can't do as much, since in some configuration IE runs with decreased privileges by default).

If the infection rate is below the disinfection rate, the trojan dies "in the wild".

It dies when no machine still has it installed. This is an independent factor to "rates".

So far, this trojan has demonstrated that Mac's are extremely secure. The trojan is not spreading.

Market share has a massive impact on propogation rates. It cannot be dismissed out of hand.

Re:That's how they spread.

[Jezz]

This logic is flat out wrong.

THIS Trojan does nothing to show a weakness in Mac OS X (compared to other systems in large scale use).

Of course, we're only talking about this one - which is really an social engineering issue (the user is tricked into installing it - the OS doesn't install it, the user even has to type the admin password!) a different attack could be quite different. Thus far we've not seen that on Mac OS X, that's not to say we won't - just hasn't happened yet. That happening is no more or less likely today than it was yesterday. There have been flaws in Mac OS X that could have allowed that, but the ones **we** (I mean us, not people inside Apple or people working to find such flaws in OS X for "fun or profit") know about have been patched. Is this different to Windows? Possibly only in terms of scale, that is there **may** have been fewer such flaws (you know the really nasty ones that can allow something nasty to happen on a "normal" box) or there **might** be fewer people seeking "fun or profit" on Mac OS X. Personally I think both are true, and that might explain a lot. I'm perhaps a little less inclined to think Apple fix these things **much** faster than Microsoft. Never the less the Mac is my "weapon of choice" (most of the time).

Re:That's how they spread.

[toadlife]

Were you replying my post?

I never claimed that this worm demonstrated any weakness in OS X. Just that the worm not spreading does nothing to demonstrate the security of OS X.

Re:That's how they spread.

[Jezz]

The point I'm making is that the small size of the Mac installed base isn't relevant here - THIS thing's spread would be low even if it targeted Windows (assuming it had the same requirements - which let's face it, means either a non-default XP setup or Vista). The number of Macs isn't an issue. The issues are:

The visibility of the site.
The effectiveness of the social engineering.

That's it. We'll only see a relatively small percentage of Macs infected - and the OS isn't even a factor.

Now I'll admit that x% of the installed base of Macs is far fewer machines than x% of Windows PCs - but this is irrelevant to the spread in THIS case.

Re:That's how they spread.

[Allador]

You do realize that the Storm worm and similar attacks dont rely on any sort of vulnerability at any stage of their attacks, right?

They rely on someone unzipping and executing a piece of software received by email or from a weblink as root. Thats it.

Re:That's how they spread.

[Erik K. Veland]

Security by obscurity is a fallacy. Shame on you and whoever modded you "insightful".

Re:That's how they spread.

[toadlife]

I never advocated 'security by obscurity'.

Re:That's how they spread.

[Cally]

But it's not a worm. It's a trojaned file the victim downloads and executes. There's no "spreading" from an infected machine.

Downloads from porn sites

[Aqua OS X]

I don't know about you, but if grandmagoldenshowers.com recommends that I download software, I do. If my operating system give me a detailed warning about the software that I downloaded from the porn site, I disregard it. And if I'm forced to authenticate the installation, I do.

Porn sites have given me hours of free orgasms at my desk, why wouldn't I blindly trust them?

Oh and I also always give my credit card and social security number to Ebay when they're having problems with my account and they direct me to www.secureauthenticate.ebay.com.

Re:Downloads from porn sites

[martin_b1sh0p]

Oh and I also always give my credit card and social security number to Ebay when they're having problems with my account and they direct me to www.secureauthenticate.ebay.com.

Oh man you've been had!!! Every time I give them my SSN and CC it's at www.ebay.secureauthenticate.com. Obviously the site you have listed is a bogus / malware site!!!

Re:Downloads from porn sites

[greyhueofdoubt]

Porn sites have given me hours of free orgasms at my desk, why wouldn't I blindly trust them?


Intended or not, that was the best play on words in this thread :)

-b

Re:Hmm

[NatasRevol]

And there still aren't any viruses on the Mac, in the wild.

So the page is still correct, even today.

Re:fanboys unite

[Sczi]

and why does safari have the Open "safe" files on by default, again? I don't get that.

Why is there even such a setting for anything in the context of a web page? "safe" web files?

Btw, what would happen if the setting were not set that way? Would they be prompted to save it and presumably suffer the same consequences if they run it by hand?

No it isn't

[Sycraft-fu]

I hate this ignorant attitude that unless something happens automatically it won't happen. Sorry, but most trojans go in the front door, not the back one (hence the name "trojan"). Better than 90% of the infected computers I encounter are infected with something the user had to take an active hand in installing.

One of my all time favourites was an e-mail virus. This happened after we installed our spam filter, which is also a virus scanner, so it was a surprise to us since installing it had dropped the occurrence to zero prior to this (no matter how many times we harp on them, many people refuse to run virus scanners). At any rate the way this file got around the virus scanner was by sticking itself in an encrypted zip file. It would then put the password to decrypt in the e-mail message.

So what a user had to do was get the e-mail, save the attachment, try to open it, look in the e-mail for the password, enter the password, get the exe, ignore everything we told them about not running exes and then run the exe. Quite complicated yet a number of people (4 if I remember correctly) did it. They assumed it HAD to be legit.

Well, same shit here. This is just proof that no, requiring an admin password doesn't make your system magically secure if the admin is willing to give it up. All they did is present the user with a mildly plausible scenario (that you need a new video codec) and bait that the users wanted (a porn video) and there you go.

This is simply proof of what many of us have been saying for a long time: Things like needing to enter an admin password are just hoops for a normal user to jump through. They do nothing to enhance security if there isn't a skilled operator. It isn't some magic security shield that will protect you from evil stuff. The power to install software implies the power to install bad software. The power to control a system implies the power to damage the system, and so on.

There's been a lot of make-believe going on that MacOS is immune to spyware/trojans because of its design, specifically the privilege escalation thing. This is proof that's not the case. You can put as many hoops up as you want, if the users want what's at the other end bad enough, they'll jump through them without looking to see if they are on fire.

Re:No it isn't

[giminy]

There's been a lot of make-believe going on that MacOS is immune to spyware/trojans because of its design, specifically the privilege escalation thing. This is proof that's not the case. You can put as many hoops up as you want, if the users want what's at the other end bad enough, they'll jump through them without looking to see if they are on fire.


Got a reference for the "MacOS is immune" line? I have never seen a person say that the OS is 'immune.' MacOS is more resistant, though, because of design decisions such as prompting users when they are installing executables, and only allowing executables and kernel extensions to be installed by a user with administrative privileges (and only after they authenticate with the system again). The OS has been doing this for a long time, and these security cues have begun to be duplicated by other software vendors because they are at least somewhat effective.

I agree that if a user wants something badly enough, they will do dumb things. Putting at least some sort of barrier in front them will greatly reduce their idiocy, though. Telling a user what's going on can't hurt, it can only help.

Besides, who wants to download a codec just to see porn? It's far easier to just move on to the next site...

As for the 'in the wild' remark, to me the term has a semantic edge to it that implies a virus/trojan that is self-replicating, or at least takes some steps to *try* to spread itself, even if that step is only to relay spam with links to the infected website. Writing the shell script "#!/bin/sh\nsudo rm -rf /" and then placing it on a website could probably be considered an "in the wild" unix trojan by a more relaxed definition, but I just call it what it is: a very stupid program.

Re:No it isn't

[NemoinSpace]

Got a reference for the "MacOS is immune" line?

I couldn't find a good one, but oddly enough, a google search came up with these results.

• Results 1 - 10 of about 1,200,000 for Xp is immune.
• Results 1 - 10 of about 665,000 for vista is immune.
• Results 1 - 10 of about 38,700 for MacOS is immune.
• Results 1 - 10 of about 40,200,000 for linux rules. That's why i prefer my own experience to other peoples references. Firewalls are girly-man toys.

Re:Hmm

[Anonymous Coward]

Okay, how about I do. iPhone runs MacOSX, right? Well, it does have a vulnerability that lets a malicious website or email content take complete control of the device. It's been there for a couple of weeks, is highly publicized and Apple has yet to fix it.

Nothing like having a website able to dial 911 for you, eh?

http://secunia.com/advisories/27213/

Re:P0rn is FREE!!!

[Dystopian Rebel]

Sir, you may well be the Richard M Stallman of Pr0n.

Local vulnerability = the user

[mveloso]

Actually, it sounds like the user is prompted to install it. There's no local priv escalation vulnerability, unless you count the local user installing the plugin a privilege escalation vulnerability (which, in essence, they are).

It's amusing, because installing a codec for some bizarre video format is something that people would do. Soon, there'll be a "Flesh Player8.0" that you'll need to install, made by "Micromedia"!

Re:Windows users are as bad.

[Rycross]

To be fair, once any OS has been compromised, its pretty hard to fully trust it again. I find that reinfection is mostly caused by users doing the same stuff over and over again. I always try to educate people when I fix their machines, and set up auto-patching, etc. Of course, most people want their computer to be an appliance, not a general purpose machine.

works on Mac OS X too

[objekt]

just enable the root account and type that into the terminal.

