Mac Malware Evolves - No Install Password Required

An anonymous reader writes "The latest versions of the Mac Defender malware attacks no longer require users to enter their admin credentials (username and password) upon install. A threat called 'Mac Guard' installs itself into areas of the Mac OS X system that only require standard user privilege. On Windows the criminals did this to avoid UAC warnings, and have copied this trick to their Mac OS X releases."

Comments

Root access not needed

[mms3k]

I always find it stupid that even here people say that malware on Linux would not be able to gain root like in Windows. Spam bots, fake antiviruses, password stealing nasties and so on run perfectly fine under normal user account. There is no reason why they would require admin privileges. All the personal files are accessible on normal user account and spam can be send without root too. Sure, it could hide a little bit better if it had root access, but there's plenty of tricks to pull out under normal account too. It's like a guy making everything overcomplicated by thinking how he needs to act like a perfect guy and take the girl to a fancy restaurant and many dates before having intercourse with her. Sometimes it's just easier to go for a ladyboy - a woman with mens desire for sex. Requiring access to root account would be more common situation with something like hacking servers since you need to modify logs and really hide in the system. Most likely you also need to get access to HTTP ports and under Linux you need root account for those. But malware runs perfectly fine under user account.

Re:Root access not needed

[CharlyFoxtrot]

It's an ongoing joke, he's been challenged to use the word "ladyboy" in every comment he makes.

Re:Root access not needed

[obarthelemy]

using ladyboy is easy. we went ladyboy anal... ogies !

Re:Root access not needed

[torgis]

It's like a guy making everything overcomplicated by thinking how he needs to act like a perfect guy and take the girl to a fancy restaurant and many dates before having intercourse with her. Sometimes it's just easier to go for a ladyboy - a woman with mens desire for sex.

Erm, I'm not sure that's really the accepted definition of the term. In fact, I'm quite sure it's not. I wouldn't go hunting for ladyboys if I were you. Especially in Southeast Asia.

Re:Root access not needed

[michelcolman]

I wish I had mod points to mark this informative :-)

Re:Root access not needed

[erroneus]

http://slashdot.org/comments.pl?sid=2184872&cid=36239592

To be fair, one point I was a little wrong about was "giving it a little time." By that, I was thinking a few weeks or even months. Turns out to be days. Oops!

The only thing root/administrator level access is needed for is to make it harder to remove. When running as the user, the malware already has access to most of what it needs -- internet/network access, user information and application data.... being stealthy and/or hard to remove is a nice addition, but not necessary to do bad things.

Re:Root access not needed

[reub2000]

You can mount your home directories with the noexec option. They can save a file in your home directory, but it can't do anything then.

Re:Root access not needed

[w0mprat]

I always find it stupid that even here people say that malware on Linux would not be able to gain root like in Windows. Spam bots, fake antiviruses, password stealing nasties and so on run perfectly fine under normal user account. There is no reason why they would require admin privileges. All the personal files are accessible on normal user account and spam can be send without root too. Sure, it could hide a little bit better if it had root access, but there's plenty of tricks to pull out under normal account too. It's like a guy making everything overcomplicated by thinking how he needs to act like a perfect guy and take the girl to a fancy restaurant and many dates before having intercourse with her. Sometimes it's just easier to go for a ladyboy - a woman with mens desire for sex. Requiring access to root account would be more common situation with something like hacking servers since you need to modify logs and really hide in the system. Most likely you also need to get access to HTTP ports and under Linux you need root account for those. But malware runs perfectly fine under user account.

Absolutely. If Malware needs admin, it's disturbingly easy to phish for a sudo password. Linux tends to ask for your sudo password a dozen times a day, training users to enter it like a reflex. Linux, unfortunately, depends a great deal on not being installed on 90% of the worlds computers for any muppet to use, and having a disproportionate number of tech savvy geeks in it's userbase.

Interestingly Android and Chrome OS are linux that do just fine without needing a sudo password. It seems sandbox based security models are superior to the old way of doing things.

After all it's better to have security by design, rather than security that offloads responsibility to the meat puppet that entered it's credentials.

Re:Root access not needed

[shutdown -p now]

That is assuming that your /home is a separate partition. Many "user-friendly" Linux distros don't do that by default - e.g. Ubuntu does not. Those that default to a separate /home usually still don't default to noexec. In short, you have to know the feature is there and how to use it - in which case it's likely not a problem for you in the first place, because you simply won't run random downloaded crap.

By the way, in Windows you can do a similar thing with permissions - explicitly deny exec rights to all files (but not subdirectories) under a given directory, such that it will override any permissions on the files themselves. This is somewhat more powerful because it can be as fine-grained as needed, and there's no need for the directory to be a separate partition. But basic problem is the same - it's not done by default, and it's not trivial to set up for a casual user.

As well, noexec doesn't help all that much, because it doesn't prevent running interpreted code - even Bash scripts can do a lot, and most Linux systems have Perl and Python running out of the box, as well. You can easily have a full-fledged server written in Python.

Re:Root access not needed

[Angostura]

I love it when Linux officianados un-self consciously praise the benefits of the walled garden approach.

Re:Root access not needed

[reub2000]

If malware started placing scripts and executables in a user's home directory, then I think distros could easily modify their installers to create a separate home directory and put the noexec option in fstab for that partition. I don't think most users would notice since most software comes from the package manager. Then if malware places a file in a place like ~/.kde4/autostart/ it won't do anything. Files like ~/.bashrc can be made immutable.

Re:Root access not needed

[shutdown -p now]

Yes, and Windows can set noexec on all directories writable by user without elevation.

But it doesn't. Nor does OS X, nor Linux distros. Which is what we have to deal with today.

As well, it doesn't really secure you againt PEBKAC-enabled malware. If the user will willingly download and run a random executable, why do you put it past him to click/type through any UAC/sudo prompts the OS might pop up? In fact, we already know that users will happily do that, from Vista/7 experience.

Re:Root access not needed

[Kitkoan]

Its not a walled garden when you can still install programs beyond the garden. Its like declaring to someone who plays games that they should buy their games from Steam. It tends to be the best way to keep things up to date and legit, but its a far call from a walled garden.

Re:Root access not needed

[reub2000]

Yes, and Windows can set noexec on all directories writable by user without elevation.

Since many windows programs are downloaded as executable files, it could make installing software harder for many users.

As well, it doesn't really secure you againt PEBKAC-enabled malware. If the user will willingly download and run a random executable, why do you put it past him to click/type through any UAC/sudo prompts the OS might pop up? In fact, we already know that users will happily do that, from Vista/7 experience.

I think that the point is that while many will click on the prompt, the rest will not. This allows them to target the rest.

Re:Root access not needed

[Stuarticus]

Absolutely. If Malware needs admin, it's disturbingly easy to phish for a sudo password. Linux tends to ask for your sudo password a dozen times a day, training users to enter it like a reflex. Linux, unfortunately, depends a great deal on not being installed on 90% of the worlds computers for any muppet to use, and having a disproportionate number of tech savvy geeks in it's userbase.

What kind of shit are you shovelling here? Nothing but updates should require password for day to day usage, and you can set security updates to run automatically in the background.

No surprises here

[betterunixthanunix]

...is anyone actually surprised by this?

Re:No surprises here

[gid]

Nope, and Google Chrome uses this same trick if I'm not mistaken.

Re:No surprises here

[supremebob]

The Apple store might pretend to be surprised by this, anyway, considering that they're still not allowed to tell customers that Mac malware exists.

Re:No surprises here

[Low Ranked Craig]

Not really. And I wasn't really surprised to find that this is a slashvertisment. Sophos makes anti-virus software for Macs. I prefer to get my news from someone who doesn't have a vested interest in selling me stuff directly related to the content of the article.

Re:No surprises here

[Low Ranked Craig]

Follow up. I find it interesting that they gloss over the fact that to completely avoid this all you need to do is turn off download safe files in safari, and/or not be stupid. Their solution is to purchase their anti-malware package for Mac. Question for samzenpus, how much did these guys pay you to post this?

Re:No surprises here

[gad_zuki!]

How about the comments in the last article from the fanboys screaming "BUT THEY NEED TO PUT IN THEIR PASSWORD UNLIKE SHITTY WINDOWS" and then modded up to +5 insightful.

Welcome to the new reality. I think they'll find that userland rights on any modern OS are pretty lenient and will allow for a great deal of scammy malware activities. Malware doesnt need to run in any system directory or open any low ports or anything.

Now is probably a good time to invest in OSX AV products.

Re:No surprises here

[gad_zuki!]

That's a little like saying "Oh just run noscript or make disable the java plugin" in the Windows world. Most end user have no clue what "safe files" are or what any of what you wrote means.

Not to mention, any web based exploit can install this malware now. It runs purely in userland. Java exploits, flash exploits, browser exploits, etc open the gate for this malware. Today its the safe files in Safari, tomorrow its one of dozens of Java exploits.

Its simply easier for end users to do updates and buy an AV than to dick around with settings they don't remotely understand. To Apple's benefit they're usually good about software updates and also update Java (at least for now).

Re:No surprises here

[CharlyFoxtrot]

That policy has probably changed now since Apple has publicly acknowledged the threat and announced a fix, as well as publishing how to remove it. That's their M.O. : nobody gabs until word comes down from the mother-ship.

Re:No surprises here

[thoromyr]

not just that, but the sophos article glosses over the fact that you still get

1. an operating system warning about executing a file downloaded from the internet (complete with reference to where it was downloaded from). They mention it in the text, but omit it in their "slideshow" showing the steps to getting infected.

2. an osx installer gui which means it can be canceled

What this is *not* is a hidden and silent install like what is going on with Windows.

Re:No surprises here

[maxwell demon]

all you need to do is turn off download safe files in safari

Turn off download safe files? But if they are safe files, why is there a problem downloading them? They are safe, right?

Re:No surprises here

[DJRumpy]

Not only that but you still have to agree to install it. It requires no password because it's run at the user's authority but it must still ask to install.

Re:No surprises here

[Anonymous Coward]

Follow up. I find it interesting that they gloss over the fact that to completely avoid this all you need to do is turn off download safe files in safari, and/or not be stupid. Their solution is to purchase their anti-malware package for Mac. Question for samzenpus, how much did these guys pay you to post this?

Spoken like a true apple fanboi. The same "not be stupid" can be said for all OSes, even windows. Apple has a big enough market share, and rich enough non-tech savvy users to make the platform a target for criminals. Get used to it, it won't go away now. Brought to you from the company that allows closed devices to be rooted by merely visiting a website!

Re:No surprises here

[JeffSpudrinski]

Security companies of all types release information about vulnerabilities...that's nothing new.

Sophos has been around for years and are widely acknowledged as a leader in security software...they simply aren't that well know in the US. Same goes for Kaspersky...been around for years, but the marketing giants of McAfee and Symantec are simply more well known in the states.

I'd rather someone out there let folks know about these issues when they find out and it never hurts if they also provide a solution.

If they had known and *not* told anyone, they'd take a beating for that.

Just my $0.02.

-JJS

Re:No surprises here

[John Hasler]

> Why this is a corporate problem beats the hell out of me.

Why aren't you doing it?

Re:No surprises here

[akahige]

The setting isn't download safe files, it's run safe files after downloading.

Not even close to the same thing.

And yes, even the existence of such a setting is stupid.

Re:No surprises here

[REJ Messser]

Actually, once the installer is downloaded you still have to enter an administrator password. Try it. This piece of malware is still a piece of $hit and requires the FUD of the Windows community to provoke the gullible user into trusting rumor instead of their own good judgement. I mean, few people leave their automobiles unlocked because they "might" leave their keys in the ignition.

Re:No surprises here

[Savage-Rabbit]

That policy has probably changed now since Apple has publicly acknowledged the threat and announced a fix, as well as publishing how to remove it. That's their M.O. : nobody gabs until word comes down from the mother-ship.

Mother ship? Word? Primitive voice communication went out a long time ago. These days Steve just remodulates the reality-distortion field slightly. If you were a Mac user you would know this.

Re:No surprises here

[mrchaotica]

Or its time to turn on parental controls, which allows you to whitelist apps. Now that this is out, that's what I'm going to do for my parents, anyway.

Re:No surprises here

[elrous0]

You get those kinds of warnings in Windows too. Doesn't stop an idiot from being an idiot, though.

Re:No surprises here

[cHiphead]

Yeah but it would be easier to get Mac users to do something like that. "Steve Jobs says turn on No-Script"

Re:No surprises here

[Skuld-Chan]

Wow... So windows has at least two layers not even counting AV/firewall/defender/user only rights that are supposed to protect users - doesn't seem to work though.

All downloaded files in Windows from external networks are blocked from execution - you have to click through that over-ride dialog.

Then you have to click through the UAC prompt to elevate the installer to Admin.

Then if the app wants to access the outside world you need click through the firewall prompts.

People still get infected though :).

Re:No surprises here

[amicusNYCL]

I find it interesting that they gloss over the fact that to completely avoid this all you need to do is turn off download safe files in safari, and/or not be stupid. Their solution is to purchase their anti-malware package for Mac.

So you're under the assumption that if you disable this particular setting, then you are now immune to all present and future malware on a Mac, correct? That proactive things like anti-virus or malware scanning are unnecessary, right? That the entire Mac malware threat ends with a single checkbox, is that about it?

You realize that nearly every time a piece of malware comes out for Windows that there's typically a single setting you can change to mitigate that one specific threat, right? Has that fact stopped criminals from finding new infection vectors?

The news here is not this one piece of software, or how it gets installed, or what it does, or how to stop it. The news is the fact that the professional malware authors are now targeting Macs, and they have the automated toolkits to do it. A little checkbox in your browser isn't going to change that fact.

Re:No surprises here

[cavreader]

So the Windows community is to blame for lax user practices on a Mac OS? This current piece of MAC malware is only the beginning. And the reason the number of compromises will continue to grow is that for years MAC users have been told that the MAC OS is totally immune to viruses, trojans, and all the other threats floating around the web. The surprising thing is the number of techies who seem to be under the impression that the MAC OS security framework is invulnerable and there is nothing to worry about. The criminals know there is a ton of money to be made going after OS X, iOS, and all the different permutations of the Android OS. Plus Windows security has improved greatly since the days of Win95 and IE6 making the number of potential exploits harder to take advantage of. Windows users have also been pounded with security notices and updates for years and that has also helped raise user awarness. I have also wondered how much easier it would have been to create exploits for the Windows OS if Microsoft had open sourced it. It will be interesting to see if open source will encourage more people to target Android in the future.

