Two Trojans For Mac OS X

I Don't Believe in Imaginary Property writes "F-Secure is reporting that there are two new Mac OS X trojans. The first is just a proof-of-concept from the MacShadows people that takes advantage of the unpatched ARDAgent vulnerability to get root access when run by the user. The second relies on social engineering: it's a poker game that requests the user's password, claiming to have detected a 'corrupt preference file.' It then takes control of the computer. Now that the source of the proof-of-concept is publicly available, we can expect that future trojans won't just politely request your password."

Comments

Re:Yawn

[KGIII]

At risk of being called a troll... The adage does actually apply but I will spell it out a bit. If you're going to attack then your goal is to do as much damage as you can as efficiently as you can. The vast majority of users are still using Windows. The vast majority of business data is still being transported on Windows based machines. You are as unlikely to find mass-effect malware for a Mac as you are for RiscOS, Amiga, Solaris, BSD, or Linux. The ends don't justify the means from a realistic view and if anyone thinks that malware authors are out there doing it just to "show the man" or for "fame" these days hasn't actually paid attention to the malware scene for the past five years. Today it is about blended threats, specific highly targeted attacks, gaining information as opposed to causing destruction and the goal isn't geekiness nor fame but rather is about money. Mac users are just as likely to type in their password as are Windows users. (As *NIX is not aimed at the mainstream I'd argue that *NIX users are less likely to do so, and yes, I use all the above OSes when required or have used them to play with them.)

Re:Yawn

[phantomfive]

The primary purpose of botnets is NOT monetary, it is political. They are rarely used to directly make money. Woah, you are way off base on this one, and I refer to Misha Glenny, his book where he investigates global hacking schemes.

Even if you think of it, the potential for profit is just too great. If you can harvest 20,000 credit cards, and only take $5 from each one (call it a service charge or something), will the people notice? If you can do it with 20,000, why not a million? Can you not imagine that this would be tempting to people? It is. Horribly tempting.

Another example we had on slashdot here a few years ago was a story about botnets being used to DDOS offshore gambling sites, and then ask extortion money to stop the attack. Here, check it out. There are many ways to make money with a botnet. Of course spam is another common way. Hacking is big business.