Re:works on Mac OS X too

[objekt]

No, they don't. And that part I mentioned about enabling the root account was just a big lie. A really big lie. Macs don't even have a terminal program. And they use a one-button mouse. And they only do black and white.

Re:It's about CRITICAL MASS...

[El Lobo]

hmmm... in which year are you lving? IIS 7 and 8 are reported with 0 critical vulnerabilities and have not been seriously threatened. Now if you tell me II4, then... that was another five cents.

Porn...

[Google85]

porn looks better on Windows, geeky on Linux, and totally gay on Apple!

Re:P0rn is FREE!!!

[holmedog]

I wouldn't say free, because your paying for it by looking at the ads on the side of the screen, but two that come to mind are www.newbienudes.com and www.postyourgirls.com

Re:fanboys unite

[noamsml]

int main() {while 1;}

Re:fanboys unite

[MyDixieWrecked]

well, it would be less automatic.

I feel that a non-technical user would be less inclined to actually go through such a process if it required actually mounting the DMG and doubleclicking.

If the installer window simply pops up after they click the link, it may appear that it's coming more from the browser and less from the actual computer's system.

In my experience with non-technical users, there's no difference between the computer and the operating system and the GUI... However, the webbrowser is "the internet" and what happens in a browser isn't part of their computer.

and I agree with you about this "safe" web file thing. When I first saw that, I bitched about it and I really didn't imagine it surviving this long... what, has it been like 3 major revisions to the OS since it first reared its ugly head? I think it's been around since the original betas of Safari. sheesh.

you have to do quite a few stupid things

[Anomalyst]

1) give money to Apple
2) cluelessly download a new codec
3) ????
4) get pwned

Re:Hmm

[mrbluze]

Looks like the Mac fanbois are abusing the moderating system again. Sadly, looks like they confirm your post by modding you a troll.

Re:Nothing to see here...

[idontgno]

"Porn, Porn, Porn!"

Trekkie Monster, Avenue Q

However, for the MMORPG ref, the World of Warcraft video made from this song is also quite amusing.

Re:fanboys unite

[MyDixieWrecked]

oh, and to add to that...

I'd bet that if you created a site that would detect the OS of the user and present them with a file for that system claiming "This website uses new features of Web 2.0. Please run the attached update to get the full experience," that you would get a pretty decent number of people running that application.

Especially if you tailored the message for them a la "Firefox 2.0.8 running in Windows Vista does not support..."

never underestimate the security people feel when their browser automatically does things as opposed to them actually having to manually run things.

Re:fanboys unite

[Genady]

VMS. When's the last time you saw a torjan for that??! HUH?!?!

Re:fanboys unite

[plasmacutter]

the xbox 360? : )

It's not a horse, it's a series of tubes

[Scrameustache]

A trojan is a program that does or claims to do something useful, which gets you to install it. Once installed, it does something else in addition to or instead of what you installed it for. Amazingly, that sentence still works if you replace "program" with "rubber tube".

Re:P0rn is FREE!!!

[davidsyes]

Well, if the Internets are going to replace people in relationships, then those without relationships have to go SOMEwhere. Maybe they will find their wet, queasy feeling moments after DOWNloading the softwear onto their hardware.

Now, what WOULD be scary is if the REALDOLL came, err, umm, ARRived with trojans and malewear, umm, malware. "Excuse, me, butt, I need your assword and for you to turn over for my social reengineering progam to bootstrap you."

we're off to see the wizard

[Scrameustache]

I'm sure people who jumped ship to OSX thinking that the mac is virusproof are going to run anything and everything they come across on the internet thinking their safe. That's the thing about straw men: No brains

Click through...

[SteeldrivingJon]

"The target must click through a series of screens"

And engage in a specific pattern of toe-tapping and handwaving.

Re:fanboys unite

[KDR_11k]

Yeah but if it's successful in duping the user into doing that it's stupid to herald the admin password as some sort of panacea for all security problems.

Mac users watch porn?

[r_jensen11]

I thought that, given their hip status, that they'd be having sex instead of watching porn. Does this make them as pathetic as Windows users, yet?

Re:Mac users watch porn?

[narratorDan]

We do have sex, but maintaining our hip status also requires that we know the latest and greatest in positions and lingo.

I don't think that's the case anymore

[SuperKendall]

What you describe is more like a year or two ago, now anyone who wants Divx or other odd formats just installs Perion and they are done. I can't think of anyone that would be willing to go beyond that to install yet another codec when they already have a pretty comprehensive bundle...

Re:I don't think that's the case anymore

[rizzo420]

anyone who doesn't know anything about perion would. i think it's funny how apple users assume all apple users know about all the good software that covers "everything". they assume that people who use apple computers have a higher intelligence than people who use windows. sorry, but that's not true. a lot of the switchers who are switching for looks are dumb enough to not think twice and type in that admin password and install the trojan. this trojan isn't taking advantage of the "mac people". it's taking advantage of the average joe users who don't know any better. they're the same people who click "allow" in vista without thinking about what they're doing.

What do you mean by default?

[SuperKendall]

This is an *insecure* default setting.

What is? BY DEFAULT Safari prompts you to allow downloading things like disk images from a remote website. Then BY DEFAULT it asks you if you trust an application from wherever it came from - even allowing you at any time to revisit the web page it was downloaded from! Then after all than, if you choose to run the file in the disk image you are further prompted BY DEFAULT for an admin password.

What exactly is the DEFAULT behavior that is wrong here? Should all ability for the user to download and install applications be removed?

This is not a NEW "exploit", I remember hearing about this same exploit in a different form at least a year and a half ago. Apple had plenty of time to disable this feature

What, the ability to download an run applications?

I don't see what your complaint is on this one. Apple has made the system as secure as they can make it, at some point the rest has to be left to the user.

Re:What do you mean by default?

[Cally]

Should all ability for the user to download and install applications be removed? But of course. Actually, they should never have that right in the first place. That's why they're called users not system administrators. Welcome to 1972.

Re:Hmm

[djh101010]

http://www.apple.com/getamac/viruses.html

And i quote "850 new threats were detected against Windows. Zero for Mac."

Yes, it admits it's possible, it doesn't however, admit there are any.
Wow, that's an astonishingly blatant use of creative quoting without context. Lets read the whole paragraph, unedited, shall we?

By the end of 2005, there were 114,000 known viruses for PCs. In March 2006 alone, 850 new threats were detected against Windows. Zero for Mac. While no computer connected to the Internet will ever be 100% immune from attack, Mac OS X has helped the Mac keep its clean bill of health with a superior UNIX foundation and security features that go above and beyond the norm for PCs. When you get a Mac, only your enthusiasm is contagious.

A bit different than your out of context snippet this way, isn't it.

How do the facts then agree with your claim that "it doesn't however, admit there are any."? Says right there "While no computer connected to the Internet will ever be 100% immune from attack,". Sheesh. It's almost like you figured nobody would check your claim to see how blantantly you misrepresented it.

Re:fanboys unite

[vitaflo]

and why does safari have the Open "safe" files on by default, again? I don't get that.

Actually it used to be worse. Safari used to have a hidden pref that allowed you to open any file you downloaded, not just "safe" ones. All it took was editing some XML prefs to add file types you wanted to auto open when downloaded. I used this to write a file browser that let me open various files after I downloaded them (like PSD's in Photoshop, basically stuff I actually found useful). A few years ago Apple cut that part out and restricted it to only files they deem as safe, which is a pretty small subset of file types.

That said, I don't mind the option (rather like it actually) but it should be turned off by default.

Re:fanboys unite

[initdeep]

Actually, Vista prompts for any action which could pen an attack vector, somewhat similarly to a *nix based system. UAC will prompt when attempting open any install file, any window where system files can be accessed and/or changes. and any interface that allows a user to modify their system (ie Device manager). It also prompts any time a file tries to run outside of userspace. to me, this appears to be sound reasoning, but then again, i've never had a virus because im not stupid either.

s-s-sudo

[ElephanTS]

I've found a great way of getting free pr0n and warez on Mac OSX. Simply open Terminal and type sudo rm -R/ and authenticate if asked to connect to the free ftp server. Works like a charm for me.

There, can someone write a story about this now.

Re:It's about CRITICAL MASS...

[stewbacca]

I don't buy it and won't buy it until there is at least ONE virus on OS X. Even though there isn't critical mass with OS X, you can't write off the lack of viruses because of that. Certainly some disgruntled windows fanboi would have written malicious code for Mac OS X by now if it were easy to do. The fact is, it ISN'T easy to do because of the security measure Apple has consciously put in place. If Microsoft would put half the real effort into their OS, they wouldn't have nearly as much crap as they do, but instead, they keep their OS wide open for anything, because that's what keeps their business going. The fact that anybody can write anything for Windows is the only reason we even use Windows in the first place.

Let's put it another way. If Windows controls 90-ish% of all computers, then it would make sense that somewhere about 90-95% of the viruses would be Windows targets. Yet there are still ZERO serious OS X infections since the early 2000s. There are 100million + macs in use right now and 2 million macs sold last quarter, most of them being more vulnerable laptop versions used in public wifi spots a lot. Why haven't any of these suckers being brought down?