Re:No surprises here

[L0rdJedi]

Nobody gets "silent" installs anymore. The malware writers realized that all they had to do was be nice, give it a good sounding name, and show some scary screens to make people think they needed it and that it was ok to install. Bam, no more silent installs needed.

Re:No surprises here

[TheLink]

Uh, guess what windows users do to install this:
http://en.wikipedia.org/wiki/MS_Antivirus_(malware)

So they just have to mod it to show OS X style graphics and messages if they detect the OS is OS X.

Once there's enough news in the media about Macs getting infected, victims might ironically install the malware to protect themselves from it :).

Re:No surprises here

[L0rdJedi]

Yes, but the car is important to them. The computer is just a magic box that lets them communicate with relatives that they don't get to see very often. If the computer gets jacked up, they just call the local geek and have it fixed. If the car gets jacked up, they can't go anywhere for an extended amount of time (yes, even several hours a day is enough to make someone angry).

Re:No surprises here

[L0rdJedi]

Ok, listen here, because Apple has set preferences on Safari to meet their corporate needs instead of user safety,just like every one else. So the user has to fix it to give us safety

In Safari open preferences. In 'General' uncheck 'Open "safe" files afer downloading'. This will require you to open the files manually from the download window.

Next select 'autofill'. Make a decision if you want Safari to save your data.

You lost at least half your audience right here (maybe even more of them). You want the average computer user to make a decision? Can't you just tell them what it should do? You're the expert, right? That is what I deal with on a daily basis. I am not even kidding.

Don't give them a choice until they complain about the way it works. Then switch it for them. It's so much easier than explaining the difference between the two choices. "Well, Carol's information always shows up automatically. Can you make mine do that?"

Re:No surprises here

[socz]

hey, i'm a PC and check the md5 of every file i download against that posted on the software page. I learned that from a little problem with irssi a while back http://www.securityfocus.com/bid/4831/discuss

Re:No surprises here

[CheerfulMacFanboy]

Security companies of all types release information about vulnerabilities...that's nothing new.

And this a vulnerability how? Don't start to blur the meaning of yet another concept in computer security.

Re:No surprises here

[gad_zuki!]

I'm responsible for more windows machines than I care to admit and we dont have this issue. I did see it at my old employer and after some investigation I found:

1. All the machines that got this had out of date Adobe Reader or Java plugins.

2. Or the end user installed it clicking yes at every warning prompt.

Most likely your plugin security isn't up to snuff. Stats released by Brian Krebs at his security blog show that crimepacks that use this exploit Java or Reader vulnerabilities 90% of the time, and the rest of the 10% is old patched browser or windows exploits.

Re:No surprises here

[michelcolman]

Actually, Steve Jobs would just release a system update to change the setting for you.

Re:No surprises here

[michelcolman]

Actually it says "open safe files after downloading". And specifies "Safe" files are movies, pictures, sounds, pdf's, text documents, disc images and other archive files. Nothing about running anything. And indeed, users are always asked for permission before actually "running" any code: the installer is just Apple's installer parsing an install script, and if that script contains any customized code, it will ask you for permission to run that too.

But all that is of course under the assumption that no exploits will ever be developed for, say, pdf.

Re:No surprises here

[Low Ranked Craig]

It's not the same or even close. Open Safari, from the Menu -> Safari -> Preferences. On the first page un-check "open safe files after downloading". The point being that if this was truly an informative article and not an advertisement they could have included this little bit there. Having that option checked is a prerequisite for this exploit.

Re:No surprises here

[TheCouchPotatoFamine]

I do - for my parents, for my friends. Why I don't do it on a larger scale? Because people have to trust me! It requires social networking to do this correctly. It might require a community tool, something opensource that communities can run to isolate good applications from bad.. But the main problem is social. Although I suggest community whitelisting, I don't know exactly how to make it "stick" with people I don't know.. isn't that the point, that we trust? I know, I know hard problem.

Re:No surprises here

[shutdown -p now]

This isn't the 90's, they just prefix the virus with 'fun'.

Prefixing with "fun" is early-2000s. These days, it is usually called something like "Free Anti-Virus Plus", and the first thing it does when run is tell you that your computer is infected, and would you like to fix that right now?

Re:No surprises here

[perryizgr8]

in win7 you get TWO warnings before execution of a downloaded file. one from explorer and the next one dimming your desktop and everything and making an annoying 'ping'. everyone just clicks 'allow'. i think its highly unlikely that an osx user would click 'deny' in the same situation.

Re:No surprises here

[perryizgr8]

are you by any chance running xp, or maybe turned off the uac?

Re:No surprises here

[exomondo]

What this is *not* is a hidden and silent install like what is going on with Windows.

If you're using the more than a decade-old Windows XP which was superseded 5 years ago by an operating system that gives you multiple warnings about executing unknown files.

Re:No surprises here

[Stupendoussteve]

Not with this "vulnerability" it wouldn't.

If it's installing to a user-controller folder, UAC will not activate for it. That's one of the reasons World of Warcraft installs to a user-writable folder (on Windows), so the program can run and/or update without needing to trigger UAC. This same attack vector is present in Windows, Mac and Linux.

You will still get the explorer warning, just like the finder warning you get on the Mac.

Re:No surprises here

[mjwx]

Security companies of all types release information about vulnerabilities...that's nothing new.

And this a vulnerability how? Don't start to blur the meaning of yet another concept in computer security.

Since when has "the user is any systems biggest vulnerability" been a fuzzy concept in computer security.

Methinks you need to go back an re-read a few books on the subject. A big part of security is actually limiting what users can screw up and making sure you can recover whatever users manage to screw up.

Re:No surprises here

[mjwx]

are you by any chance running xp, or maybe turned off the uac?

XP post SP2 asks before executing a lot of files, any one that hasn't been signed by MS (so Firefox doesn't but CutePDF will). So the GGP needs to be running a six year old version of Windows and to be frank, not having UAC would be the least of his security problems.

Re:No surprises here

[mjwx]

How about the comments in the last article from the fanboys screaming "BUT THEY NEED TO PUT IN THEIR PASSWORD UNLIKE SHITTY WINDOWS" and then modded up to +5 insightful.

How many Mac users are running without a password. When starting/re-installing OSX the password is still optional (just like shitty Windows). Basically, running as admin on a Windows box with not password is pants on head retarded and we all deride MS for making that possible, why does Apple receive a free ride? MS should make passwords mandatory for admin accounts with the next Windows release at the very minimum. So should Apple.

Welcome to the new reality. I think they'll find that userland rights on any modern OS are pretty lenient and will allow for a great deal of scammy malware activities. Malware doesnt need to run in any system directory or open any low ports or anything.

Now is probably a good time to invest in OSX AV products.

But the new reality doesn't "Just Work(TM)". I'm sure Mac Fanboys will just stick their heads in the sand until its over.

Re:No surprises here

[Provocateur]

Ah but then the idiot is evolving, ever resistant to these warnings. And *you* never expected to see 'idiot' and 'evolving' in the same sentence, now, did you?

Re:No surprises here

[vaporland]

It was a good ad too! I installed their free antivirus on my Mac ...

Re:No surprises here

[Kalriath]

Install for just you and the Mac won't pop up the password dialog either.

Re:No surprises here

[CheerfulMacFanboy]

Security companies of all types release information about vulnerabilities...that's nothing new.

And this a vulnerability how? Don't start to blur the meaning of yet another concept in computer security.

Since when has "the user is any systems biggest vulnerability" been a fuzzy concept in computer security. Methinks you need to go back an re-read a few books on the subject. A big part of security is actually limiting what users can screw up and making sure you can recover whatever users manage to screw up.

I hope you attempted to make a joke. Why would "the user is any systems biggest vulnerability" need to be reported as a new vulnerability in this case?

Re:No surprises here

[mjwx]

I hope you attempted to make a joke. Why would "the user is any systems biggest vulnerability" need to be reported as a new vulnerability in this case?

I hope you're attempting to make a joke here, otherwise you really need to be locked away from computers.

First of all, you've gotten confused between a vulnerability and a threat. Security companies like Sophos and Trend disclose threats, which this is one of.

Secondly the user is a massive vulnerability.

Thirdly, the nature of the threat has changed (no longer requires elevated permissions) so the threat warning needs to be re-issued.

Get used to these conversations. Malware is now a reality on OSX. Using semantics to try and hide it will not make it go away.

Re:No surprises here

[CheerfulMacFanboy]

Try to follow the thread. On second thought, burn your computer.

Re:No surprises here

[Waccoon]

Aren't most security problems these days application-level? What is any OS going to do to protect my data when it's all in user mode? An OS can only cover its own ass.

Not to mention the fact that since we do most things over the Internet in a web browser, it's a single point of failure. Run a PDF viewer in your browser as a plug-in? Oh, what a great idea.

It's not just Mac users that are in denial. Linux isn't going to keep your data safe either if there's a security flaw in the web browser, and... oh boy, are there plenty.

Re:No surprises here

[AmiMoJo]

For this exploit perhaps, but every year at pwn2own people come up with plenty of drive-by infection vectors for Safari. And Firefox for that matter, which could also be used to infect a Mac. Chrome seems to be the only browser that ever comes out of the competition intact.

Re:No surprises here

[thoromyr]

Yes and no. It depends on the malware and what vulnerabilities it is exercising. In *principle* you get a warning from Win7 about executing a file downloaded from the Internet. In practice, not necessarily. For example, one of the Java "apps" I reversed did a simple "fetch and execute". Most users aren't going to be warned about a java app embedded in the page, nor are they going to be warned about it fetching a remote file and executing it. The fetched file wasn't even given an executable extension, it was directly loaded/executed by function from Java.

Not that that same can't be achieved on OSX, but I haven't seen any examples of it.

PEBKAC

[Hatta]

This still requires the user to deliberately install the malware. Since it's not compromising the system, but the user, it doesn't need privileges to do this.

Re:PEBKAC

[Anonymous Coward]

Comments like that make me think you are not participating in the two minute hate.

Just embrace the hate of apple and join the group think.

Re:PEBKAC

[Ryanrule]

So, you are saying the computer is fucked upon purchase? FUP?

Re:PEBKAC

[TWX]

That's what I've always liked about proper user versus management privileges on a computer- when the user who isn't the computer's owner or admin b0rks their account, you just nuke the account and recreate or just nuke the home directory, backing up only if they're important enough for it to cost you if you don't. Unfortunately, when the "admin" is the owner and only has user-level knowledge, they're probably not willing to nuke their own account, assuming they're not running with too many privileges in the first place. At least with OSX it should be possible to do this as they're following the POSIX model for the most part, but only if the owner is willing/able to do it right.

On a somewhat-unrelated note, it still blows my mind when enterprise level IT still has users with full admin rights over the local workstation, as those machines constantly and continually get infected and reinfected through the ignorance of the users. Sure, it means that a user can add a local device more complicate than a printer without calling the helpdesk, but it also means that any piece of unauthorized software, whether the user intended to install it or not, or whether it's benign or malicious, gets on to the computer. When the IT department sets up the computers and privileges properly, and if the OS doesn't have local root exploits so large one can drive a Mack truck through, the user can do a lot less damage.

Re:PEBKAC

[CharlyFoxtrot]

And now it can do less damage because it's running without admin privileges. Should be a lot easier to remove too.

Re:PEBKAC

[Richard_at_work]

For the small fraction of people that have more than one active account on their Mac, sure, but for most people it will do the same amount of damage.

Re:PEBKAC

[Talderas]

On a somewhat-unrelated note, it still blows my mind when enterprise level IT still has users with full admin rights over the local workstation, as those machines constantly and continually get infected and reinfected through the ignorance of the users. Sure, it means that a user can add a local device more complicate than a printer without calling the helpdesk, but it also means that any piece of unauthorized software, whether the user intended to install it or not, or whether it's benign or malicious, gets on to the computer. When the IT department sets up the computers and privileges properly, and if the OS doesn't have local root exploits so large one can drive a Mack truck through, the user can do a lot less damage.

It's not entirely unsurprising. Telling the company owner that "We need to change the level of permissions everyone has on their machines, which means they won't be able to do this, this, and this." after the company owner and the entire user base is accustomed to having that level of permission doesn't typically get a go ahead flag from the company owner.

Re:PEBKAC

[AndyAndyAndyAndy]

But now it compromises slightly smarter users, widening its success rate by some degree.

Re:PEBKAC

[TimeElf1]

This still requires the user to deliberately install the malware. Since it's not compromising the system, but the user, it doesn't need privileges to do this.

Gee, users deliberately installing things that might be harmful for their computer? I can't ever see that happening....

Re:PEBKAC

[BitZtream]

Just putting itself in the Applications directory doesn't do anything special, users still have to run it. The Applications directory isn't setuid or anything like that, it doesn't make the app run as root, it doesn't have anything to do with startup or anything else, you're just allowed to create files in the Applications directory.

As I pointed out elsewhere, the intelligent thing to do would be to install to the users home directory as most non-techie Mac users will NEVER look in their home directory and notice it, thats just someplace they don't generally have to go, thats what the Documents, Pictures, Music and other folders are for. Unlike the Applications directory where users are bound to be looking at least once in a while.

The end result would be the same, all its going to do is effect a single user.

Now if it was intelligent, it'd modify the plist of an existing app to take itself on as the app launcher, then start the real app itself, which would possibly be used by other users on the system. You wouldn't be able to do it to the Apple builtin apps as permissions still require you to be root to modify it, but some other app the user installed will be owned by them and modifiable.

Back when they were asking for a password, they should have been installing a kernel extension to cloak themselves and make removal without booting from a clean drive impossible.

This 'malware' is like most Mac users, its a joke, its not even a little bit impressive, it just happens to be the first one noticed.

Just wait until the Windows malware writers start putting some effort into OSX, THEN it'll get nasty.

Re:PEBKAC

[Lumpy]

Stop bringing truth and facts into this.....

Re:PEBKAC

[tepples]

Gee, users deliberately installing things that might be harmful for their computer?

Conventional antivirus software acts as a blacklist. Mac App Store acts as a centrally managed whitelist. Do you recommend either of these two approaches, or do you recommend a third one that's less widely known?

Re:PEBKAC

[nlawalker]

Clearly, then, this malware was engineered by Apple itself to cull from its userbase those that it felt were not worthy of their computing experience. I mean, seriously, no one who dares install apps from anywhere other than the App Store(TM) should be able to call themselves an Apple user.

Re:PEBKAC

[Lunix Nutcase]

On a somewhat-unrelated note, it still blows my mind when enterprise level IT still has users with full admin rights over the local workstation, as those machines constantly and continually get infected and reinfected through the ignorance of the users. Sure, it means that a user can add a local device more complicate than a printer without calling the helpdesk, but it also means that any piece of unauthorized software, whether the user intended to install it or not, or whether it's benign or malicious, gets on to the computer. When the IT department sets up the computers and privileges properly, and if the OS doesn't have local root exploits so large one can drive a Mack truck through, the user can do a lot less damage.