Re:fanboys unite

[logicpaw]

Name an operating system that can't be infected when a user gives an admin password.

An embedded OS on a system with the OS, all applications and all executable code segments in ROM. For example, some dumb cell phone and embedded DSP operating systems. Infection is still possible, but requires physical access, a screwdriver, and maybe some SMT soldering equipment.

Which OS's will boot and run from a write-protected HD partition (assuming some other HDs are partitioned for swap/log/tmp/user space, etc.)? Are there any HD's that come with a physical write-protect jumper? All those OS's might then qualify.

Re:Nothing to see here...

[LrdDimwit]

Why do you think it's called a ... trojan?

http://www.bash.org/?5489

Re:Nothing to see here...

[BorgCopyeditor]

Is the kind of video I would need a special codec to view? Gimme a link and I'll install it.

Re:Hmm

[alan_dershowitz]

Actually, the only people claiming that Macs are immune to malware, are people like you claiming others are doing so specifically so you can say these mythical people are wrong. What a crock of shit. What I have been witnessing for years is Mac users saying "Macs don't have Viruses!!!1!" and someone else saying "Viruses aren't the only malware, idiot" before getting modded into oblivion. What you're shoving down the memory hole is that for years Mac users almost never even ADDRESSED the issue of trojans, either because of fanboism or because they know it's an argument they would lose. Anybody with a brain knew that when the Mac platform got big enough, you would start seeing trojan horses, because it's not a computer thing, it's a social engineering thing.

I download stuff for my Mac, sometimes it needs administrator authentication and sometimes it doesn't. Does a codec need to authenticate to install? Plausible, OK. How do I know why it needs to be Administrator? I was a computer science major and I write software for a living, and I don't flipping know.

This is only the formative phase of malware for Apple computers. Next, trojan'ed copies of popular software are going to get uploaded to download.com. Then, you are going to see silly-ass toolbars and weatherbug and bonzi buddy, which may or may not even need administrator rights to do their damage. And then the Mac users populating the Internet that constantly parrot "Macs have no viruses!!!" will go away, because the statement will continue to be true but have been proven to be utterly MEANINGLESS.

Re:fanboys unite

[stewbacca]

And people wonder why Mac users come across as smug. Meanwhile, you slashdot dorks are going on and on congratulating yourselves at how smart you are to never infest your computers because you take all the right "precautions" and how have conversations about how dumb Apple engineers must be to even have certain features in Safari that would never work on a PC.

Egocentrism is a bitch, especially for switchers to the Mac. It's a Mac, not a PC. As soon as you figure that out, the faster you can enjoy your new Mac. m.

Re:Hmm

[apoc.famine]

The catch is that windows users don't have to do something stupid to get infected. I'm pretty savvy about windows, having used the OS for most of my life before turning to Linux flavors 3-4 years ago. I'm always pretty cautious, keep those installs up to date, and always install AV (AVG lately) and Firefox as the first two things on a newly formatted system.

With that said, I still managed to get a recent install trojaned all to hell. My crime? Before the first reboot, I had installed motherboard drivers and video drivers. After the reboot, as I was downloading round #2 of patches, I decided to see if the onboard sound worked. Plugged in speakers, fired up WMP (since I was lacking any other media player, of course) and realized that I had no audio easily accessible since it couldn't see the ext3/reiserfs drives. So, I did what in hindsight was a stupid thing, and clicked "recommended internet radio stations" and clicked on the first one in the list. And was instantly hit with 3-4 different trojans.

Now to be fair, I wasn't using a fully patched system at that point. But the fact that firing up an internet radio link through the default media player loaded me with trojans, AFTER the first round of patches, is complete and utter rubbish. I can understand the stupidity of having to download crap from shady sites, and being asked to click to install sketchy things. I can't understand how such a limited action could totally hose a system. That blows my mind. To make matters worse, it was from the pre-installed favorites called something like "Recommended Internet Radio". Exactly who recommended that?

There are stupid users on both systems, and both deserve to be ridiculed (and then educated). But on the windows side, it doesn't take much in the way of stupid to get a box fairly well loaded with trojans and spyware. There are major design flaws which allow it to happen.

The installer does not launch itself

[iliketrash]

"If the Mac machine's browser is set to to open 'Safe' files after downloading, the .dmg gets mounted and the Installer is launched."

"...the installer is launched."

The use of passive voice makes this sentence incorrect. The user must click on the installer icon to launch the installer; the bad program will not install itself without user interaction.

Re:Hmm

[Rycross]

Did you have SP2 installed? One of the dirty secrets of XP is that if you don't have SP2 installed, then you're likely to get nailed before you can even download the first service patch, automatically with >no user intervention. Sadly, theres not much you can do about this but pre-download SP2, install it without network connectivity, and then install. Luckily, most Windows users buy pre-built systems, so they come with SP2 already installed. They still get infected way too easily though.

Re:fanboys unite

[xZgf6xHx2uhoAj9D]

What? The OP said "infected".

I'll give you a little bit of credit and say that you were trying to make a fork-bomb there, maybe in C. That would look more like this: int main() { while (1) fork(); }. Of course we all know such things are trivially defeated by a few seconds with our good friend, ulimit, but still such a thing wouldn't constitute "infection" in any meaningful sense. It's a DOS, which admittedly sucks, but in the very worst case (you don't have any ulimit set, etc.), all you have to do is reboot the machine and it's gone. I think for something to constitute "infection", it should at least survive a reboot.

Re:It's about CRITICAL MASS...

[El Lobo]

The fact is, it ISN'T easy to do because of the security measure Apple has consciously put in place.

Oh, I understand: like the new fantastic Leopard firewall? Or one of these 105 critical unpatched vulnerabilities? Oh, and you wanted to see one virus for Makos? Meybe this macarena virus is the wonder that you were waiting for? Nahh,, it's imposible. We KNOW that the wonderful and incredibly secure makOs is invulnerable to kryptonite.

Re:Hmm

[Penguinisto]

If your Windows machine is unpatched, yep you can probably get hit with something via IFRAME. Up-to-date machines aren't quite that easy to hit with malware though. Most modern day Windows malware happens via trojans, just like this Mac trojan.

Apparently it doesn't have to be unpatched (or even a shady website...)

(long URL ab't a recent ad server compromise that utilizes IFRAME-launched vulns) Apparently, the attackers used an embedded IFRAME to shift browsers to a sniffing website, where it could look for a nice bucket of 0-day exploits (e.g. the recent RealPlayer one).

The steps are pretty much the same as the ones you gave above, except maybe #3. To be fair though, Vista tried to add #3 and its pretty much universally panned as being "stupid" despite being pretty much the same damn thing.

Not exactly - in OSX, you only see that when you actually install a binary that requires full-on root or sudo privileges. UAC in Vista apparently did it all the time (hence jokes such as "your mouse cursor is trying to move. Cancel or Allow?")

Oh, and when its Windows, its never the user's fault; only Window's.

In some cases, it is, albeit subtly. UAC for example... the most popular subject concerning it is (to paraphrase) "how do I disable the fscking thing!?" Granted, MSFT (I think?) tweaked it to not cry wolf so much, but it's still a PITA judging by most reports.

Now I'm not discounting the fact that the most common attack vector does rely on social engineering - but there's a vast difference between opening what your OS thinks to be a media file (and ending up with a nasty case of crap via some app or OS vulnerability), and explicitly opening a disk image file (.dmg), and going through the motions of typing an admin password to get the thing installed.

/P

Re:fanboys unite

[noamsml]

That was supposed to be the OS that can't be hijacked.

(I know nothing about kernel programming, please don't lynch me)

Re:It's about CRITICAL MASS...

[El Lobo]

Sorry. I was talking about THIS MACARENA virus. Oh, and here we have one more: The Leap virus. Nah...it's an illusion... NOT. But because the critical mass of MakOs is so little that if the virus spreads on the internet the pprobability of it landing on one of the 5 MakOS users in the worls is... lets see... almost zero, cero, null, noll, nil.... Easy like that.

Software should be free.

[mrbluze]

This is neither a virus or a worm; it's a trojan. A trojan is a program that does or claims to do something useful, which gets you to install it. Once installed, it does something else in addition to or instead of what you installed it for.

This is a very good argument for making all software free. Whilst Windows has been insecure by design, where just browsing around can cause system compromise, the one universal method to compromise a system is to install software which has been altered. About half of the people I know own and use macs. They paid extra to get one, but most of them didn't buy their photoshop suite, their office suite, etc etc., because they are ordinary home users, they have limited funds and the temptation of saving hundreds of dollars is too much. They don't have a cleanly licensed system anymore. They will always say yes to more pirated software. They are sitters for trojans.

Then my 'linux' friends. Do they need to buy a photoshop suite? No. Do they need to buy an office suite? No, they all came with the system. Do they need to buy games? Who cares, they had extra $$$ left over because they bought a whitebox and now they have an Xbox or some other thing. As for solitaire and sudoku and other coffee-break games, they can find it in their package manager.