That's funny because the only cases of malware being placed on computers where I work was done by the IT people themselves. None of us "plebes" have ever done so.

Re:PEBKAC

[WuphonsReach]

Grrr... you just *had* to link to tvtropes...

(Well, there went a half-hour of my day.)

Re:PEBKAC

[not-my-real-name]

This 'malware' is like most Mac users, its a joke, its not even a little bit impressive, it just happens to be the first one noticed.

Maybe we can say that using a Mac damages the brain so much that even the malware writers can't do a good job.

Re:PEBKAC

[recoiledsnake]

So you mean it was just hate of Microsoft and group think when Microsoft was attacked for malware on Windows in at least half a million comments on here by Linux and Mac enthusiasts?

Re:PEBKAC

[Hatta]

I ain't sayin it doesn't ever happen. I'm sayin it's nobodys fault but your own when it happens to you.

Re:PEBKAC

[makomk]

This still requires the user to deliberately install the malware.

Something like 97% of Windows malware infections these days are caused by users "deliberately" installing malware, and that's with Windows putting a lot more obstacles in the way of websites wanting to convince users they should install something malicious than Mac OS X does. Doesn't stop Windows malware infections from being a big selling point for Macs. (Even in the bad old days of Windows security, an awful lot of infections were due to users agreeing to install the malware.)

Re:PEBKAC

[Skuld-Chan]

The end result would be the same, all its going to do is effect a single user.

Until that userspace malware exploits something to elevate itself to root.

Just because it starts as a limited user doesn't mean it won't go somewhere :).

Re:PEBKAC

[Cheech Wizard]

None of them that I know do it that way. All the Mac people I know, and Windows people for that matter, have an understanding of classification, and prefer a well managed, organized computer. Pictures go in the Pictures folder, Documents go in the Documents folder, etc. But then - Your posting as Anonymous Coward pretty much says it all with respect to your post.

Re:PEBKAC

[L0rdJedi]

For the past 10+ years I'd ad. Now that Mac users are getting a taste of it, they're coming up with the same excuses.

The Linux guys will probably never get a taste of it since nobody wants to use a computer where the expert says "No, you idiot! Don't do that!" and "You want that feature? Go write it yourself, the code is all there".

Re:PEBKAC

[BitZtream]

Yes, and I pointed that out in my post, there are several ways it could do something to infect others, but it doesn't, it does things in an absolutely stupid way.

They are either complete and total idiots, or simply dragging this thing out as long as possible by using the easiest way every time and then as soon as that is 'fixed' they use the next one on the list.

The problem with that logic is that they fucked up by having the password prompt previously and NOT installing a kext at that point in time to do really nasty stuff, now all it will take is people realizing that the shouldn't be entering there password, which only requires a slight amount of education and is far easier to do as more publicity comes for this sort of stuff.

So ... they clearly aren't doing this because they want to drag it out, the people/person writing this thing doesn't have an clue what they are doing, this is the sort of shit you did back in middle school and high school to screw with the PCs in your local Stables/BestBuy/CircuitCity/Walmart/BigBoxStore, it doesn't take talent, skills or even very much knowledge, just a malicious little kid that thinks its cool that he knows a way to trick people into doing something.

Re:PEBKAC

[L0rdJedi]

On a somewhat-unrelated note, it still blows my mind when enterprise level IT still has users with full admin rights over the local workstation, as those machines constantly and continually get infected and reinfected through the ignorance of the users. Sure, it means that a user can add a local device more complicate than a printer without calling the helpdesk, but it also means that any piece of unauthorized software, whether the user intended to install it or not, or whether it's benign or malicious, gets on to the computer. When the IT department sets up the computers and privileges properly, and if the OS doesn't have local root exploits so large one can drive a Mack truck through, the user can do a lot less damage.

And, at least where I'm at, it's those same users that demand local admin rights that always screw it up. They don't even get viruses. They just somehow manage to mangle their file systems and registries so bad that shit starts crashing all over the place. Then you end up having to get them a replacement machine because "I can't have any downtime". So they just deal with the problem for months at a time asking you every now and then "Do you by chance have a fix for this yet?" "You mean beyond wiping it out and reinstalling? No".

Re:PEBKAC

[L0rdJedi]

I have found that taking rights away from people that don't really need it without telling them is the way to go. Just remove local admin from their account and see if they run into problems. They have no idea that they've been setup differently and they don't even know what you're doing if/when you add it back anyway (they don't care).

You simply do it and then watch as your level of support calls from those people drop. If necessary, for some older programs, you give the user rights to that programs folder or a few registry entries. It not only prevents viruses, malware, and other junk, but it also keeps them from installing all kinds of stupid little programs that they don't need.

Also, if you present the argument as "We need to take away this access so they don't try to install pirated software" management tends to agree in a heart beat. It's even better if you have evidence that someone has already installed "unauthorized software".

Re:PEBKAC

[psydeshow]

The end result would be the same, all its going to do is effect a single user.

Can we retire this meme?

Nobody besides IT gives a shit if the trojan can hack into the kernel or system libraries. If it can run in user space it has access to my contacts, my photos, my browser history, my bookmarks, my email, my music, and pretty much every-fscking-thing I care about on the computer. It can send mail as me, post to websites as me, drop files in my downloads folder, and put stuff on my desktop.

I mean, great that it can't infest drivers and start servers below port 1024. But the primary user of the computer (the non-admin shlub who actually needs to get work done) is infected.

Re:PEBKAC

[cratermoon]

Mac Defender just proves that Apple has finally broken the Microsoft Windows monopoly on the desktops of the sort mouth-breathing idiot who can be socially engineered into incredibly stupid actions.

Re:PEBKAC

[X0563511]

I'm also sure they are working on taking care of that "PEBKAC" issue. The way this thing is advancing, in another week it will be a silently installing drive-by download...

Re:PEBKAC

[Jibekn]

Also, if you present the argument as "We need to take away this access so they don't try to install pirated software" management tends to agree in a heart beat. It's even better if you have evidence that someone has already installed "unauthorized software".

Have done this.. got the guy fired.. policy change didn't get approved. I hate this company.

Re:PEBKAC

[CheckeredFlag]

On windows, don't the trojan makers try to install without you noticing. I find it really amazing that many people would get infected by this application.

No. By definition, a trojan is something other than what it claims to be and works be tricking the user to install something good that they want and instead delivering something evil.

Social engineering is only getting better and better. As long as the OS allows the execution of unsigned code obtained from any source, the user will be the weakest link. As much as I hate the idea of a closed app-store, Apple might be on to something here which may become the way of the future - i.e. the OS only allowing execution of software from a known trusted source. Malware writers are becoming so good, you can no longer trust the user to be wise. These decisions need to be moved back into the OS via signed code and certs.

Re:PEBKAC

[ninetyninebottles]

Something like 97% of Windows malware infections these days are caused by users "deliberately" installing malware...

Citation please. When last I had access to real data, automated worms accounted for about 50% of infections. That was some time ago, but if you're making an assertion about this, a source is necessary.

Re:PEBKAC

[exomondo]

This still requires the user to deliberately install the malware.

like most malware on any platform.

Re:PEBKAC

[mjwx]

Comments like that make me think you are not participating in the two minute hate.

Just embrace the hate of apple and join the group think.

So Microsoft is not responsible for malware because it's the users fault.

That means MS isn't lying to us, Windows really is the most secure Operating System out there. /sarcasm

Blame the user is the cheapest trick in the book, it never worked for MS so why aren't we holding Apple to that high standard?

Re:PEBKAC

[mjwx]

The end result would be the same, all its going to do is effect a single user.

Until that userspace malware exploits something to elevate itself to root.

Just because it starts as a limited user doesn't mean it won't go somewhere :).

Exactly,

Why do you need root access to send Spam or participate in a DDOS. All you need is net access on ports 25 and 443/80 (maybe 23 also) respectively. I don't know of a consumer OS that restricts net access to a limited user account. You don't even need to start the program as a service, just drop a script into the login script directory (been a while since I've done this on OS X but IIRC it wasn't that hard if you had any understanding of *nix).

Re:PEBKAC

[BitZtream]

Which means you can rmdir /q/s %HOME% or rm -rf ~username and recreate the home directory and the day goes on, no need to reimage the machine just to fix it, the poor IT guy saves him or herself a whole lot of work. In a proper environment, most things will reconfigure to intelligent defaults when the user next logs in, and all their apps will still be there.

So rather than the IT staff (if they have half a clue or more) having to reimage the machine and wasting the time to reapply any customizations or changes from the previous image to current config, and all the other minor changes that happen that get missed along the way ... the IT staff can just delete the users home/profile directory and the user recovers, the hassle of reconfiguring their preferences hopefully reminding them to be a little more careful in the future.

You clearly don't work in IT, so you don't really get to vote on 'retiring this meme'.

I am safe.

[Anonymous Coward]

My PC can't get Mac malware.

Re:I am safe.

[geoffball]

Your Windows system got this malware years ago. Some hackers decided it would be fun to port it to MacOSX.

Re:I am safe.

[BobNET]

You laugh now, but it's only a matter of time before PCs become popular enough that malware writers start targeting them instead.

Re:I am safe.

[jalefkowit]

That's because Windows is the hipster OS! It had malware before malware was cool.

Re:I am safe.

[amicusNYCL]

Really? A Mac is not a personal computer? What kind of device is it, then? Perhaps a "different computer"? Also, why does the definition of what a Mac is relate to how long someone has been in a coma? Surely the presence of recently-comatose patients would not change the nature of the machine itself.

Re:I am safe.

[drinkypoo]

Really? A Mac is not a personal computer? What kind of device is it, then?

Steve's computer.

Re:I am safe.

[amicusNYCL]

It is a computer that is personal, not a Personal Computer.

"A computer that is personal".. that's the same thing as a personal computer. So a Mac is, in fact, a personal computer. So it's not incorrect to refer to one as a PC, if you're into the whole brevity thing.

I know you and the dumb-shits wasting mod-points on this conversation are not this ignorant.

You're right, I'm not ignorant, I just don't base my definitions on marketing drivel, thank you very much.

Re:I am safe.

[amicusNYCL]

My goal has nothing to do with karma on Slashdot, I'm pretty sure it's already as high as it can go (half the time I don't even see scores next to anyone's posts, I haven't bothered to look into why). Yes, I checked the link. I realize that people commonly use "PC" to refer to Windows, for whatever reason. That still doesn't mean that it's incorrect to refer to a Mac as a PC. We've established that a Mac is in fact a personal computer. How much longer did you want to argue about this?

Re:I am safe.

[amicusNYCL]

Didn't say Karma, I said the word Insightful next to your post.

If that was something I cared about, you would probably see me quote my own posts in my signature.

I'm not confused about anything here. I don't go around referring to my computer as a "tower", I don't refer to all soft drinks as "a Coke", and when I'm talking about a particular operating system I just name it instead of using ambiguous terms.

Re:I am safe.

[Em Adespoton]

On a side note (not as funny), the guys pushing this FakeAV will provide you with a Mac or Windows variant, depending on your user agent. I haven't noticed them go after Linux yet though....

The funny thing is, they could do this just as easily via a web app on iOS4 or Android.

Re:I am safe.

[Jibekn]

I can communicate just fine with a child who doesn't know, or use proper terms. Doesn't mean I think they're using the proper words / terms.

I view people who call Macs non PC's as the same way, I understand them just fine, I just do not think they are using the proper terms is all. By strict definition, they're not. A Mac is indeed a personal computer, just not, until recently, one capable of running a Windows OS.

My Apple IIe was a PC, so was my Commodore 64.

With that being said, I would also consider it as rude to correct someone on this, just like I think its rude to correct someones grammar in casual conversation.

Re:I am safe.

[chuckugly]

Ask that preppy Mac marketing douche, he's the one who said he was a Mac and contrasted that with a "PC".

Re:I am safe.

[MobileTatsu-NJG]

I view people who call Macs non PC's as the same way, I understand them just fine, I just do not think they are using the proper terms is all. By strict definition, they're not. A Mac is indeed a personal computer, just not, until recently, one capable of running a Windows OS.

Just an observation: You're saying 'personal computer' here, and not PC. It really is a branding discussion no matter which way you slice it.

My Apple IIe was a PC, so was my Commodore 64.

This is not inconsistent with what anything I have said.

With that being said, I would also consider it as rude to correct someone on this, just like I think its rude to correct someones grammar in casual conversation.

It's more rude than correcting someone's grammar. The fear of English mutating away from its established rules is not unfounded. The PC vs. pc debate, if it really needed to be fought, really needed to be fought at least 10 years ago. By today it's something that even Commander Data would roll his eyes at.

Re:I am safe.

[Unkyjar]

Well, to be honest, if you're keeping with the everything must be abbreviated then you should call your computer a "T".

Re:I am safe.

[Unkyjar]

Being pedantic isn't Mac a Microcomputer, I mean can you really call it a personal computer if you don't know how many people use any particular machine?

Also keep in mind that PC can mean a lot more things than Personal Computer, but people never seem to bring those other abbreviations up when they get upset at people calling Window's machines PC's.

Player Character
Politically Correct
Primary Care (physician)
Parsec
Per Capita
Punch Card
Prerequisite Course
Political Committee
Private Contractor
Pepsi Cola
Petty Cash
Protective Custody

Re:I am safe.

[amicusNYCL]

I don't care if things get abbreviated or not. I'm just saying that it's not wrong to refer to any personal computer, I.E. not a mainframe, server, etc, as a PC, regardless of the operating system it happens to be running. For example, if I have a computer that can boot into either Windows, Mac OS, or Linux, it's a PC. If it can only boot in one of the three, the fact that it's a PC hasn't changed.

Re:I am safe.

[amicusNYCL]

Being pedantic isn't Mac a Microcomputer, I mean can you really call it a personal computer if you don't know how many people use any particular machine?

I don't think the term personal computer implies a single user. A personal computer is distinct from other types of computers like mainframes or even servers (even though a personal computer can in fact have server software installed on it). I tend to think of a "personal computer" and "terminal" as more or less the same, regardless of what hardware is inside them. It's a computer designed to be used by a single person at a time. Mainframes and servers do work for a lot of people at a time, even if they aren't all sitting in front of it.

Re:I am safe.

[Haeleth]

Why assume his PC runs Windows? Linux still has a small enough desktop market share to be largely unthreatened by this kind of malware, and by the same principle OpenBSD is 100% safe, guaranteed.

Re:I am safe.

[MobileTatsu-NJG]

I tend to think of a "personal computer" and "terminal" as more or less the same, regardless of what hardware is inside them.

Wow. Just... wow.

Re:I am safe.

[exomondo]

Really? A Mac is not a personal computer?

No. it is not.

yes, it is most certainly a personal computer.

Less damaging

[CharlyFoxtrot]

So that means it's now running with only user privileges instead of admin rights, which seems like a slight improvement for those dumb enough to install it.

Re:Less damaging

[LordLimecat]

Theres no reason the malware cant install in usermode, and also attempt an elevated install for real rootkit goodness.

Re:Less damaging

[Ephemeriis]

So that means it's now running with only user privileges instead of admin rights, which seems like a slight improvement for those dumb enough to install it.

It also means that whatever files exist and whatever changes are made live somewhere in that user's profile.

The Windows malware that does this is annoying because it can sneak in without admin rights... But it is easily removed by simply logging in as a different user and deleting the infected profile.

Re:Less damaging

[CharlyFoxtrot]

True but if they were capable of using a real exploit wouldn't they do so directly ? The more work these asshats have to do to get into the system the more chance there is of detecting and/or stopping them at some intermediate point.

Re:Less damaging

[0123456]

So that means it's now running with only user privileges instead of admin rights, which seems like a slight improvement for those dumb enough to install it.

Not when it logs your banking passwords and sends them to the Russian Mafia. Most of the things that malware wants to do can be done in user mode as well as admin.

Re:Less damaging

[CharlyFoxtrot]

Sure but if your kid installs this under his/her account then mommy & daddy are still safe, for now at least. And it'll be a lot easier to purge something that didn't have admin rights from the system.

Re:Less damaging

[lightknight]

Lol. Only if the user is on the ball.

Remember, Apple has been marketing their Macs to people as a way of avoiding malware. While some of the Mac population consists of intelligent people capable of spotting these threats, most of it does not. They think they are safe, forever, from malware.

Malware for a computer is like paparazzi for an actor. You need to pass a certain threshold in popularity, and then it doesn't matter who you are, it's a problem.

Re:Less damaging

[BitZtream]

I'd love to see it get my banking passwords out of my Keychain without my password ...

The OSX keychain exists to make sure that isn't a problem, so they only time it would be a problem is if you were using some banking software that didn't use the keychain. Remember, an app can't even ask for another apps data from the keychain unless the original app that wrote it made it available for other apps.

Can it infect OSX, sure, is it going to be stealing passwords? Not from any app that matters and was intelligent enough to use the keychain rather than trying to reinvent the wheel, so probably not anything your bank is using either ... since lets face it, your banking passwords are being used in Safari, which uses the keychain.

Re:Less damaging

[CheerfulMacFanboy]

Lol. Only if the user is on the ball.

Remember, Apple has been marketing their Macs to people as a way of avoiding malware. While some of the Mac population consists of intelligent people capable of spotting these threats, most of it does not. They think they are safe, forever, from malware.

And according to your "logic", this is why they will install something that will protect them from malware - are you even trying?

Re:Less damaging

[lightknight]

Your assumption is that my post pertains 100% to the current incarnation of this attack, rather than it being a proof of concept.

If your users believe that they are immune to malware, and they aren't, they can become infected. That it requires a small amount of social engineering to game a user into installing the malware right now is immaterial.

To put another way, "Malware Defender for the Mac" may not work, but "iJailbreaker for the Mac" probably will.

Market Share

[helix2301]

It was only a matter of time till there started being viruses and malware for the MAC just like anything else the more market share something gets the more it gets picked apart. It's only a matter of time till we see desktop linux get virus and malware released. We have already seen some variation of it with the way they are pulling android apps off the market cause of security issues.

Good

[thePowerOfGrayskull]

Hi profile attacks that occur in user space help to underscore that the obsession OS vendors have with admin access doesn't do much of anything to prevent a machine from being compromised -- it only serves to give users a false sense of security. Any malware can run in the user space of any os if the user installs it (and they wiil); and at minimum it has access to all of a user's private data. That should be just as worrisome as a single user machine getting rootkitted - while the harm to the system is greater for a rootkit, the damage to the user is just the same

Re:Good

[_Sprocket_]

Hi profile attacks that occur in user space help to underscore that the obsession OS vendors have with admin access doesn't do much of anything to prevent a machine from being compromised -- it only serves to give users a false sense of security.

I have a hard time completely dismissing privilege escalation. There is still some value in being able to separate user data from the system proper - if only to make clean-up easier. But I do completely agree with the overall lesson here. An overly simplified view of security might very well overlook the fact that there's still a lot of value with operating in the context of an unprivileged user. And as such, users should remain wary whenever they're acting outside the boundaries of their local environment.

It strikes me that this is a subset of the dancing pigs problem. The promise is that computing is being made easy. And in doing so, the end user gets all manner of over-simplified, friendly (or frightening) messages wanting their rubber-stamp to do various unknown black-box things. Whether you promise dancing pigs or protection from evil hackers, it comes down to the same thing. Present the proper dialog box and end users are likely to accept it.

This is a problem that won't be solved by more dialog boxes. At some point, the user needs to be exposed to some level of the complexity of their environment and hopefully given enough information and skepticism to make reasonable decisions.

Re:Good

[thePowerOfGrayskull]

Exactly this. I would even go so far as to say that the extent to which we try to protect the user is causing more harm than good. We teach then to click through warnings as you say, because that is the path they must follow to complete the tasl at hand. worse we teach them that antivirus makes them - even though we know this isn't possible. To make a truly safe experience, the user must be willing to accept a locked down walled garden, permitting only approved software to execute on the machine. Anything less means that the user *must* be educated as to different attack vectors, safe practices, etc. Yet we keep avoiding this reality. Instead we pat them on the head and remind the users to install the latest antivirus in order to keep the bogeyman in the closet where he belongs.

Re:Good

[thePowerOfGrayskull]

Good points. However, I would say that while most users would be perfectly comfortable using the web in this scenario... most of them don't know it, and would squeal like stuck pigs if MS, OSX, or Linux distros tried to use this configuration by default.

And of course, those users who do have legitimate need to get around those restrictions aren't as infallible as they might think they are.

Real issue

[Anonymous Coward]

The only real issue is the "auto-download safe content" default option in Safari.It should'nt be enabled by default. Just uncheck it.

Another case of iClicitys (rush of advertisement clics generated by apple buzz)

Re:Real issue

[konohitowa]

Since I don't have mod points I'll just say, "Thank you!" This isn't a major issue but 'Open "safe" files after downloading" is a piss poor default in Safari. The fix should be simple enough for Apple to push in an update.

The difference

[wandazulu]

So instead of installing into /Applications, which does require an admin username and password, it now likely installs somewhere in the user's home folder, which doesn't require admin authorization. This means the problem would be isolated to that particular user's account.

Re:The difference

[betterunixthanunix]

This means the problem would be isolated to that particular user's account.

For many home users, that is all that really matters. We are not talking about an enterprise setup here, we are talking about some person's laptop. Frankly, in an enterprise setup I would be surprised if user home directories were not mounted with noexec (or whatever such an option would be called in Mac OS X), which would thwart this problem.

Re:The difference

[geekoid]

Except it will probably infect a trusted executable, and then when the trusted executable asks for elevated privileges nearly everyone will allow it to have them.

Re:The difference

[thePowerOfGrayskull]

So instead of installing into /Applications, which does require an admin username and password, it now likely installs somewhere in the user's home folder, which doesn't require admin authorization. This means the problem would be isolated to that particular user's account.

And this is ok? When you consider that most systems that are not servers have only one or two users, the fact that it's limited to one account doesn't mean much of anything all. That's one account having its passwords and cc info gleefully distributed, among other things. Do you really think it matters that the admin account has not been compromised? (yet - once installed it's trivial to trick the user into providing admin access)

Re:The difference

[0123456]

Frankly, in an enterprise setup I would be surprised if user home directories were not mounted with noexec (or whatever such an option would be called in Mac OS X), which would thwart this problem.

It would reduce the problem, not eliminate it. Just because you can't run $HOME/malware.sh directly doesn't mean you can't 'bash $HOME/malware.sh'.

Re:The difference

[betterunixthanunix]

That much is true, which is why I said "thwart" and not "completely eliminate." Now, with a bit of work, you could stop users from doing that as well -- set up the right SELinux policies/contexts and whatnot -- and thus mitigate the threat further. In the end, it really depends on what exactly you are trying to do, and what your users need to be able to do. If your users only need to be able to launch a web browser and email client, then go ahead and stop them from running bash.

Re:The difference

[drsmithy]

Frankly, in an enterprise setup I would be surprised if user home directories were not mounted with noexec (or whatever such an option would be called in Mac OS X), which would thwart this problem.

I wouldn't. The proprtion of Macs in the enterprise is miniscule to begin with, the proportion managed by highly-skilled admins (who would know about, and be able to implement, noexec) virtually nonexistent.

The vast, vast majority of Macs in the enterprise are "one off" purchases for C-level staff, or various other favoured individuals. They're rarely even noticed at by IT support, let alone actively managed.

Re:The difference

[BitZtream]

That's one account having its passwords and cc info gleefully distributed, among other things.

Investigate the OSX keychain and how it works, your apps aren't stealing passwords that any of my other apps use, they are in the keychain, a system level provider of protected storage that is designed to insure that only the app that created the data can access the data unless it specifically does so in such a way to allow other apps to access it.

This won't lead to any password theft without a password being entered to completely unlock the keychain allowing it to be viewed by any app ... which throws a big nasty 'you should NEVER EVER DO THIS' message up and prompts you for your password to confirm.

So, while you are right, once its installed, it its far easier to trick a user into doing something, thats still one more step, and its required before they can even think about stealing passwords (well, until someone figures out a keychain exploit or something along those lines)

Re:The difference

[rsborg]

So instead of installing into /Applications, which does require an admin username and password, it now likely installs somewhere in the user's home folder, which doesn't require admin authorization. This means the problem would be isolated to that particular user's account.

This always confused me about the Mac, why have the /Applications directory if you allow executable .app packages to be run from other locations?
I've accidentally run apps from the download directory or dmg files by using Spotlight to search for the name and choosing the wrong app.
Could they fix this by mandating all Applications run from /Applications or ~/Applications (which could be secured by requiring user non-admin password to install)?

Re:The difference

[Stupendoussteve]

Because maybe you don't want to share all of your Applications with all of the users on the computer?

For a single user it makes no difference, but maybe you don't want your kids messing around with HotPron.app, so you keep it in your own locked down profile.

Apple is patching anyway

[Bryan3000000]

So either the patch will already recognize and remove this, or they will have to issue another little update to take care of it completely. Given that they are not compromising any privileges, stopping this should be ridiculously easy. Why are these guys even bothering?

Unless perhaps they are trying to get an installed base with the current package, which can then perhaps help with a real exploit - e.g. directing a browser to a website that exploits a real vulnerability.

Re:Apple is patching anyway

[geekoid]

Or they want to infect a trusted file, or more likely, the user info they want will resides in the users directory.

For the most part, modern attackers don't want to damage your computer, they want to get personal info. CC numbers and the like.

IT's best for them if there attack as no noticeable impact on a system.

Re:Apple is patching anyway

[Xiterion]

... Why are these guys even bothering?

Because their target is the user who doesn't quite grok the difference between files, folders, programs, and the Internet. You know, the sort of person who can't find their Word documents outside of Word itself. I think the authors of this malware are simply taking advantage of the fact that most users won't notice it's there, and won't bother trying to remove it. Malware doesn't have to be dug in to a computer so hard that a tactical nuclear strike is needed to remove it in order to be effective.

Re:Apple is patching anyway

[WuphonsReach]

For the most part, modern attackers don't want to damage your computer, they want to get personal info. CC numbers and the like.

I would classify malware a bit differently as not all of them want the same things, and their goals sometimes overlap.

1) Control of the machine for use as a force-multiplier. Such as participating in a DDoS, a spam relay, or to harness CPU/GPU time. The traditional "botnet" falls into this category for the most part where the attacker wants to take over other machines to magnify the effect that they can have on a target or to simply spread the load out. The problem with this type is that it is noticeable, often slows down the system, and tends to lead to the machine being deloused.

2) Collection of personal information. Spyware, etc. This sort of operation can be extremely well hidden as it only sends a very small amount of data out and generally does not impact the use of the machine.

3) Ad fraud, click hijacking, page redirection, etc. Highly visible, the malware infects the machine specifically to display ads to the user or to redirect the user's web pages to an ad-serving page. Since it is highly visible and highly annoying, it tends to result in the machine being sanitized.

And there are probably other smaller categories.

Re:Apple is patching anyway

[Em Adespoton]

So either the patch will already recognize and remove this, or they will have to issue another little update to take care of it completely. Given that they are not compromising any privileges, stopping this should be ridiculously easy. Why are these guys even bothering?

Unless perhaps they are trying to get an installed base with the current package, which can then perhaps help with a real exploit - e.g. directing a browser to a website that exploits a real vulnerability.

Apple's AV contains rudimentary signature detection that will block KNOWN copies of problematic malware, when downloaded via Safari or Firefox, or saved via Mail.app.

These guys recently modified their FakeAV so that you download a download app via the SEO poison pages, and IT downloads the actual FakeAV. As a result, any of Apple's detections on the FakeAV itself will never trigger -- and the downloader is much easier to make polymorphic. This means that Apple will always be out of date on the detections unless they overhaul their detection system.

As for why these guys are bothering? Stopping this should be ridiculously easy, but it's turning out that a LOT of Mac users are falling for this and entering credit card details. They don't need OS vulnerabilities when exploiting the user is working so well.

Re:Apple is patching anyway

[CheerfulMacFanboy]

Stopping this should be ridiculously easy, but it's turning out that a LOT of Mac users are falling for this and entering credit card details.

Ahh, finally somebody who has some statistics. Or a big mouth.

Re:Market Share

[_Sprocket_]

Yes, yes. We hear this every single time there's Mac malware. You do realize that this isn't the first time, right?

Does this make it easier to remove?

[UnknowingFool]

Originally this malware asked for an admin password which means it could get access to admin privileges. This new variant installs under user permissions which means that the admin can more easily remove it. That is assuming users don't run as admin. BTW, this variant still requires user intervention to install so it's not quite a virus or worm but still a Trojan.

Re:Does this make it easier to remove?

[ninetyninebottles]

Originally this malware asked for an admin password which means it could get access to admin privileges. This new variant installs under user permissions which means that the admin can more easily remove it.

While theoretically this could have been the case, it isn't. The original software just needed to be force quit and dragged to the trash.