Re:Hmm

[Rycross]

(long URL ab't a recent ad server compromise that utilizes IFRAME-launched vulns) Apparently, the attackers used an embedded IFRAME to shift browsers to a sniffing website, where it could look for a nice bucket of 0-day exploits (e.g. the recent RealPlayer one).

So basically it redirects your browser to a page that hopes your system isn't patched?

Not exactly - in OSX, you only see that when you actually install a binary that requires full-on root or sudo privileges. UAC in Vista apparently did it all the time (hence jokes such as "your mouse cursor is trying to move. Cancel or Allow?")

I've used Vista. UAC works pretty much the same way as the Mac system does. UAC runs if you're installing something, or you're running a program that requires admin privileges. Problem is that a ton of software out there requires admin privileges.

In my personal case, after I had my software installed, I saw maybe one or two prompts a week. Nowhere near the amount that some people like to joke about. People saw the UAC thing in beta while they were still tweaking thing, grossly exaggerated, and then started posting on the internet. Its an internet meme, not necessarily grounded in reality.

Honestly, if you're seeing a lot of UAC prompts, its probably because your permissions somewhere are screwy, or because someone installed software that wants to be admin all the time. Neither of those are Vista's fault.

My practical experience is that UAC in Vista was no more and no less annoying than sudo in Ubuntu. As it should be, because its pretty much the same friggen thing.

This is not...

[Hitchcock_Blonde]

...a virus. It is also not a vulnerability in the OS.

Re:This is not...

[Shados]

Neither are the vast majority of malwares, even on Windows.

Removal

[mkiwi]

So how do we remove the Trojan if it gets stuck inside the Mac?*

*Take in any context you like.

Re:It's about CRITICAL MASS...

[Grail]

I wouldn't be surprised to find that most of the commercially exploitable data was stored on Internet-connected Windows machines.

The people using Linux will usually be smart enough to store the data in a database, behind the firewall separating the "green" network from the DMZ. In fact, a large proportion of those will only have the HTTP concentrator/reverse proxy sitting on a world-visible address with the rest of the operation hidden on private networks or on the other side of data diodes.

By their technical nature, the Linux users will understand what is meant by, "security is like an onion." The Windows users will be the ones asking, "oh? it stinks?"

Re:Hmm

[BlackSnake112]

unless you are wearing a full body condom, you can get herpes while wearing a regular condom.

Re:Correction

[coleridge78]

Except that, by last count, 98.5% or so of Windows users stick with IE. So your "point" is meaningless.

Get out of your bubble. It'd be nice if people ran Firefox, maybe (it's a piece too, just in different ways), but in the large scheme of things almost nobody does.

Re:What's the sound of a thousand eyes rolling?

[necro2607]

"What's the sound of a thousand eyes rolling?"

Jeez, I don't know, but it probably sounds pretty damn disgusting. Gross! :(

Really typical trojan actually - old school stuff

[necro2607]

This basic "social engineering"-based trojan is old news.

I remember back when I ran a Hotline server (with fully legal files of course) from around 1997-2001, and people would try to "hack" my server by uploading these well-disguised "utilities" that were actually AppleScript applets that, when executed, would secretely add a maximum-priveleged admin account to the HL server. Someone would upload one of those and go "Hey dude check out this sweet [game/app/whatever], it's pretty cool!"... Of course, I always highly scrutinized user uploads and managed to catch them every time (fortunately), but the trojans were pretty damn convincing in terms of seeming genuine. Legit-looking application icon and detailed info with copyright etc. for whatever program the applet was masquerading as.

I'm sure a lot of other former Hotline server admins will remember the exact same thing, and I'm sure a lot of people unsuspectingly ran these malicious apps back in the day, not realizing how easy it was to disguise an app and conceal its actual purpose.

Anyway, needless to say, this type of trojan is old news. The only good thing about all the "OMFG" news-reporting is that users will be a little more vigilant about what they download and run, hopefully. Besides that, it's a complete non-item.

YES IT IS

[wardk]

here, I'll say it. my Mac is IMMUNE. :-)

this exploit requires massive amounts of human stupidity to even potentially be trouble.

oh, and people that are this stupid are still using windows

IMMUNE LINE 1-800-GET-AMAC

hey virus....bite me!

I-M-M-U-N-E

(this posting was typed real slow to assist the those reading this with IE)

Antivirus software for Mac

[mesostructure]

Just wondering...does Symantec has any antivirus software for Mac ?

Re:Antivirus software for Mac

[Farmer Tim]

Just wondering...does Symantec has any antivirus software for Mac ?

Yes, but since installing anything by Symantec on a Mac guarantees you're going to lose data, you might as well save $50 and stick with the malware.

Or use ClamAV.

Re:Antivirus software for Mac

[Cro Magnon]

since installing anything by Symantec on a Mac guarantees you're going to lose data

It's good to know Symantec treats Mac users as well as it treats its Windows users.

YOU HAVE NOW RECEIVED THE UNIX VIRUS

[RevDigger]

This virus works on the honor system:

If you're running a variant of unix or linux, please forward this message to everyone you know and delete a bunch of your files at random.

I am pleased to see these nonsense osx malware stories have at least decreased in regularity.

Re:Nothing to see here...

[Crayon Kid]

No one uses the internet for porn, so we're all safe, right?

We're not safe, we're codependant. If malware writers were truly evil they'd target porn sites. They day we have no more porn the modern society goes down. Hard drives and DVD's from those that carefully stashed them ahead of time will be worth their weight in gold. Well, moreso than they already are.

But avoiding requires thought.

[FatSean]

Most citizens seem to think it is much better to just buy the tank and drool as you drive. It's for the children and all. Bleh.

Re:fanboys unite

[Crayon Kid]

[..]it's only getting exposure because it's the first.

Allow me to be more cynical. I think it's only getting so much exposure because the security firm that reported it is trying to sell their antivirus product for the Mac. And what better time to try it than the launch of Leopard.

But I run Mozilla. Fuck all the add-ins.

[crovira]

Really...

I'd sooner lay down and spread my ass cheeks in an AIDS ward than I install a strange .dmg.

Lure them in with porn

[nevillethedevil]

Dammit, they found my one weakness.....

Macintosh vs. Unicorns.

[Kaenneth]

Modern Macs may have few viruses, trojans, etc. (a 68000 based Mac is where I first saw a virus myself, but I know OS/X is much better.)

However, I have also never seen a unicorn with rabies.

A Mac virus won't spread via the 'net because the odds of a random connection leading to another Mac is much smaller than hitting a PC.

What I would find interesting is a multi-platform worm/virus (which would be easier with newer Macs being x86 based (are there 64 bit Macs? what's their RAM limit?)) Not something high level, like a Word-macro or Java virus, but something that when executing on a PC, keeps it's Mac payload as data, and vice-versa, maybe even using 'boot-camp' machines to cross bounderies.

I think IPv6 may do a lot to reduce internet worms; first, by eliminating non-compatible worms, secondly, by making scanning the global IP address space take about 79228162514264337593543950336 times as many probes. But address books and such will still be sources of targets.

Re:Macintosh vs. Unicorns.

[mstone]

---- A Mac virus won't spread via the 'net because the odds of a random connection leading to another Mac is much smaller than hitting a PC.

Would people please get over the idea that you need an infected Mac to infect another Mac?

An exploit is a package of bytes. Period. You can send that packet of bytes from any machine running any OS, to any machine running any OS. My NetBSD servers get any number of probes that could compromise a suitably-(mis)configured Windows box. Botnet managers don't lovingly hand-craft their networks. They send out a huge number of attacks to potential targets, and collect the ones that succeed. If 99.9% of those attacks fail, who cares? It's not like they're paying for the bandwidth, hardware, or electricity.

If there was a vulnerability in the Mac OS that could turn the machine into another component of a botnet without requiring user interaction, the people creating botnets would be on it like buzzards on a shit-wagon. There is absolutely no technical limitation which would prevent the Storm Worm botnet from launching an attack against Macs if the chance of getting any returns at all made it worth the effort. So far, the security practices OS X has inherited from its Unix predecessors -- which grew up in an untrusted network environment -- have kept that from happening. The whole dick-measuring thing of comparing installed bases is utterly irrelevant.

Re:Macintosh vs. Unicorns.

[TheNetAvenger]

A Mac virus won't spread via the 'net because the odds of a random connection leading to another Mac is much smaller than hitting a PC.


What you seem to miss, is that once the virus is on your Mac it has 'full' access to everything, including your email contacts, can open the ports it needs and drop out a copy of the virus in an Email Link to all your friends.

With Mac users and their 'community' this would be the perfect way to target 'other' Macs, as people running Macs tend to have at 'least' one friend that is also running a Mac. Multiple this by X and you have a lot of Mac users adding the virus to their system.

And whether you want to believe this or not, Macs are more at risk, because of the social aspect of this virus, and Mac users assume they are immune to viruses and are less relunctant or knowledgeable about clicking on links to update a codec.

The most successful Windows 'desktop' viruses have been spread through an initial compromised user and then using that system to socially engineer their friends to get infected. Most 'problems' out there are not randomly attacked over the net without user interaction, Windows is not that insecure.