Re:Does this make it easier to remove?

[Stupendoussteve]

Users don't run as admin, even with an administrator account. They are generally unaware of this.

Macs still have a root account, and much like Ubuntu it is locked down and unavailable by default. It is possible to configure the root account and login to the console or gui with it, to make the required fixes, and then disable the account afterwards. Macs also have single user mode, so if things got a little more hectic you could boot into that and remove the malware without an issue and reboot back into a clean system. On a side note this is also why Macs are inherently insecure by default, because it is trivial to login under single user mode and do whatever you want with any user's files. The keychain is an improvement because changing the user's password will not give access, but their files are still insecure by default.

More damaging for Apple than most think...

[imyy4u3]

One of the key selling points that entices a lot of novice users to buy an Apple over a PC is lack of malware/virii. The other key selling points being ease of use/reliability/stability. This latest outbreak, while not particularly damaging, and while not really a threat as the user still must "install it," is getting a ton of media attention and is thus removing the "cloak of invulnerability" that Macs have been advertised to have against malware and virii. So now when a novice user, who doesn't know any better, has to choose between the more expense Mac vs a cheaper PC, will the remaining key selling points be enough to entice them to pay the higher premium? Many people switch solely on the reason of not dealing with virii/malware, but now that they will have to deal with that (whether or not it's true is irrelevant as in many novices minds Macs are now vulnerable) they might just stick with their PC. Bottom line - this is going to really hurt Apple a lot more than most people realize, as they will no longer have the novice users switching just to avoid virii and malware. Apple's "cloak of invulnerability" has been removed...and whether the remaining key selling points will sustain them remains to be seen.

Re:More damaging for Apple than most think...

[AHuxley]

http://iantivirus.com/threats/ has a list of some of the OS X/pre OS X era malware.
Not a lot of virii, Trojan.OSX.RSPlug was it for a while.

Re:More damaging for Apple than most think...

[Shados]

The vast majority of Windows infections also come from viruses that "must be installed". Not 100% obviously, but if you take out the ones that infected users months after patches were released, and the ones where users clicked through a UAC prompt to install anyway, you end up with a very very small sample.

Its all about social engineering now.

Re:More damaging for Apple than most think...

[Vokkyt]

The problem with this assessment is that it's the exact same assessment that OS X has been receiving for the past 6 years whenever a new Trojan pops up. And no, this trojan really isn't any different than its predecessors. I'm not trying to defend OS X as the almighty glorious Mac Master Race computer, but it's a little ridiculous to see this cycle every time an OS X Trojan pops up (and they've pretty much all been trojans -- IIRC, a few were classified as worms, but I really don't remember clearly):

1. Malware appears for OS X
2. AV companies advertise it wildly
3. Journalists/"Analysts" declare that age of Innocence for OS X is over, no longer "immune" to Malware
4. Message Board users declare the end of OS X/Catastrophic damage
5. Time passes and reality sets in -- the Malware/Trojan fails to reach any noticeable level of threat

Again, this isn't to say OS X is immune. Absolutely not. But every time a bit of Malware appears, this exact cycle happens -- and OS X and Apple's sales only go up.

Does the principle apply to Linux?

[G3ckoG33k]

Does the principle apply to Linux? If yes, then it matters, for nerds, for real. ;)

Re:Does the principle apply to Linux?

[0123456]

Does the principle apply to Linux? If yes, then it matters, for nerds, for real. ;)

If you download and run random programs on any OS I've used you're vulnerable to malware. You could partially mitigate it by mounting /home as noexec, and you could probably use SELinux to prevent users from running any applications from /home, but that's a pain.

Re:Does the principle apply to Linux?

[betterunixthanunix]

you could probably use SELinux to prevent users from running any applications from /home, but that's a pain.

How is that a pain? Have you ever tried it? In Fedora, it is a matter of setting an SELinux boolean (allow_user_exec_content) and setting the user as user_u. This is literally two things to click on in the SELinux GUI tool, or two commands to run in a terminal. This might annoy users who want to do things like write scripts, but if your goal is to defend against this kind of malware, then that is what you have to do.

Of course, most home users are unaware of noexec/SELinux and would need the family IT guy to do this for them.

Re:Does the principle apply to Linux?

[Lumpy]

Under linux you have to download it, turn on the execute bit and set the permissions and THEN execute it.
Nope no chance in hell that a user will fall for this under linux. if they launch random crap they will never be able to set it to execute.

Re:Does the principle apply to Linux?

[0123456]

How is that a pain?

If you're not using a Fedora-based OS then SELinux probably doesn't work, and any competent Unix user probably has a bunch of scripts in $HOME that they use to do random things; I certainly do. I could put them in /usr/local/bin instead but that's a pain in itself.

You also need to ensure that /tmp and /var/tmp are noexec, which Ubuntu, at least, seems to dislike. On the plus side, /tmp is normally a RAM disk so any malware installed there will vanish at the next reboot.

Re:Does the principle apply to Linux?

[0123456]

Under linux you have to download it, turn on the execute bit and set the permissions and THEN execute it.

"To install the Cute Kitty screensaver, download malware.sh, open a Terminal window and type 'bash malware.sh'."

Yeah, it's a pain, but more than a few people will do it in order to see cute kitties or b00b13s. The only way to stop them from doing it is to ensure they can't run anything that isn't in a system directory.

And, even then, they'll still install random Firefox plugins which don't require execute permission or root access.

Re:Does the principle apply to Linux?

[LoganDzwon]

A direct example would be more like a website can tell if your on debian/ubuntu or RHEL/fedora and sends you an .deb or .rpm. Then your browser see it is a package so it fires up your package manager for you.

Re:Does the principle apply to Linux?

[betterunixthanunix]

If you're not using a Fedora-based OS then SELinux probably doesn't work,

Well, there is also AppArmor, TrustedBSD, TrustedSolaris, etc. The real point here is that mandatory access control does not have to be a hard thing to use, especially if you are trying to do something common like prevent a particular user from executing programs in their home directory. I cannot comment much on how easy AppArmor/etc. are to use, since I have not actually used them.

You also need to ensure that /tmp and /var/tmp are noexec, which Ubuntu, at least, seems to dislike.

That screams "problem" to me, but theoretically an SELinux policy could be written to allow this for whatever specific program needs that privilege. I have tried a few lightweight things with SELinux, and there are quite a few surprises -- like the fact that Firefox tries to mark its stack as executable (seriously, in 2011, a web browser wants to execute code on its stack). Another option, which I have made use of, is the SELinux sandbox, which lets you confine an application so that it can get special permissions (like marking its stack as excecutable) without allowing it to affect other parts of the system (this also means that you cannot save files, unless you mount a special home directory just for the sandbox, which is allowed; the sandbox also allows you to set up the security context in a way that makes sense, e.g. Firefox should be able to access the web).

Re:Does the principle apply to Linux?

[FudRucker]

what if /home was in its own disk partition and mounted with a noexe parameter? i guess /tmp and /var would have to get the same treatment too...

Re:Does the principle apply to Linux?

[itsdapead]

Does the principle apply to Linux? If yes, then it matters, for nerds, for real. ;)

Here's how to find out:
$ cat > nasty.c
#include <stdio.h>
void main() { puts("Oh No! The sky is falling!\n"); }
$ gcc nasty.c
$ ./a.out

If your Linux prints "Oh No! The sky is falling!" then yes you have the OMG, my computer lets me run code in user mode! vulnerability. Remain calm - walk (don't run) to your local Apple store and buy an iPad, which is safely locked down so that you can't run any old code on it, even if you want to.

So what's it to be folks? Should the Holy Jobs lock down OS X like an iPad so that (unlike Windows or Linux) users can't run userspace code? Wasn't that exactly what we were slagging him off for (allegedly) planning last week? Anybody else know any brilliant way of stopping users clicking on the "Yes please I want to install and run this software that has just mysteriously popped up while I was browsing the web" button?

Re:Does the principle apply to Linux?

[Bill_the_Engineer]

$sh [insert script name here]

No execute bit needs to be set.

Need proof?

$vi test

#!/bin/bash
echo "This is a test"

:x

./test
bash: ./test: Permission denied

Looks promising. Now lets tell bash to run that script without setting the execute bit.

$sh test
This is a test

Yep, it executed.

Re:Does the principle apply to Linux?

[onefriedrice]

I don't know what the GP meant by calling noexec and SELinux a pain, but as a developer and "poweruser," I have legitimate reasons throughout the day for executing programs from /home. So, while it's clearly not a pain setting up noexec and SELinux, it is a pain just dealing with the result.

The said, as a savvy user, I'm also not dumb enough to run random programs off of the internet, so I don't lose sleep from being able to execute stuff from /home.

Re:Does the principle apply to Linux?

[dkleinsc]

Of course. Just pass around INSTALL instructions like this:

To install the nataliehotgrits package, open up the tarball, and run:
# ./configure --prefix=/home/dumbuser/ --include-stupid-stuff --disable-sanity-checks --disable-selinux &&
# make &&
# make PAY_TO_THE_ORDER_OF=badguys_in_russia AMOUNT=1000.00 check &&
# make install

Re:Does the principle apply to Linux?

[Kamiza Ikioi]

mod up parent

Re:Does the principle apply to Linux?

[kvvbassboy]

You don't even need to do this, at least in Linux Mint (and I am sure Ubuntu and all it's derivatives). Double-clicking on a shell script, gives you the option of either opening it as a text file, or running it in the terminal.

Re:Does the principle apply to Linux?

[BitZtream]

Personally, I was looking at it as a pain in the ass from a user perspective more so than a admin perspective.

noexec is a pain in the ass for your home dir as a user, and is only really useful if they have no way they can write to any location that isn't noexec, which is easy enough to do, but easy enough to miss someplace as well.

Re:Does the principle apply to Linux?

[betterunixthanunix]

Personally, I was looking at it as a pain in the ass from a user perspective more so than a admin perspective.

Only for those users who are adept enough to write their own scripts and programs; I would like to think that such users are not going to be downloading MacDefender.

noexec is a pain in the ass for your home dir as a user, and is only really useful if they have no way they can write to any location that isn't noexec, which is easy enough to do, but easy enough to miss someplace as well.

One nice thing about SELinux is that you can ensure that a user is unable to execute any file that they themselves created, or any file that another user at the same access level created. Combined with a policy that prevents users from executing programs that interpret scripts that could potentially modify the user's environment or write/modify files in their home directory (i.e. bash), or perhaps only allows such programs to be executed in a sandbox, you can mitigate quite a few PEBKAC-exploiting attacks.

Re:Does the principle apply to Linux?

[BitZtream]

Or the better way to run it ...

. ./test

Might as well affect the current environment as well!

This is the evolution of criminality

[hellfire]

The malware is evolving from taking advantage of bugs in Windows, to social engineering. I had malware scanning on my PC because malware could get in the back door via services and other areas. Now, they are installing it right in front of your face trying to masquerade as something else.

They are going from the thief in the night who exploits the bad lock in the back door, to walking in the front door acting like the delivery man and given the run of the building by unsuspecting human beings. They are no longer exploiting Windows or Mac OS X... they are exploiting the users directly and making it look like it's the OS's fault.

I've seen plenty of PCs pwned by this type of malware, and it wasn't Windows fault in those situations either, the user simple installed something that took over the system.

Re:This is the evolution of criminality

[JSBiff]

I think another point might be that the malware is evolving from doing things which might require system-wide admin privileges, to just doing things which require lower levels of access.

My first thought when I saw an article posted on Ars Technica yesterday, about this change in the malware, was, "But, wouldn't that mean the malware has to run at lower privilege levels"?

Then I realized that something running at "user" privilege levels instead of root, can still be bad. It could probably still keylog that particular user's credentials when going to websites and such. It could still send out spam emails as the user. It could still search through the user's personal files looking for anything "interesting" (or just uploading them en-masse to another 'owned' machine). It could still act as an online file repository for child porn, terrorists, organized crime, etc. It could act as a webserver for a phishing attack.

It could be used as part of a DDOS, or as part of a massive computation network (think something like World Community Grid for organized crime - to, e.g. brute force recover encryption keys for someone or some system the criminals are targetting).

Re:This is the evolution of criminality

[Aldenissin]

IMHO, it's always the user's fault, to a certain extent, if only because they chose an inept OS security wise. Or perhaps they didn't want to deal with the hassle of a "locked down" system. But that extent only extends past where the assholes who wrote the malware in the first place responsibilities end.

It's all a matter of convenience, but for me, security is king, for without that it isn't worth the risk to begin with.Mostly because we don't live in an ideal world. But with OS's like Windows wanting to hold users hands and set them up with bad user practices right out of the box just so they make another nickel, we've come along way in reinforcing that we don't really need to get serious about security. And that, is very sad.

If texting while driving is like driving drunk, then running windows is worse that either as far as "surfing" the net goes. I haven't once got malware in Gnu/LInux, and yet, users EXPECT it in windows to happen some time. I was happy with Windows 7, but I was stupid, I should have known better. My girlfriend still got something on it, and she is one of the more aware users.

Re:This is the evolution of criminality

[hellfire]

It's true that if you aren't part of the solution, you are part of the problem. However, fault is a spectrum and at one point it's more the human's fault than the software. Software is best at dealing with digital software issues, like an exposed area in the code that's not supposed to let someone in but lets someone in anyway. Relatively speaking that's primarily the software's fault for allowing that, and secondarily the user's fault for not researching how to secure their system better. And yet, exactly how much do you expect the average person to do when they are told in some way they need to have a computer to do work or access important information for their life online? Once someone starts installing stuff themselves into a computer that is malware, fault moves from the software to the user.

It crosses over into the human realm of responsibility when a computer is done precisely what it is asked to do, and it's the owner of the computer who is deceived into doing that. This type of malware is possible on Windows, Mac OS, or Linux, because it requires the user to take actions on the system and install it or run it. The operating system is doing exactly what it's told. If you run a car off a cliff while texting, it's not a functional problem with the car, the car did exactly what was told.

The next step is for apple user's to take a very small bite of humble pie. Mac OS is immune to viruses and most Malware, particularly the malware that requires back doors. Them. But no system is immune to malware that requires user actions to install, i.e. a Trojan Horse. And it looks like criminals are switching from the back door to the front door simply because the back door is getting so much harder to break into. And future defensive software is probably going to ramp up the detection of common Trojan horses, but that won't be as effective as the age old adage of never downloading something you don't trust.

Re:This is the evolution of criminality

[Rich0]

About the only thing a virus running as admin/root gets is the ability to infect other executables, or to affect something that happens on a different user account. The average win/mac/linux desktop has only one user account actually used on it anyway.

Oh, running as root/admin also lets the virus start on boot, instead of login. If you're infecting servers that don't have anybody logged in 99% of the time I guess that matters. If you're infecting desktops, how many people leave their PCs running but not logged in?

The whole OS security model needs to change to something more like what is done in Android or SELinux. That does require a lot of upstream/distro support or otherwise needs to be designed into the apps. Even android has its limitations - users can't easily modify an apps permissions so they're stuck with just the options of use or not use. Access needs to be more granular than the user account. Vim doesn't need to be able to open TCP sockets, and firefox doesn't need to be able to read my thunderbird contacts list or whatever. If apps were isolated in general then their ability to cause damage would be greatly limited.

Re:This is the evolution of criminality

[dristoph]

I would have to agree with this assessment. I would also say that people who are less likely to install frivolous things such as extra emoticons or extraneous toolbars from untrustworthy or potentially untrustworthy sources (ads, torrents, or sites requiring an installation for access) are pretty safe.

Adding to that, the Mac community's ecosystem for applications is relatively resistant to these kinds of things. For all the snobbishness surrounding ownership of a Mac, you also have high expectations for Mac applications; even simply the way they conform or deviate with Apple's Human Interface Guidelines actually impacts the success of a Mac application within the ecosystem. This trait makes Mac users in general more picky about what they install. Mac users usually find new software through their friends, positive reviews, or (now) the App Store. They are far less likely to find it through banner ads for free smileys or toolbars.

That's not to say that this won't/can't change. The Mac is also becoming more popular among amateur computer users, such as mom and grandma, as opposed to professionals who use their computer more like a tool than a toy. As this segment of the user base grows, there may well be a correlation with the number of actual Mac malware infections.

Re:This is the evolution of criminality

[Tim C]

I had malware scanning on my PC because malware could get in the back door via services and other areas. Now, they are installing it right in front of your face trying to masquerade as something else.

That started at least a decade ago. Dressing your malware up as something the user wants is hardly new.

Re:Market Share

[betterunixthanunix]

It depends on who is using the computer. GNU/Linux has many millions of desktop users, but it would be pretty hard to convince most of those people to run some random program they downloaded from some website. Mac OS X's userbase, on the other hand, is composed mainly of people who are not knowledgeable about computers and who wanted something that was "easier" or "more user friendly" than Windows (cue the comments from technically adept people who happen to like Mac OS X), and may more easily fall victim to social engineering.

Of course, desktop GNU/Linux use is expanding to more people who are not so technically inclined, so this may change over the next few years.

That will be the most interesting aspect

[SuperKendall]

I'm really curious just what Apple will do in a patch to prevent this. You could of course recognize one variant, but you can't easily find an infinite number of variations... especially when there's so little difference between a trojan and some application that is meant to be downloaded and run.

The funny thing is currently the absolute safest recommendation you can make to a Mac user to keep them safe is to NOT install any anti-virus software.

Re:That will be the most interesting aspect

[Bryan3000000]

Nothing prevents Apple from implementing heuristics in their already-implemented security structure. Even a heuristic based on the signature of this one variant would likely be effective against many or most possible variants.

Good News for the App Store

[vwjeff]

This just gives Apple one more reason to force all application installs via the app store in future versions of the OS. The other reason of course is money.

Re:Good News for the App Store

[CharlyFoxtrot]

It'll never happen. A lot more mac users are power users than the stereotypes suggest and these people just wouldn't accept it. At most they could go with an opt-out system. Otherwise I think app-stores are more of a positive evolution than people give them credit for, when they are not shoved down your throat that is. The signing of software to guarantee that it hasn't been modified or tampered with is a no-brainer, a bit like having shrink-wrap around a box-set of physical media.

Re:Good News for the App Store

[angel'o'sphere]

Then they would lose a good deal of their user base.

Unlike popular believe lots of Mac users are actually geeks working in the software industries.

Unless Eclipse, Tomcat, the Spring Framework etc. etc. is all available via an Appstore: FOR FREE ... such a move would be a very bad idea.

angel'o'sphere

Re:Good News for the App Store

[elrous0]

They already accept it on their iPhones and iPads, not that much of a leap for them there. And even if a few power users rejected it, that's not the audience that Apple would be targeting anyway. There would be a HUGE demand for such a secure computer amongst the general public (especially as malware and identity theft have become more and more common). They would probably start by offering a specific line of PCs with this as a "feature" (and/or offering it as an option on all their PC's at purchase), and eventually make it the default. It would actually be a very smart move (from a business perspective)

Re:Good News for the App Store

[CharlyFoxtrot]

They already accept it on their iPhones and iPads, not that much of a leap for them there. And even if a few power users rejected it, that's not the audience that Apple would be targeting anyway.

The slippery slope argument, eh ? As an iPhone/iPad user and power user I sure as hell wouldn't want such a system on my mac unless, as I said, I could opt out. Also as I have previously stated there are a LOT of mac power users, don't fall for stereotypes. As for Apple not targeting them, I suggest you take a hard look at OSX, especially tools like Automator, Services, system-wide scripting with Applescript, the myriad of developer tools and command line utilities OSX ships with, etc., etc. For people who supposedly don't like power users they spend a lot of their effort developing their OS in ways to please them.

There would be a HUGE demand for such a secure computer amongst the general public (especially as malware and identity theft have become more and more common). They would probably start by offering a specific line of PCs with this as a "feature" (and/or offering it as an option on all their PC's at purchase), and eventually make it the default. It would actually be a very smart move (from a business perspective)

They don't such a PC, they have the iPad to fill that niche and there is a huge demand for it. For people who need a physical keyboard there's the iPad keyboard dock and a dongle to import photographs from a digital camera. You are coming at this problem from the geek perspective assuming people want a so-called "full computer" (i.e. traditional screen+box+keyboard setup), they don't they just want access to some functionality which the iPad provides in an attractive, secure, easy to use package.

Re:Good News for the App Store

[MaWeiTao]

I've worked in the design industry for well over a decade now. Nearly everyone I've worked with is a Mac user, and a die hard at that. Nearly every last one of them was not the kind of power user you imagine they are, although a good number of them did fancy themselves to be one. I think this is reflected online where the perennial solution to every last problem is the utterly ineffective "delete your preferences".

The ones I currently work with continue to consider themselves immune malware.

Re:Good News for the App Store

[CharlyFoxtrot]

I probably have a different perspective since I work as a unix sysadmin and so most mac heads work with either came to mac because it's an easy to use unix system or have been computer geeks their entire life and started on Apple computers. There's a lot of these people out there though, like I said a lot more than I think people give credit for. And OSX generously caters to geeks.

Re:Good News for the App Store

[Raenex]

As an iPhone/iPad user and power user I sure as hell wouldn't want such a system on my mac unless, as I said, I could opt out.

Why do you accept it on your iPad, then? Or even your iPhone for that matter? The "it's a phone" excuse doesn't work for the iPad, and even that excuse is poor for today's smart phones.

For people who supposedly don't like power users they spend a lot of their effort developing their OS in ways to please them.

They'll follow the money. Don't bet they won't sacrifice the existing power user base to follow the trend.

They don't such a PC, they have the iPad to fill that niche and there is a huge demand for it. For people who need a physical keyboard there's the iPad keyboard dock and a dongle to import photographs from a digital camera.

Which just supports the parent's argument. It wouldn't be surprising if the desktop was just phased into the iPad at some point.

Re:Good News for the App Store

[CharlyFoxtrot]

Why do you accept it on your iPad, then? Or even your iPhone for that matter? The "it's a phone" excuse doesn't work for the iPad, and even that excuse is poor for today's smart phones.

It seems "right" for the platform. I don't want to surf around, downloading apps and generally cluttering up the place (like I do on my mac.) Encapsulating available apps in a centralized repository accessed through an app itself seems natural. It also reduces initial fears or inhibitions inexperienced users have about installing software and encourages paying (though relatively low amounts) for software. Yes, I would probably be in favor of competing stores having access to the device just on principle, though the quality of apps in the Cydia (jailbreak) store isn't really encouraging. Overall the system works, for iOS - I don't see it working for the mac.

They'll follow the money. Don't bet they won't sacrifice the existing power user base to follow the trend.

Maybe, it might also be partly the culture that carried over from NeXT though it would be anyone's guess if that would survive a focus shift inside the company. That's not for the near future though.

Which just supports the parent's argument. It wouldn't be surprising if the desktop was just phased into the iPad at some point.

No, the only danger I see is if the bottom falls out of the computer market because too many people switch to iOS devices or similar. But again, this isn't for the near future: Apple hasn't even got cloud syncing yet which they NEED to abandon their current model of the computer as media hub from which all personal portable devices are synced. Personally I could see a future where the pc loses emphasis in favor of iPad like devices that'll be used for most, but not all, tasks but it'll never completely go away and neither will the mac.

Re:Good News for the App Store

[mjwx]

It'll never happen. A lot more mac users are designers and hipsters, just like than the stereotypes suggest and these people just would just accept it.

There, fixed that for you.

I hardly ever see a Mac in the hands of someone who understands how computers work. They aren't marketed towards power users who understand what they are buying.

Now marketing and design people, you'll be hard pressed to find one without a Mac.

What you need to remember is that you, as a Mac User are not indicative of the general Mac using population. Most people buy one because they are not computer savvy and don't want to figure out how to use one. The marketing is geared towards these type of people and just like with the Iphone, they'll roll over and take any restriction because Jobs tells them its good.

I've worked as a net admin for 4 years, I also worked as tech support for 3 before that. Part of my duties was looking after a design and marketing subsidiary and inhouse dev team, none of the admins or developers had Macs, they were running Windows or dual booting with Linux (OK, one of the JEEE guys was running Solaris only). Only the designers were Mac users, I think you're projecting the world you'd like to live in onto the world we actually live in.

Re:Good News for the App Store

[CharlyFoxtrot]

It'll never happen. A lot more mac users are designers and hipsters, just like than the stereotypes suggest and these people just would just accept it.

Your willingness to pre-judge people on something as random as what type of computer they prefer is striking. Macs, like PC's are used by a broad variety of people (slightly skewed towards the more educated because macs are targeted towards the mid and high end of the market.)

I've worked as a net admin for 4 years, I also worked as tech support for 3 before that. Part of my duties was looking after a design and marketing subsidiary and inhouse dev team, none of the admins or developers had Macs, they were running Windows or dual booting with Linux (OK, one of the JEEE guys was running Solaris only). Only the designers were Mac users, I think you're projecting the world you'd like to live in onto the world we actually live in.

So my anecdotal evidence clashes with your anecdotal evidence. Let's go slightly more fact-based. This survey says 'Mac users are 21 percent more likely to believe they are 'computer-savvy gearheads.'" So there you go, mac users are likely to describe themselves as power users. This is your cue to bite back with a sarcastic remark about self delusional hipsters.

Re:Good News for the App Store

[mjwx]

Your willingness to pre-judge people on something as random as what type of computer they prefer is striking

You're comprehension is less then stellar.

I commented on the people I've observed, sorry that reality is different to what you perceive.

This survey says 'Mac users are 21 percent more likely to believe they are 'computer-savvy gearheads.'"

I've boded the key word, the infographic proves nothing, it doesn't even pretend to. Dunning-Kruger is sufficient evidence against that.

Of course they believe it, they need to justify why they paid twice as much for a white Dell. The question is can their self evaluation be considered accurate, given the fact they don't beleive that Mac's use the same components and manufacturing process as Dell indicates that the Dunning-Kruger effect is alive and well with Mac Users.

All you've managed to demonstrate is that you're not very good at finding proof and possibly quite gullible. "Fact-based" indeed, you cant even tell the difference between a causal survey and proper research (CLUE BY FOUR, real research does not use the word "believe"). Especially when you don't have access to the raw data and methodology.

Re:Good News for the App Store

[CharlyFoxtrot]

All you've managed to demonstrate is that you're not very good at finding proof and possibly quite gullible. "Fact-based" indeed, you cant even tell the difference between a causal survey and proper research (CLUE BY FOUR, real research does not use the word "believe"). Especially when you don't have access to the raw data and methodology.

I said a little more factual and while not proper research it's at least better than to argue purely based on opinion as you are doing, as shown by more broad statements about what mac users supposedly believe above. Are you psychic ? Because then Mr. Randi has a prize for you. Anyway the argument seems to be descending into ad-hominem so I'll take my "clue by four" from your sig.

It still requires the user to click through

[Shivetya]

You are still required to click through an install wizard, so this is in no shape or form an install performed without the user.

Re:It still requires the user to click through

[robmv]

is that OS X install wizard build by the OS?, or is it an executable coded by the malware author? if the answer is true to the last question, why is needed to continue the install wizard?, the malware author can add code before opening it to install anything they want even if you press cancel

The problem is Safari setting to open "safe" files automatically, that is the most dumb thing a browser can do

Re:It still requires the user to click through

[jimicus]

It's produced by the OS; a Mac OS package is analogous to an .rpm or a .deb. So it's trivial to stop it installing - hit cancel before it does anything.

But... the package doesn't appear out of nowhere. What happens is you visit a site that downloads it, the site flashes up a very impressive looking virus warning page which pretends to be scanning a bunch of things, find all sorts of malware and flashes up a warning saying "Your system is infected! You must install our package!".

Now to you and me, that'd be a red flag immediately. But this thing is playing the same numbers game as all the other social engineering malware - it doesn't matter if 80, 90 or even 99% of people don't let it run. With just 1%, you still get an impressive number of installs pretty quickly.

I bet if you put 10 laypersons in a room with 10 Macs - people with no specific IT knowledge and nobody to call on to ask "is this okay?" - told them to surf the web and then engineered it so they'd hit this sooner rather than later - within the hour you'd have at least one system infected. Probably many more.

But, but...

[Moraelin]

But... but... weren't we all told that this isn't possible? I'm sure I've heard the rhetoric repeatedly before that if someone didn't bother porting some malware to Mac or Mozilla back when they had tiny market share, then it's some kind of proof that they're secure and it can't be done.

So uh...

[bmo]

Where, exactly, is this going to hide from htop, top, ps or any other process listing facility?

Unlike Windows, OSX and Linux and every other sane OS in the universe, there is no such thing as a "hidden process."

As a user process, it also cannot patch top, ps, or htop, or any other process lister. It cannot fuck with logs. It cannot do anything at all that the ordinary user cannot do. Indeed it runs under the same UID as the logged in user.

ps -uax | grep $USER
OH HEY GUYS THAT LOOKS WEIRD
killall -9 $SUSPICIOUS PROGRAM
rm $PATHTOSUSPICIOUSPROGRAM/SUSPICIOUSPROGRAM

And not even have to have a # in your prompt. No sudo, no su, no nothing.