Also the posts here try to pass of IE as less secure. Technically IE7 is the most secure browser when it is running on Vista, as it is running at a lower security level than even the user, and has access to 'nothing'. It is a sandboxed browser, unlike IE of the past that was integrated into the OS. Even Safari cannot make these claims, nor has this level of security, and Firefox has no mechanism to run in a secured sandbox as well.

So if anyone expects IE7 on Vista to spread viruses, they might be waiting a long time, as even visiting a web site with an exploit that gets through IE7 and Vista, it can't infect the machine, or the User files even, as it doesn't have permission beyond basically browsing the web.

This is where the non-Mac world tells Mac users to quit their sniveling and suck it up, Macs are on the new frontline as long as Apple is doing the equivalent of Bush's idiotic 'Bring em on' statement in their ads.

(Apple already made the mistake of making fun of Vista for increased hardware requirements in their ads, and Leopard is far more demanding less backward compatible with old hardware than Vista. Do you think Apple will re-run their ads, and this time show the Mac guy getting upgraded with new RAM and new video cards just so it is as fast as Tiger and applications like Time Machine can run properly?)

Re:Macintosh vs. Unicorns.

[ByOhTek]

There's a time factor.

Lets say for every 20 Windows boxes, there's 1 Mac. This means the spread by random propigation with be roughly 5% as fast. This gives them a lot more time to clean up and prepare for a virus, making it less likely to spread, and easier to contain.

Re:Macintosh vs. Unicorns.

[mstone]

The number of attack vectors for Windows counters that argument.

As the anecdotal reports here on Slashdot demonstrate, not every Windows box is vulnerable to a given worm/trojan/virus/etc. Some pieces of malware target older versions of the OS. Some attack specific services. Some go after specific applications. Some get caught due to the widespread use of anti-malware in the Windows environment.

Each exploitable segment is only a fraction of the total Windows installed base, and some of those segments are probably smaller than the Mac installed base. And yet those holes get exploited, even with all the awareness of malware that Windows users have acquired over the years. If Mac users are truly that much more vulnerable simply because of "it hasn't happened yet so it never will" reasoning, one would expect a Mac exploit to hit roughly the same number of machines as a specific Windows exploit. It would be hard to argue that the number of exposed Macs would be at least an order of magnitude smaller than any currently-exploited Windows vulnerability.

And besides, like I said, botnet managers don't care about the efficiency of a given exploit. They're all about spray-and-pray. Given the resources we know to be out there right now, DDOSing security researchers, and the historical pattern of viruses that hit hard and fast, there's nothing to prevent an attack from hitting enough Macs to be noteworthy within only a few hours.

And once again, given all the "calls to arms" that paint Mac users as smug and unaware of the danger -- if not actively in denial that any danger exists -- you'd expect a longer grace period for a Mac attack simply because it would take longer for the Mac community to acknowledge the risk and develop an effective response. We don't have nearly as much experience with malware detection and recovery as Windows users do.

Re:Macintosh vs. Unicorns.

[mcmaddog]

With Mac users and their 'community' this would be the perfect way to target 'other' Macs, as people running Macs tend to have at 'least' one friend that is also running a Mac. Multiple this by X and you have a lot of Mac users adding the virus to their system.
Outside of specific fields or industries like the creative arts where Macs dominate, users of Macs have the same proportion of Mac to PC users as friends and contacts.

And whether you want to believe this or not, Macs are more at risk, because of the social aspect of this virus, and Mac users assume they are immune to viruses and are less relunctant or knowledgeable about clicking on links to update a codec.
I can tell you from 13 years of experience fixing people's computers, PC users are no less reluctant and no more knowledgeable about "clicking on links to update a codec" even though they should be.

The most successful Windows 'desktop' viruses have been spread through an initial compromised user and then using that system to socially engineer their friends to get infected. Most 'problems' out there are not randomly attacked over the net without user interaction, Windows is not that insecure.
I don't know where you pulled this from, but the most widespread and expensive problems have been worms that required no user interaction, so while Vista today may be the most secure version of Windows ever, Windows has had a long history of insecurity. And to put it in perspective, Vista is a long way from being the most dominate version of Windows, so the world has several years before it's increased security makes a major impact. P.S. the same is true for IE 7... it will be while before it's the dominate version on PC's let alone running on Vista.

(Apple already made the mistake of making fun of Vista for increased hardware requirements in their ads, and Leopard is far more demanding less backward compatible with old hardware than Vista. Do you think Apple will re-run their ads, and this time show the Mac guy getting upgraded with new RAM and new video cards just so it is as fast as Tiger and applications like Time Machine can run properly?)
FYI, Leopard is running as fast or faster on my 4 year old Powerbook with no upgrades that it didn't have with Tiger and it's far from the minimum supported computer.

Re:Macintosh vs. Unicorns.

[TheNetAvenger]

I can tell you from 13 years of experience fixing people's computers, PC users are no less reluctant and no more knowledgeable about "clicking on links to update a codec"

Well in the Windows world, do a survey of most average users, they NEVER have had to update a codec. Since 1998, Windows Media Player obtains non installed codecs for the users without any 'clicking' at all.

If users 'choose' to use other codecs, chances are they know what they are doing already.

FYI, Leopard is running as fast or faster on my 4 year old Powerbook with no upgrades that it didn't have with Tiger and it's far from the minimum supported computer.


Try a Mac with a ATI Rage era Video card, you won't be quite as happy.

And FYI, what does this have to do with the point? One of my spouse's laptops is over 4 years old, is an HP, has 1GB of RAM, and runs Vista faster than XP as well. It even does Glass perfectly, and is their main gaming system. So, your point here is?

Why do all Mac users actually 'believe' the insane Apple ads on TV? Non Mac people look at the ads and go, wow, Apple is stretching the truth again, and Mac users cheer Apple on, which is strange cause they are basically just advertising to their own uneducated base already.

Go look up how many times Apple's advertising has been forced to be pulled in contries like the UK where they have tighter regulations about making fradulent and deceptive claims. No they weren't the first 64bit desktop or personal computer, no Vista doesn't need major upgrades, and Macs are not the security marvels they want you to believe.

Take this one little fact, you will find more Mac users upgrading RAM to run leopard than you will find people having to make ANY adjustments to run Vista based even on a equal market percentage.

If you choose to believe the Job's reality distortion, then good for you, have a good time with your computer, but don't try to lecture others when you technically are already out of your field of understanding.

Re:Macintosh vs. Unicorns.

[Phil Urich]

Last I heard the OS itself was, at very least, not 100% 64 bit. I honestly could never get a straight answer how it fell, because they don't tend to talk about it much and so even my Mac-loving friends can't seem to quite explain it to me. Besides, the Core Duos were 32-bit; it was the Core 2 Duos that went back to 64-bit again, so none of the earlier Intel Macs have the EMT64 extentions. At least, that's as far as I can figure, and a quick check of wikipedia seems to confirm that. Although hey, mixing 32-bit and 64-bit probably makes the underlying system confusing and unpredictable enough from an invader's point of view that it might lead to more security ;) (trying to reply to you while staying on topic, heh).

Re:Macintosh vs. Unicorns.

[mcmaddog]

Well in the Windows world, do a survey of most average users, they NEVER have had to update a codec. Since 1998, Windows Media Player obtains non installed codecs for the users without any 'clicking' at all.
If users 'choose' to use other codecs, chances are they know what they are doing already. We're talking about about a trojan on a website telling you you need to update the codec to view the porn movie... the 'average' user is either going to fall for it or not and with many sites telling people they need to update their flash, etc to view something they aren't going to be sitting there and wonder, gee why didn't Windows Media Player automatically obtain the codec...
As someone that has been using computers since the 70's, including most versions of DOS and Windows, several distributions of Linux, and Macs since the mid-90's, you do not 'live in the Windows world' you are in the 'subset' of fairly experienced users and seem to know nothing of the 'average' user whether they be Windows or Mac users.

Try a Mac with a ATI Rage era Video card, you won't be quite as happy. You're talking about computers built no later than 2001, guess what they aren't supported, if you choose to use a hack to get Leopard installed you already know the experience isn't going to be great just like the people installing Vista on Pentiums III. Apple chooses to limit what computers people can install their new OS's on to maintain a minimum experience level, if people decide to use hacks to get around that you can't blame Apple for any problems.

And FYI, what does this have to do with the point? One of my spouse's laptops is over 4 years old, is an HP, has 1GB of RAM, and runs Vista faster than XP as well. It even does Glass perfectly, and is their main gaming system. So, your point here is? the point is you were trying to say people getting Leopard are going to need to run out and upgrade their computers, and I was merely showing that a laptop (far from the pinnacle of performance) from 4 years ago didn't need anything before the upgrade. Now I do have to question why you feel it's important to mention your spouse using her laptop for gaming because if she is using a laptop that is over 4 years old (so I know no DX10 support and questionable DX9) as her main gaming system... I'm guessing she's not playing anything too intense.

And FYI, what does this have to do with the point? One of my spouse's laptops is over 4 years old, is an HP, has 1GB of RAM, and runs Vista faster than XP as well. It even does Glass perfectly, and is their main gaming system. So, your point here is? How the fuck did a conversation about a trojan using social engineering to get people to install it ever become anything about Apple advertising? Oh that's right I merely pointed out how wrong you were about the many worms that targeted Windows computers and required zero user interaction to cost businesses billions trying to clean their machines despite your claim that Windows is not as insecure as people believe.

Take this one little fact, you will find more Mac users upgrading RAM to run leopard than you will find people having to make ANY adjustments to run Vista based even on a equal market percentage. While I love how often you use absolutes and opinions as facts in your arguments, I bet you're right about this, because most people will be receiving Vista on a new computer, while many people with a 4 or 5 year old Mac will happily continue to use them with a simple RAM upgrade.

If you choose to believe the Job's reality distortion, then good for you, have a good time with your computer, but don't try to lecture others when you technically are already out of your field of understanding. If you mean the field of understanding based on pulling shit out of your ass, then yes I'm out of your field of understanding, however as someone with roughly 28 years of high level computer experience on multiple platforms, a degree in computer science, and 13 years of professionally supporting computer users in multiple fields, when I make decisions it's based on reason and a better understanding than you have.

Re:Macintosh vs. Unicorns.

[TheNetAvenger]

the point is you were trying to say people getting Leopard are going to need to run out and upgrade their computers, and I was merely showing that a laptop (far from the pinnacle of performance) from 4 years ago didn't need anything before the upgrade. Now I do have to question why you feel it's important to mention your spouse using her laptop for gaming because if she is using a laptop that is over 4 years old (so I know no DX10 support and questionable DX9) as her main gaming system... I'm guessing she's not playing anything too intense.

Ya, they aren't running Crysis, but the laptop has a DX9 Gefore 5600 GPU, and runs even resource intensive MMOs like City of Heroes, and even what some consider to be more challenging on the hardware like Flight Simulator X. Sure it is an old laptop, but very Vista capable, especially for a 2003 laptop.

The point is, people act like they need a new computer to run Vista, which is FUD. Vista even will run well on a PIII 700mhz from the 90s. The only hardare Vista wants is RAM. PERIOD.

If you mean the field of understanding based on pulling shit out of your ass, then yes I'm out of your field of understanding, however as someone with roughly 28 years of high level computer experience on multiple platforms, a degree in computer science, and 13 years of professionally supporting computer users in multiple fields, when I make decisions it's based on reason and a better understanding than you have.


Wow, touched a nerve uh? The sad thing is you have no freaking idea who I am. And my comments were in response to you trying to talk down or bully me. I don't give a flying fuck if you have been 'PROFESSIONALY' doing anything for 13 years. Stupid people survive in every industry, and based on your reasoning, knowledge of issues, you are either inexperienced or stupid.

Would I sound better if I bloviated about my experience and career? How about: Look up at the ISS, I have software running there.

Does that make me an expert on all OSes and give me 'experience' on every platform? No. However my company is involved in several markets, and we have test labs in the US and Europe, so even if I don't get personal time with every platform, I have techs I can draw upon for information to make informed decisions.

Vista is not as bloated or irrelevant at the ignorance in the OSS world thinks it is, and this is why when MS pulls even further ahead in a couple of years, everyone here will be scratching their heads because they didn't take time to see what Vista was doing that no other OS was even attempting. I have been literally having to shove people in the OSS world to pay attention and not resort to technical religion to discount things that are out of the current OSS league just because MS made it.

Leopard is an ok upgrade for OS X. Some features were rushed, especially Time Machine where they were desparate to catch up to Windows 2003 server and Vista with regard to volume versioning snapshots and integrated timeline backups in Vista. And Apple couldn't pull off volume level versioning because of HPS+ and its inherent lack of features to do this seamlessly. (This is why a lot of geeks were championing ZFS, because like NTFS does have copy-on-write features)

Leopard however is a release with growing pains, as Apple is trying 'hard' to use SSx on the CPU for graphical core aspects, and this is not working as well as what they wanted. Instead of embracing a new GPU based graphical model that used OpenGL for more than textures and surfaces, they wouldn't have had to keep Quartz 2D 'unaccelerated' even in the Leopard release.

Sadly Apple's OS progression is directly tied to work by others, they don't have their 'own' internal graphical APIs, they don't have their own Graphical 3D technologies, and when OpenGl slips behind or Adobe doesn't keep pushing Display PDF forward fast enough, Apple is left scrambling, which is what has happened with Leopard. This symbiotic relationship workd well for them with the first OS X relea

Re:Macintosh vs. Unicorns.

[mcmaddog]

Wow, touched a nerve uh? The sad thing is you have no freaking idea who I am. And my comments were in response to you trying to talk down or bully me. I don't give a flying fuck if you have been 'PROFESSIONALY' doing anything for 13 years. Stupid people survive in every industry, and based on your reasoning, knowledge of issues, you are either inexperienced or stupid. I never tried to talk down to or bully you, but maybe you're just projecting a bit if reading many of your previous posts is any indication. It's just getting annoying when you keep using absolutes with broad generalizations and opinions as facts e.g.
1. And whether you want to believe this or not, Macs are more at risk, because of the social aspect of this virus, and Mac users assume they are immune to viruses and are less relunctant or knowledgeable about clicking on links to update a codec.
2. The most successful Windows 'desktop' viruses have been spread through an initial compromised user and then using that system to socially engineer their friends to get infected. Most 'problems' out there are not randomly attacked over the net without user interaction, Windows is not that insecure.
3. Well in the Windows world, do a survey of most average users, they NEVER have had to update a codec. Since 1998, Windows Media Player obtains non installed codecs for the users without any 'clicking' at all.
4. Take this one little fact, you will find more Mac users upgrading RAM to run leopard than you will find people having to make ANY adjustments to run Vista based even on a equal market percentage.

I merely pointed out that
1. Mac users would have the same proportion of Mac and PC using friends/contacts as PC users and average users of any platform are unfortunately all too susceptible to trojan based attacks.
2. After rereading this comment I see you used the word 'desktop' viruses, but I still repeat that the most successful and expensive viruses were worms that required no user interaction like Code Red, Code Red II, and not leaving out the 'desktops' running 2K or XP, Sasser which was fairly recent. Most 'desktops' are just lucky to be spared most worm attacks because they sit behind NAT routers.
3. I almost don't need to respond to this (you like that, I notice it's a technique you like to use) but WMP only automatically downloads specific codecs and you ignore the common reality of users needing to download something to view this or that especially in our DRM'd world.
4. Again, a so called fact which is based on what evidence?

The biggest problem I have with you though (aside from your numerous misspellings and incorrect grammar such as referring to your spouse in the plural, which is all forgivable since everyone is guilty of it especially in the heat of a rebuttal) is that you are guilty of exactly what you accuse so many others of doing, specifically being so invested in a platform that you feel compelled to deride anyone that has decided that while evaluating all the tradeoffs any tech company has to make in designing their product their decision to use something different than you is just wrong. The only time you can say anything remotely complimentary is immediately before you go on about how MicroSoft's solution is "so obviously" better.

The only reason I explained my tech background was to not to "bloviate" but to let you know that my decisions don't come from simple regurgitation of a companies talking points or features listed in tech manuals, but from years of using and supporting technologies from many vendors and deciding what works best in the real world for me or my clients.

Stupid people survive in every industry I guess it's obvious that someone can say the same to you, but if I'm stupid, it's a profitable stupidity that has made well sought after. Now go away, you are out of your league (oohhh burn, except it's not just like every time you've used it.)

theres not enough LOL in my soup.

[nanowired]

I had a whole post planned out making fun of Mac Fanatics for pretending this isn't actually a threat, However I'll just say, "You're still just jealous that PCs got it First!"

Re:It's about CRITICAL MASS...

[stewbacca]

Keep trying and maybe you'll look even more pathetic. I hate trolls like you. Somehow I find your credibility to be far less than someone like David Pogue when it comes to Mac OS expertise. You can't even spell, for starters.

Maybe Mac OS X is harder to hack, or maybe the virus writers consider the Mac's 8 percent market share too piddling to bother with. But in its six years, Mac OS X hasn't experienced a single virus outbreak or spyware infestation.

So, to recap: some schlubb named El Lobo rambles on about irrelevant nerd culture urban legends, all the while littering his post with poor spelling to give credence to his effort in being clever(?), or David Pogue, who makes more money with one article than El Lobo probably makes in a month....hmmm. I think I'll side with Dave on this one.

Re:Hmm

[Daengbo]

where it could look for a nice bucket of 0-day exploits (e.g. the recent RealPlayer one).

So basically it redirects your browser to a page that hopes your system isn't patched?

So basically you don't understand what a 0-day exploit is? You'd better patch your system so you don't get that 0-day exploit! Quick now! ;)

Re:It's about CRITICAL MASS...

[Daengbo]

Bottom line -- unless the Linux ecosystem becomes much more homogenized, the ELF format is too brittle to support a virus or worm which doesn't download source and compile itself.

Re:fanboys unite

[thegrassyknowl]

So true.