Go on with life

Wow. That's...difficult.

--
BMO

Re:So uh...

[robmv]

With tricks like this Howto change a UNIX process and child process name by modifying argv[0]

For example sendmail change it to this "sendmail: accepting connections"

Re:So uh...

[robmv]

oops I forgot, when the malware is installed, it can just change all your init session scripts, prepend a directory to your PATH, install new versions of ps, top, htop, kill,.... not impossible to detect, but it can hide itself a little more that simple running ps and kill

Re:So uh...

[Arrepiadd]

Yes, I can clearly see my mom running that on her laptop...

This is a problem for the random user, not for the geeks who know what ps, grep and piping are used for.

Re:So uh...

[drinkypoo]

Unlike Windows, OSX and Linux and every other sane OS in the universe, there is no such thing as a "hidden process."

There are no hidden processes in Windows, only those which the task manager will not display. Get process explorer, it's free.

Re:So uh...

[bmo]

From your linkypoo:

>There is a catch, which is that "ps" and "top" can show you either the "command line" or the "program name", and we can only modify the command line.

So no, you still can't hide it.

--
BMO

Re:So uh...

[bmo]

which (1) will show you all versions of a program and their location if they exist in your path.

You can get also around programs put in ~/bin/ by typing the absolute paths to top, ps, etc, or just fixing your PATH environment variable.

There's a reason why malware writers, all things being equal, prefer root access. You can make anything appear as anything and patch right down at the kernel level.

Not addressed at you, just in general:

I noticed all the anonymous cowards in this thread shouting "but grandma is never going to type that!!!! HURR!!!!"

Grandma doesn't even know that malwarebytes and other tools even exist for Windows. Grandma is going to have you come over for cookies and milk while you do it for her anyway. Stop being such stupid disingenuous shits.

At least with this, if you are across the country, you can do it remotely through ssh.

--
BMO

Re:So uh...

[robmv]

Replace which, I am not saying that it is impossible to detect, I am just saying that simply checking ps and killing is not enough. I am the kind of person that think if a machine has indications of malware, it must be cleaned by reinstalling everything starting with the OS

Re:So uh...

[robmv]

Apparently there are other ways to do it with prctl on Linux and other APIs on OS X

Re:So uh...

[bmo]

It's not running as root.

It doesn't have the ability to replace which. All anyone can do at user-level is install shit in places that the user has access to - in this case, not overwriting, but altering the path to point at the "new" versions in ~/bin/ or wherever.

It's not friggin' magic. We're not talking of Ken Thompson levels of deviousness here.

>nuke and pave everything

Yes, i have that page from technet too.

Yes, but we are talking about user level shenanigans. User level shit is ridiculously easy to get rid of. Give the user a new set of .rc scripts after removal of the offending program and you're good to go.

Stuff installed with root permission? Yeah, nuke and pave.

--
BMO

Re:So uh...

[drinkypoo]

It's for the same reason that every system attempts to hide complexity from the user. Auto companies don't put detailed diagnostic information on your dashboard because it would confuse the average user and doing so takes up real estate and costs money. But even before OBD-II mandated a malfunction indicator light (or "MIL") to inform the driver when emissions are over mandated limits, automakers were implementing "Check Engine" lights, to say nothing of providing oil pressure and other gauges from which the typical user can learn nothing unless they fail to operate at all. When you take your vehicle to the dealer for service, they will do the same thing you do to begin the diagnosis, but then they'll connect a diagnostic machine to get a deeper view of the problem if it is not immediately apparent to them. Task Manager is much the same. Microsoft wants to be able to tell you to kill certain processes over the phone. If they need deeper diagnostic information they will have you running some other utility, or they will connect to your system remotely and perform the action themselves.

Re:So uh...

[bmo]

And Windows enthusiasts say that "OSX is dumbed down"

Man, I don't know what to say after reading what you wrote. I'm just speechless.

--
BMO

Re:So uh...

[drinkypoo]

Uh, if you think OSX is any different, you're delusional at best. And I'm not a Windows enthusiast, I'm an agnostic realist.

Re:So uh...

[bmo]

It's inconsistent. What works in ps doesn't work in top. It says so right in the thread.

I'm done arguing here. It's a userspace thing. At worst, you have to nuke ~/bin/, chmod -x -R everything else in /home/$USER and give the user default .rc files if you don't feel like going through them manually.

For someone who knows what he's doing, no longer than 10 minutes.

Re:So uh...

[bmo]

So you're flat out stating that ps, prctl, and all the other tools that /come with/ OSX are just as crippled as taskman.exe?

And you call me delusional? When this shit is /required/ for OSX to keep its Unix certification?

*whistle*

--
BMO

Re:So uh...

[benjymouse]

So here's the question:

Why won't task manager show hidden processes?

Why do I have to rely on a third party (Sysinternals) now bought by Microsoft, just so I have the ability to see these things?

What are you talking about? Task manager shows the same processes as process explorer. Did you miss the "show processes for all users" button?

Re:So uh...

[Em Adespoton]

Why, exactly, would it WANT to hide from htop, top, ps or any other process listing facility?

It's sole purpose is to scare the user into providing the crooks with their credit card info. They don't CARE whether you kill the process or not. If you know enough to ps axc -> kill then you're probably not going to fall for this in the first place (note the probably -- everyone has bad days).

As a matter of fact, Apple's KB article for the old version tells people to launch Activity Monitor and use it to quit the process. This worked on the version with admin access.

Re:So uh...

[Rich0]

I know exactly what ps, grep, and kill do. I can't remember the last time I did a ps -eal and just paged through the list of processes running on my machine. If it rose to the top on atop and didn't have an innocent-looking name then maybe I'd get suspicious.

If the virus just piped instructions into bash or whatever it would run under the process name bash. How likely is somebody to notice an extra bash running or whatever as long as it doesn't consume an ungodly amount of resources?

Now, not running as root would make a process easy prey for rkhunter and things like that - assuming the user runs them.

We need to get away from enumerating badness and simply define SELinux policies for apps or whatever.

Re:So uh...

[BitZtream]

Much like in windows, you get a hidden process in UNIX by using a kernel extension.

None of them do it by default. They are all the same in this aspect. I assure you that its trivial to hide processes the instant you have a kernel module loaded, which is how it happens on Windows.

As for patching apps, again, you're wrong. You can modify any process you own in Linux (Without something MAC support, you know, the default for pretty much everyone), and in OS X and in Windows. Do you have any idea how GDB works? Of course not, or you wouldn't be saying what you're saying.

A normal Windows user is unable to fuck with logs just like a normal OSX or Linux user, if they don't have permission they don't have permission. If they login as an admin, all bets are off, regardless of the OS.

As for your killall -9 suspecious program ... the first thing my malware would do is reset its process name to something that was a known long running process and already running on the system ... initd, httpd, sendmail, shrug, pick something. Takes one line of code to change the way the app appears in top, try again.

Its cute that you think you know how OSX and Linux are 'better' than Windows, but the reality of it is, the things you pointed out they all do EXACTLY THE SAME, so if you're going to be an OSX Fanboy or a Linux Zealot, you might want to get a clue before you spew your ignorance.

Yours truely,
An educated OSX Fanboy

Re:So uh...

[drinkypoo]

Does it really matter if it comes on the DVD or if you get a CD and you have to download the other tools? You actually get them from the vendor now, and before that they were free and freely available. Microsoft also has an extensive knowledge base online dating back to DOS 5, while I have personally watched an article which casts Apple in a bad light disappear from their knowledge base. Unless, of course, it has mystically reappeared since; can you find the article on data corruption on the B&W G3 Macintosh computer? It's easy to find references on XLR8 and LowEndMac about the issue and the article in the TIL which failed to make it into the KB though both older and newer articles made it.

Just to be clear, I think that both Apple and Microsoft are basically evil, only in slightly different ways. Apple tries to hide the details of the OS from the casual user just as surely as Microsoft. This is essentially desirable behavior.

Re:So uh...

[BitZtream]

Yea, except ... very few people actually know that, and it doesn't show command line by default on any install I'm aware of.

Re:So uh...

[BitZtream]

Every thing you pointed out to 'detect' the problem can be overcome by setting LD_PRELOAD in those init scripts to use a specially modified replacement for system libraries to cloak itself. No need at all to replace system binaries, just replace the libraries they use so they aren't ever even aware of the changes.

Which won't be useful when the information IT gets back from its own library routines is a lie.

Re:So uh...

[BitZtream]

She'd probably use Activity Monitor instead, unless you need something top or ps specific (which you wouldn't for this purpose) theres no reason to use top over Activity Monitor when looking for processes. Your mom could easily run Activity Monitor from the Applications/Utilities directory.

Of course, more along the lines of your point ... she probably wouldn't know what to do after she ran Activity Monitor ... or even that she should.

Re:So uh...

[BitZtream]

Reality:

You can see the same thing in task manager if you execute it as the SYSTEM user. Remember, on Windows, you are NEVER EVER root, you might be an 'admin' but you aren't root. SYSTEM on the other hand is, and its the only account that is truely unrestricted. Every other account has various restrictions on it, regardless of what groups you put it in or what extra flags you set on it.

Processes can be hidden from BOTH using a kernel extension, which is what ACTUALLY happens now days.

Re:So uh...

[bmo]

But this is all normal-user-privilege stuff.

Replacing with default .rc files is going to nuke any and all such settings, including path and ld_preload and whatever else you can find. That's what I'm trying to point out here. Shit with joe-user permissions is not going to be writing /usr/lib any more than writing /bin. Once the user's config files are restored, they will no longer point at the bogus libraries in ~/lib/ or /tmp or wherever.

At the level of joe user, you can stomp on all of this all day long and kill it dead if it never gets elevated. But once this escapes to root permissions, all bets are off and the only thing left to do is nuke and pave.

--
BMO

Re:So uh...

[cbhacking]

Better yet: install a new version of sudo (and su, and whatever programs are used for elevation). The new version *looks* like the real one, but doesn't actually do any elevation itself. Instead, it logs the password you enter, then passes that password to the real program. As soon as the real program accepts it, the malicious version calls `sudo install-root-malware-and-hide-infection` and passes in the password it just captured (actually, the last step might not even be needed since sudo probably cached your credentials for a few minutes).

Your window of opportunity to find the malware is only from the initial install of the (user-only) malware, to the next time you have to do anything as root. After that, you're completely pwned.

Only your own folder? Still...

[lpp]

That seems like it's not really any protection at all. Most Macs are likely single user setups anyway. Sometimes, sure, you'll have some other users on the machine, but most of them are likely just tied to one user.

To that one user, their files are the critical component of the machine. If they bought the machine, they have the reinstall discs for the OS, plus those of any upgrades. Annoying? You betcha. But if they haven't been backing up their files (shame on them) then having to reinstall the OS is the LEAST of their worries.

And this of course goes for Windows and Linux installs as well. And really, even in a multi-user/single-machine scenario, while the damage is limited, it is still potentially devastating for the user involved. And again, for many (most?) installs, there's only one user that matters anyway.

Re:Only your own folder? Still...

[BitZtream]

Reinstalling the OS isn't even needed if they are using Time Machine for backups, you can just roll the whole machine back to preinfection.

Its too bad getting time machine working requires some extra piece of Apple hardware, all the silly hacks to get it to work on a samba share are for all intents and purposes, worthless.

Re:Only your own folder? Still...

[tm2b]

Time Machine backs up just fine to any local (non Apple) external hard drive (I suppose internal, too, if you have multiple internal drives). No extra Apple hardware required.

It didn't evolve.

[Anonymous Coward]

The new version was simply designed more intelligently.

NB

[itsdapead]

PS: I know I shouldn't have put "void" in front of "main" but its 15 years since I wrote any serious C, and malware is supposed to be badly-written, isn't it?

Re:There's a difference...

[hairyfeet]

Oh you're so right, why they can even get to the DOS underpinnings that way! Oh, wait a tick, that hasn't been true for nearly FIVE years now since on Vista and 7 both run IE under low rights mode something even Linux doesn't have. Last time I checked Linux ran the browser with the same rights as the user that launched it whereas both IE and Chromium based (like the Comodo Dragon I'm typing on now) run as LOW rights, with the Dragon and other chromiums going one more step further and sandboxing (and if you are running the excellent Avast free you can have a "Yo Dawg" moment as it sandboxes too) the browser.

So unless you want us to start talking about how Linux is only up to version 2 of the kernel and doesn't support SATA yet you might want to stick with the facts, kay? If someone chooses to run a decade old OS, even if MSFT is nice enough to still offer security patches, that still isn't gonna make it safe for the modern web, anymore than digging out some 10 year old Debian discs would make for a very secure web server.

As for TFA, what was it I said to the Mac troll that swore up and down it wasn't a bug (he insisted on correcting everyone with a nice blame the victim "its a trojan!" meme) and insisted It didn't have anything to do with his excellent OS, just stupid users? oh yeah I said "the blood is in the water, now the wolves will come because they have seen that many Macs are like sheep ready for the slaughter" and guess what? I was right! Apple has gotten by with "security by obscurity" for so long that practically NO sally average Mac user follows safe practices, nobody on the Apple side runs AV or antimalware, so here come the sharks.

Which only makes sense, because despite all the "poo poo, Macs aren't toys for the rich, poo poo" studies have shown that not only do mac owners have multiple Macs, they on average pull down $100,000 a year. Wow. Who do you think has a juicier CC? The guy making $100k a year pisslefarting on his Mac? Or Becky the Wally world checkout girl who just got that $400 Dell out of lay-away? I know who I would be going after, and it sure wouldn't be Becky. Windows will be the target for botnets, and Macs will be the targets of those wanting them CC digits.

Mark my words: Now that they have seen how well they can spread the blood IS in the water, now the sharks will come. like any other predator the wolves looking to steal CCs, be it by ransomware or scareware or simply snatching the digits, they will look at Macs like a hungry wolf looks at a nice T-Bone steak. If it is any consolation Mac guys, I have a feeling Android may be the "mass market" product the bones the Linux guys, so at least you won't be alone. As a windows builder allow me to say...Welcome! The "how not to get pwned" workshop is on Thrusdays, coffee and donuts are in the back. Welcome to the club fellas, hey at least that means you're popular now, right?

Re:There's a difference...

[sqlrob]

Linuxes mode is even more powerful than Windows. It's just not commonly used because it's a pain to manage.

You're spelling it wrong

[Jennifer3000]

MAC (stop yelling!) is a brand of cosmetics. I believe you mean "Mac", which is short for Macintosh, a brand of computer manufactured by Apple, Inc.