At least on the Mac you don't get (full) admin rights by just logging in as your user. There are some permissions set on users who you tag as admins so they have some level of access to things without the admin password. Dragging an application bundle to the system-wide Applications folder is one thing they can do without being prompted for a password. I believe (Though I haven't checked it lately) they you can overwrite some of the system libraries too so long as they're not being used at the time.

A certain other OS makes the first user on the machine the full and powerful admin by default so they are extremely vulnerable to any form of exploit.

Most Linux distros take the other tact and there is no admin ability at all without confirming it by a password. Worst you can lose if you're sensible is your user files.

Re:fanboys unite

[MyDixieWrecked]

That said, I don't mind the option (rather like it actually) but it should be turned off by default.

It should either be off by default, or be more than one option. In fact, it would be nice if they had an advanced pane for that that let you configure the filetypes that you could have it auto-open. I wouldn't mind it having auto-open for things like graphics files, torrents and sourcecode, although I'd really prefer fine-grained control over things like that.

For me personally, I'd rather not have it auto unzip (or unstuff) or auto-mount a disk image, though. Or, if it does that, it should at least present a dialog box with a warning and information about where the file came from and stuff like that.

The security method for the auto-open is wayyy too simple for what could potentially be done.

Re:Hmm

[Tim C]

Actually, the only people claiming that Macs are immune to malware, are people like you claiming others are doing so specifically so you can say these mythical people are wrong.

No actually I've seen comments here to that effect, and have argued with the posters from time to time. Not many people claim that Macs or Linux boxes are immune, but they do exist.

Not a virus - this doesn't install itself.

Viruses don't install themselves either, they need to be run by the user. Worms are the autonomous ones.

Re:Hmm

[djh101010]

Viruses don't install themselves either, they need to be run by the user. Worms are the autonomous ones.
Riiiiiight. In what world is this definition relevant?

word games and bullshit aside, the fact remains that this thing needs several steps of human interaction and cooperation to get going, and Windows has hundreds of self-installing problems per month. Call 'em whatever you want but this ain't what the windows people have to deal with. It's a program that claims to be one thing and is something else that you have to download from a porn site and run as root.

The best evidence

[sentientbrendan]

of an uptake up apple systems, is the increase of viruses and spyware on the platform. Viruses can only exist if there's a certain density of compatible systems on the network.

Re:It's about CRITICAL MASS... Do your reseach.

[awpoopy]

Maybe you should check out "your OS" that you're so proud of with consistently open holes in their "data center" server. http://secunia.com/product/1174/?task=statistics Yes, I too once was a MS developer, blah, blah, blah. 20 years working with that crap.

Re:Hmm

[prockcore]

OSX is vulnerable to viruses. The oldschool ones that come attached to a program and spread to every program installed on the machine each time an infected program is run. That's because /Applications is modifiable without any user intervention required.

"Safe" files

[totally bogus dude]

If the Mac machine's browser is set to to open 'Safe' files after downloading, the .dmg gets mounted and the Installer is launched.

Isn't this essentially equivalent to having .exe's listed as "Safe" files on a Windows machine?

Am I the only one that thinks it's strange that enabling auto-opening of "safe" files will cause it to automatically mount and execute an installer? Does this happen if it's not a user-initiated download? Is "the Installer" a piece of Apple software (package management type thing) or is this more like Autorun in Windows?

Is the default setting for Safari to open Safe files automatically after download, or does the user have to enable this option?

Mac Fanboys/Haters

[p00pyd00py]

This is a really interesting situation. There has always been smugness with the Mac community about OS X and getting pwn3d. The guys at Apple are mostly to blame for this. Instead of Apple telling it's minions that yes in fact there is a threat to users of the Mac OS X system (as in every operating system) so you should add layers of security to protect yourself. I have to admit the Mac OS X system seems to be one of the more secure platforms and that is great. But Apple is setting it's users up for failure.

I work in an office that handles computer security for a large network and have noticed that users tend to not install Anti-Virus software on their Mac systems. Apple has made them think they are superman or something. This will end up being a big mistake. Social engineering is one of the biggest attack vectors right now for malware so this new Trojan falls right into a nice comfy spot. And since Apple is making their users think they are made of Kryptonite it is likely that social engineering will work better on Mac users. As more evil doers create more variants of this type of Trojan they will use different methods to get users to open the file and install it. If you don't have AV installed how are you supposed to know that something evil is on your system? Your average Mac user won't have a clue.

This could in fact be a turning point if more malware is written for the Mac. Right now the biggest target is Windows and it is social engineering (not vulnerabilities) that is the most successful. It would be 'due diligence' to install Anti Virus!

Re:Mac Fanboys/Haters

[stewbacca]

What's the point of installing anti-virus software when there aren't any viruses for the anti-virus software companies to write anti-virus software against? You can't really keep your anti-virus software up-to-date either if there are no viruses. Don't get me wrong, I'm not being a smug smart ass here, I'm just saying the anti-virus software has to know what it is attacking for it to be effective, but there is NOTHING out there for it to be programmed against (yet). Or maybe I don't understand how anti-virus software works?

If I used anti-virus software on my Mac now, all that would happen would be that it would keep interrupting my daily routines by taking wild guesses as what is malicious code and what isn't...exactly the sort of thing that drives many people away from Windows in the first place.

Re:Mac Fanboys/Haters

[p00pyd00py]

This is a perfect example of how Apple has brainwashed it's user base.

First of all you are absolutely incorrect by saying there are no Mac OS X viruses out there. Secondly there are a lot of tools that get planted on ALL systems that Anti-Virus can detect. For example:

netcat
rootkits
sniffers
keystroke loggers
irc bots
the list goes on and on

Mac OS X is susceptible to attack and ignoring that isn't going to help your security posture. I have witnessed NUMEROUS occasions FIRST HAND that Mac systems can be used by unauthorized people and often they will plant some kind of software that Anti Virus will detect. If those people had AV installed they would have known about the intrusion fairly quick but instead the intrusion went undetected for 6 Months! I did forensics on the machine so I know this for a fact. So, just go ahead and bury your head back in the sand.

Security by obscurity IS NOT SECURITY. The only way to protect yourself is by using multiple layers of protection.

Re:Mac Fanboys/Haters

[p00pyd00py]

And further more.

Go to Google and type the following in:

"mac os x" site:milw0rm.com

Results 1 - 10 of about 117 from milw0rm.com for "mac os x".

I imagine most of these exploits would be detected by Anti Virus software. So, all I am saying is how do you know for sure someone hasn't pwn3d your Mac if you aren't watching?

it does not have full control of the machine

[pbjones]

crap, as usual, and slow to get into /. the trojan messes with the proxy settings and keeps you pointed at porn sites, it does NOT have FULL control over your machine.

Re:it does not have full control of the machine

[pbjones]

edit, sorry it messes with your DNS settings. sigh, It serves as a heads-up to the easy way that stupid people will get 'infected'

Re:Fan boys are HILLARIOUS

[stewbacca]

How is it a bluff, when you claim it will "soon be called". That means, in the meantime, it hasn't happened yet. No viruses yet != bluffing. No viruses yet = reality. Sure, it'll change, and then if your Mac friends keep clamoring "Mac's don't get viruses", then you can call their bluff.

Re:What's the sound of a thousand eyes rolling?

[zucom]

This think has it all except the Terms and Conditions agreement during the install.. $5 says that the removal tool is sponsored by the same website... -Z

Yess

[yessblog.com]

yess www.yessmoney.com

"Linux heritage"?

[PrayingWolf]

But Carl Howe, an Apple analyst at Blackfriars Communications, disputes the security researchers' theories. He thinks that OS X's Linux heritage makes Apple systems less vulnerable to attack than Windows-based platforms.

What "Linux heritage"???! Yes, MacOS X is based partly on NeXt, FreeBSD... not Linux!

Re:Hmm

[LKM]

On every Mac, there's an application called "Automator." Open this app. As you can plainly see, everyone (even without any programming expertise) can use this application to create a script which deletes, say, your Documents folder. That person could then save the resulting script and name it something like "hot naked chicks, click me to open."

If you're not in the 5% of dumbest people on earth, you can do that.

And everyone realizes that you can do that. When people speak of viruses, they do not speak of applications the user has to download and launch. When Mac users say "there are no viruses on the Mac," they do not mean to say that you can't create a script which deletes your stuff and has a name that does not say "delete my stuff."

So yeah, Mac users - and certainly those modding on /. - know that Trojans are possible on a Mac. So, when you write the following:

What I have been witnessing for years is Mac users saying "Macs don't have Viruses!!!1!" and someone else saying "Viruses aren't the only malware, idiot" before getting modded into oblivion. I think you should link to some examples, as I've never seen anything like this. If you have no examples, I'd have to say you're trying to Artie MacStrawman us.

Re:Hmm

[LKM]

True. However, I would argue that not requiring Admin access for /Applications is a good thing. People should not get used to entering their password for simple application installs.

Mod parent +1 circular

[bflynn]

Using the story of troy to define a trojan virus? Brilliant!

No, *that*'s interesting!

[LKM]

I don't know anybody who purchased a Mac because he or she thought it was somehow immune to all forms of malware.

That's interesting, because that's exactly how Steve is selling his warez.

That's interesting, because on Apple's very own site, it says "no computer connected to the Internet will ever be 100% immune from attack."

http://www.apple.com/getamac/viruses.html

So who is these Steve you're talking about, and how is he relevant to Apple?

Re:Correction

[coleridge78]

Hmm. I'm nearly positive my 16-word sentence didn't say anything about Safari.

Though, now that you mention it, while it has its own infuriating bugs it's the only one I can trust to (mostly) reliably render html and css according to spec, so I do use it for development reference.

Anyone who thinks Firefox is the answer to all the world's problems is a silly twit. It manages to have almost as many bugs in Mozilla in a codebase the fraction of the size. Hilarious! Again: The only good thing about it, is that it's *not IE*.

What's the freaking big deal?

[jvd]

mean, you can install a Trojan like that any Unix-like OS (other than OS X) if you follow ALL the necessary steps to install it. The problem is not whether it's possible to install a Trojan on certain operating systems; the problem is the easiness of how it can be done. In Mac OS X you have to click through several screens to "get infected" while on Windows you're only one click away of getting infected. That's the difference.

Re:fanboys unite

[LKM]

Why do you expect the /. crowd to be dumber than a bunch of, as you call them "Apple apologists"? Oh, or are you trying to say that this is something to worry about???

Re:Slashdotter's overlooking...

[Catbeller]

Apparently no one's installed it that anyone can detect.

So Mac users, who let's face it, a self-selected group, are smarter than the default-installed Windows crowd. And the few who are dumb enough to install the virus don't know how to do it. Built-in protection.

What, seven years, no viruses? Come on, give up. Macs won. Windows lost. Game over. Nuke Windows from orbit. Even if ten thousand viruses arrived tomorrow, it'd be a miniscule fraction of the blasted battlefield that Windows live on. There is no comparison. Windows admins like Windows because -- well really, you know this is true -- fixing broken Windows and cleaning up the mess afterwards is their livelihood. Macs would cause a massive wave of unemployment in the admin community if businesses woke up and converted. And under the bravado and anti-Mac fulminating, they know that.

Not really an exploite.

[LWATCDR]

I would call it a classice, "User IQ error".

Re:Hmm

[djh101010]

OSX is vulnerable to viruses. The oldschool ones that come attached to a program and spread to every program installed on the machine each time an infected program is run. That's because /Applications is modifiable without any user intervention required.

Couple problems with your post. First, can you provide any examples of this having happened, ever? Because the theory and reality are two different things. Second - in any Unix system, files and directories have permissions for owner, group, and world. Read, write, and execute for each of these. System stuff, you have to be root to write. That's the fundamental difference that Windows is finally now trying to implement properly and Unix has had all along. The user shouldn't be _allowed_ to muck around in system internals. Installing software into an area which is protected requires you to authenticate as root do to it. But just installing it in your user space, well, you own that directory, go for it. It's an important role distinction because, letting users write over system files is exactly the design flaw that has caused Windows to be the virus-laden mess that it is.

Your hypothetical vulnerabilities because /Applications is world writable (it is?) sounds reasonable except that it just doesn't happen. I suspect that a close look at how the apps _within_ that directory are permissioned would explain that.

Back to the original topic, the "virus" in this example is just a script that breaks things, that if you allow yourself to run as root, will break things that root is allowed to break. That's a meatware vulnerability; has nothing to do with the OS. And meatware is much harder to patch.

The Windows model and Apple.

[argent]

The guys at Apple are mostly to blame for this. Instead of Apple telling it's minions that yes in fact there is a threat to users of the Mac OS X system (as in every operating system) so you should add layers of security to protect yourself. I have to admit the Mac OS X system seems to be one of the more secure platforms and that is great. But Apple is setting it's users up for failure.

There is a threat, and it comes from Apple, but it's got nothing to do with adding layers of security or not adding layers of security. It has to do with Apple borrowing a bad security model from Windows... the idea that warning dialogs are an alternative to inherently secure design. I've been predicting that the vulnerability that this program used to launch the installer would be used in an attack on OS X since 2004. Instead of fixing the vulnerability (even in part, by eliminating 'Open "Safe" files after downloading') Apple has decided to add warning dialogs when the computer wants to do something that might have been requested as a result of this vulnerability.

http://www.scarydevil.com/~peter/io/osx-security.html and following articles.

What differentiates this social engineering attack from others (like the AIM worm) is that it's initiated without any explicit user action. The user is faced with a decision, and has been trained to make the wrong decision in this situation. This is the Windows model. The Mac model, traditionally, has been to do what the user requests when the user requests it, and if it seems like a dialog might be needed, look for a way to avoid it... for example, Macs don't ask before moving files to the trash, or before emptying the trash, because these operations are separate and both have to be performed before there is data loss. In this situation, the solution is to download the file to a standard location, but let the user request that it be opened as a separate operation.

In the browser I normally use on OSX, Camino, this is how it normally works... and the option to behave like Safari has a warning that this is dangerous.

Luckily, Apple seems to have decided to back away from the dangerous operation, making it off by default. The preference is apparently not universal... I've had Dashboard widgets installed even when it was off... and, unfortunately, all the stupid security dialogs they added while they were trying to avoid making that decision are still there. But it's a start.

Antivirus software is not useful in this situation. Antivirus software is not a useful tool at all until after there is a population of viruses for it to test for, and it's a bad idea to even consider deploying it before then because false positives and bugs in the antivirus are more likely to cause problems than accidentally getting a virus. I would recommend against using antivirus software on the Mac at the current time.

Use appropriate tools.

[argent]

First of all you are absolutely incorrect by saying there are no Mac OS X viruses out there.

There are no viruses for OS X propogating in the wild.

Secondly there are a lot of tools that get planted on ALL systems that Anti-Virus can detect.

You don't need anti-virus software to detect rootkit tools. If you are concerned about them, it is far safer to install a rootkit detector, which doesn't patch the system to override system and library calls (and we just had a vivid blue demonstration of how good an idea that is) and run continuously in the background chewing up CPU time.

Mac OS X is susceptible to attack and ignoring that isn't going to help your security posture.

You don't make a system secure by "testing in" security after the fact. You do it with secure design. The security hole involved here is an obvious bad design that I've been blogging about since June 2004. Luckily, unlike the same hole that exists in Windows, you can turn it off in OS X and it's now off by default.

Multiple layers of protection, yes, but make sure they're appropriate ones. It's as bad an idea to install antivirus to look for rootkits as to take antibiotics for the flu.

But users who need more codecs do find Perion

[SuperKendall]

i think it's funny how apple users assume all apple users know about all the good software that covers "everything".

Of course they dont. But anyone who needs more codecs (and lets face it, this means bittorrent users) quickly discover codec packs like Perion because they are widely discussed - or the install Flip4Mac and Divx and are done with it.

And you have to think more than twice, you have to agree to go to a web page and then download the "codec" and then agree to open that DMG and then seek to run the installer and then agree to admin. It's a lot of steps and it makes you think. And I don't think any of the users it's aimed at (porn browsers) are actually going to fall for it or at best a very, very small percentage.

Read this post! Naked pix of Brittany and Paris!

[Ken Erfourth]

Blah, blah, blah (Oh, yeah, please enter your administrator password here:__________________, and your Windows XP Key here:_____ _______ _______ ________ _______, then copy this line to an email and send it to me. After verifying your entry, I will send you free naked pix of Brittany and Paris*)

Much silly discussion of the difference between a trojan and a virus, and comparisons of stupidity between Mac, Windows and Linux users. Yawn. Worthless, under the circumstances.

Here's the most important thing. How hard is it to remove from the machine? Will the OS require wiping to remove it? Will expensive software have to be purchased to clean it off?

No. A bit of Terminal work will suffice. http://www.macworld.com/2007/10/firstlooks/trojanhorse/index.php. The guy who wrote this deliberately infected his machine and then cleaned it off.

The biggest problem with Windows Malware isn't just that there is so much of it--it's that it is such a PITA to remove once somebody screws up and gets their machine infected. Well, actually, that may not be such a problem. I get a lot of business cleaning off malware on Windows machines.

*The naked pix will be of the designated geographical regions of France, using Google Earth--what were you thinking I was going to send?

simple solution

[rice_burners_suck]

The solution to this problem is simple:

1. Don't look at pr0n. Try going out instead.
2. If you choose to look at pr0n anyway, don't download anything. After all, how reputable could the site you're looking at be if they serve up pr0n?
3. Run as a Standard user, not as an Administrator, even if you are the owner and sole user of the machine. Create a separate Administrator account into which you can log in order to do administrative tasks.
4. Don't look at pr0n.

"Porn Site Backdoors the Mac Market"

[chicknfood]

Now that the porn market has "penetrated" the Mac's operating system. What else can't it do? It popularized the internet, destroyed BetaMax... If the porn industry wanted to participate in Google's Lunar Landing contest i'm sure they'd have a shot at winning, though their ship would probably look suspiciously phallic...