Re:There's a difference...

[sqlrob]

There's a glaring flaw in your reasoning.

Malware authors don't want to wreck your system. They want to get value out of your system. That doesn't need root.

Re:There's a difference...

[spongman]

this would only happen if there's an unpatched privilege escalation vulnerability on the system you're using.

i'm not sure why windows/mac/linux would be any different in this regard.

Not worried

[pianophile]

I'd take these new "malware" scares seriously if I ever, ever encountered one on my Mac in real life, or knew anyone that had. I hear lots of haters, lots of hearsay, but not much else.

Re:Not worried

[BitZtream]

In 15 or so years, I've had one Windows virus ... and I STILL act the same way ... I recognize the fact that I need to be vigilent otherwise I'll know the pain that is Windows virus hell because I started downloading random stupid shit off the Internet.

By the time you start taking it seriously, it'll be too late for you to save yourself.

I treat my mac just like a windows machine, I'll be safe while you're trying to figure out how to uninstall something you clicked on because 'there are no mac malwares'

Your way of handling this situation is extremely ignorant and is EXACTLY why OSX will get beat to all hell and back when they start focusing on it.

I remember the time ... on slashdot ... that no one would have made such an obviously ignorant statement. Some other news site with random joe schmoze of the street ... sure ... but here, you're supposed to have a clue by virtue of the site itself. Now they we're at what ... 2 million accounts? ... I'd bet 1.9 million of them are idiots :(

But what is the heuristic?

[SuperKendall]

Even a heuristic based on the signature of this one variant would likely be effective against many or most possible variants.

Based on what it does though, I don't really see a clear heuristic you can apply.

At the heart of things, it's basically an app that opens web pages. Lots of apps do similar things, I don't see how you can implement a heuristic that would trigger false positives.

It seems like the only approach they can take is looking for specific code signatures, a tactic which works but is also easily worked around as the code changes.

Seriously....

[DJ Particle]

Still. Not. A. Worm.

</ysac>

Yawn.

Even for enterprise users

[Sycraft-fu]

The "BUT IT DOESN'T INFECT THE SYSTEM!" screaming is just a geek defense mechanism that shows ignorance of how computers are actually used. Nobody at work gives a shit about the system. They don't care about the OS, the applications. They've learned that we, the IT people, can get that all back and running quickly. None of it matters to them.

What matters is their data. That is what they want, what they worry about. From the important, like actual work, to the trivial like bookmarks and backgrounds, that is what they want us to save when a computer has a problem. It is of no comfort to them that "The malware only infected your account," because their account is what matters to them.

Also in terms of real damage it also doesn't matter. Even if malware infects a system so bad there is no possible removal, who cares? I can rebuild a system from scratch no problem. However if malware gets in and steals passwords, credit card data, SSNs, then it doesn't matter if it just had access to one account, real damage is done.

Isolation to an account doesn't matter and the malware authors have figured this out.

Malware - Validware

[jscotta44]

Wow, the anti-Apple sharks are in the water biting at everything. Question. How do you tell that a piece of software asking for an in-app purchase is malware/crapware/just bad software? How does anti-virus software prevent that from happening?

I ask, because, as I understand it, this Mac Defender malware starts an installer that requires user interaction to go through a series of steps (no Admin level stuff) to actually install the software. Once the user has completed the steps, it then goes through another series of steps to try to convince the user that they need to purchase the license.

Okay, how is this much different than a legitimate piece of trialware? Yes, we happen to know this group will use that credit information for nefarious purposes. But how is anti-malare supposed to discriminate between legitimate and non-legitimate software? How do you protect the user from being ill-informed or just plain stupid?

Infinite Loop

[RichM]

So, when are the bad guys going to invent the "Mac Guard Cleaner" tool?

Re:There's a difference...

[jbengt]

despite all the "poo poo, Macs aren't toys for the rich, poo poo" studies have shown [mashable.com] that not only do mac owners have multiple Macs, they on average pull down $100,000 a year.

TFA you linked to did not say what the average income of Mac owners is.

Re:There's a difference...

[mrwolf007]

Oh, wait a tick, that hasn't been true for nearly FIVE years now since on Vista and 7 both run IE under low rights mode something even Linux doesn't have.

sudo -u $browseruser /usr/bin/firefox
Just create a seperate user for browsing if you dont want the browser messing around with your files. Sure, requires configuring sudoers, but not exactly rocket science.

Re:Market Share

[BitZtream]

Right Linux users never grab stuff from random repositories ... they always use the ones built in with the OS install and never add their own.

As far as the Mac userbase being like Windows ... well, you do realize that anyone who isn't just a 'Linux Zealot' and actually just likes UNIX in general pretty much loves OSX because its UNIX WITH a pretty GUI and apps that weren't designed by high school kids with no ability to focus or consider the people they are 'developing the software for'

I don't think you could possibly be more wrong about the user base. Before OSX you would probably be right, but after OSX was released, pretty much every UNIX lover on the planet got a boner over it, myself included. Most people that rant on about OSX for various reasons are typically Linux Zealots. This isn't a troll, I don't mean Linux users are jealous, most don't give a shit. The wants that rant and rave and make stupid statements like yourself however, are most certainly nothing more than ignorant zealots 9 times out of 10.

OSX Users may be less computer literate because they don't have to be UNIX admins to make the OS work, but many UNIX admins love it. On the other hand, you aren't running Linux unless your a geek or the fact that its Linux is completely hidden from you (Like in say, a TiVo or router or something). No non-geek has ever went out and looked for how to use Linux, certainly unlikely any non-geek installed it without a geek to guide them through the process.

Your zealotry has you completely out of touch with reality.

Re:There's a difference...

[RightSaidFred99]

Yeah, someone's never seen 'sudo' in use. You don't always need your "special" password (which is 90% of the time the same anyway for home users).

Smug comment from Dr. Seuss

[erroneus]

Then they yelled at the ones who had stars at the start,
&ldquo;We&rsquo;re still the best Sneetches and they are the worst.
But now, how in the world will we know&rdquo;, they all frowned,
&ldquo;If which kind is what, or the other way round?&rdquo;

Then up came McBean with a very sly wink.
And he said, &ldquo;Things are not quite as bad as you think.
So you don&rsquo;t know who&rsquo;s who. That is perfectly true.
But come with me, friends. Do you know what I&rsquo;ll do?
I&rsquo;ll make you, again, the best Sneetches on the beaches.
And all it will cost you is ten dollars eaches.&rdquo;
----
I hope everyone knows this story and appreciates the relevance.

Re:Smug comment from Dr. Seuss

[IrrepressibleMonkey]

I'm assuming that Sophos is playing the role of Sylvester McMonkey McBean in this re-telling? The truth is that right now these Mac users would have been better off believing the "Mac is immune to viruses" myth. The fear of malware has made these users download and install malware to their Mac in an effort to protect themselves. Sophos is one of the companies that are aggressively marketing FUD on this issue. Frankly, their product is merely detecting and removing a competitor's product.

Re:There's a difference...

[beelsebob]

Wow, the anti-mac trolls out in force. Somehow your logic about being clever applies to OS X, but doesn't apply to the OS with the exact same security model.

Re:There's a difference...

[PreparationH67]

So unless you want us to start talking about how Linux is only up to version 2 of the kernel and doesn't support SATA yet you might want to stick with the facts, kay?

Are you retarded? If linux doesn't support SATA they how is my computer running right now?

Re:There's a difference...

[geminidomino]

You, uh... might want to reread that. The bit you quoted is in response to 5-year out of date ranting on the part of the GP.

You just got seriously whooshed, and there wasn't even a joke.

stupidity still required

[robogobo]

Like a total stranger walking up to your door and saying, "here eat this turd." Password or no, only the stupid will fall for this one.

Re:There's a difference...

[Wild_dog!]

"not only do mac owners have multiple Macs, they on average pull down $100,000 a year. Wow. Who do you think has a juicier CC? The guy making $100k a year pisslefarting on his Mac? Or Becky the Wally world checkout girl who just got that $400 Dell out of lay-away? I know who I would be going after, and it sure wouldn't be Becky. Windows will be the target for botnets, and Macs will be the targets of those wanting them CC digits."
--------------
Hmmm. I certainly don't fit this image. My last tax year I ran just north of 23K. I have 7 year old mac mini, a hackintosh dell mini 10v I picked up for $240, and a newer mac mini I recently got for $600 bucks.

I suppose you are right I do own multiple macs, but I don't think my credit card wold do a thief a whole lot of good.

Re:There's a difference...

[shutdown -p now]

Right, and now you can't save downloaded files to ~/incoming.

IE & Chrome process isolation is more than that - it does run the tab processes in a low-privilege sandbox, but it also provides them a very restricted API for limited, user-controlled access outside of that sandbox.

Re:Sour grapes or vinegar...

[BitZtream]

I'm a mac lover, and if you look up towards the top, I'm probably one of the first posts to say 'wait until the Windows guys come after OS X'.

Its just reality, these 'exploits' are user exploits, not true OS exploits. They are hacking the user, getting them to do something they shouldn't. If the OS stopped you (which it can) then you'd be ranting about how evil apple is for locking down the OS to the point of being a walled garden.

OSX WILL get bet the to hell and back if it keeps gaining popularity, hopefully Apple will have learned from whats happened to Windows and not suffer all the same issues along the way, which they clearly have done something better out of the gate, but not at all a perfect implementation as there have been plenty of exploits up to this point and they'll be plenty more for sure.

If Linux got popular, the same thing would happen to it. They stopped going after the OS, its FAR FAR FAR (insert 20 or so more FARs) easier to convince an ignorant user to do something they shouldn't than exploit the OS, even on Windows now days. Do people still hack the OSes? Sure. I used to crack games for people on IRC just for the challenge, and never play the game beyond verifying the crack. Its fun. Some people think causing massive amounts of extra work for other people on the Internet is fun, most of the time they grow out of that before high school ends though and put the script kit away. Very few people actually put work into exploiting the OS in order to get their malware spread, and those guys usually don't want to get noticed so they aren't doing stupid shit like 'buy our software' popups. They're just quietly using your machine to spam for profit.

Re:There's a difference...

[BasilBrush]

Which only makes sense, because despite all the "poo poo, Macs aren't toys for the rich, poo poo" studies have shown [mashable.com] that not only do mac owners have multiple Macs, they on average pull down $100,000 a year.

You're too stupid to understand that "âoeThirty-six percent of Apple computer owners reported household incomes greater than $100,000, compared to 21 percent of all consumers." does not mean that "they on average pull down $100,000 a year."

The rest of your post is even dumber. Knuckle draggingly dumb.

Re:There's a difference...

[geminidomino]

If saying someone "got whooshed" is "harsh," no wonder everyone's first reaction to getting their panties in a bunch is to run, sobbing, to mommy and demand that "being a big meanie" be declared a felony.

Re:There's a difference...

[webnut77]

Right, and now you can't save downloaded files to ~/incoming.

You obviously don't know how to use groups. On second though with an ID like yours you're obviously a troll.

Re:There's a difference...

[shutdown -p now]

You obviously missed the point. If the user under which the browser runs can save files to any folder at all - whether you set it up using groups or otherwise - then you're back to square one. Your browser can now download e.g. a bash script from the Net and run it - that's not a sandbox.

Furthermore, even if you do use groups like that - now you can only save to ~/incoming. What if I want to save to ~/docs also? Should I give the browser access to that as well? Oh, and I want ~/pics as well. But wait, now it can read all the files I actually care about. So much for sandboxing.

A proper sandbox does not give browser direct access to your home at all. It gives it an API which lets it access things in a controlled way - the sandboxed process can request that user selects a place to save a file (the corresponding dialog pops up outside the sandbox), and then the file is opened, and some form of handle to that file is provided to the sandbox. The sandbox thus has access to that particular file - which can be anywhere on the filesystem where the real user has proper permissions - but to that file alone, and as soon as the file is closed, the handle is invalidated, and any further file access has to go through the same process again. Thus, the user is always prompted to pick a file first, and nothing happens behind his back.

And what's wrong with my ID?

Re:There's a difference...

[webnut77]

Sorry. I took it that you were saying that you could not accomplish the ~/incoming thing using Linux. However your ID indicates you at least now how to shutdown Linux.

Re:There's a difference...

[shutdown -p now]

Actually, my ID indicates that I know how to shut down FreeBSD - Linux would be "shutdown -P now" (capital "P"). ~

the flood

[reiisi]

The flood started a long time ago.

Practically from the days of the yellow box and the blue box.

What we are seeing now is the shift from professionals to skript kiddies. That's why this is in the news. Skript kiddies don't know how to keep their heads down.

But the first wave of skript kiddies will pass. And Mac malware operating in the wild will still be, relative to the installed base, at least an order of magnitude less than MSWindows malware.

But how did we get here? Everyone has to compete with Microsoft, and the only way to do that is to do inherently unsafe junk. That's why I really don't like Microsoft. The push the vulnerable marketplace.

Re:the flood

[amicusNYCL]

What we are seeing now is the shift from professionals to skript kiddies.

I don't really agree. Yeah, definitely the kiddies are writing Mac malware, but the professionally-produced Mac vulnerability kit (kits?) is the real problem. There may be 1000 kiddies trying copy-and-paste vulnerabilities, but it's the handful of pros who also write Windows malware that Mac people need to be worried about, not the kids. Like we can see in this story, how the password is no longer required, the vulnerability and exploitation kits are going to continue to become more advanced the more they get developed. This is part of the reason why I think it's a bad idea for Apple to release a tool to disinfect this particular threat. I don't think Apple wants to get in the business, or create the expectation, that they will personally protect every machine. They should start educating people about proactive measures they can take for themselves (scanners and detectors), but that would go against a lot of their marketing BS. If they were really serious about keeping people safe, they would develop tools on par with Windows Defender, Microsoft Security Essentials, and the Malicious Software Removal Tool. Those things aren't perfect by a long shot, and it's been a long time coming, but at least Microsoft is making a serious effort in developing them.

Who is making this credit card harvester?

[reiisi]

It's not the real pros.

Yeah, it's something to worry about, but it's high-profile. The guys who really know their stuff don't do high-profile, and that's why we haven't seen this until now. They have definitely known about local execution for a long time, and there really is nothing special about this tool. Except that only a script kiddie would make something like it and release it to the wild.

This has been possible since well before Mac OS X 10.0, and I had to admit to myself by 10.3 that Apple, as a company, was not really interested in pre-emptive security measures. When they "switched" processors, I finally had to admit it myself that Steve was either not really seeing a whole lot more of the picture than Bill, or that the board of directors was insisting on going head-to-head with Microsof instead of trying to solve the real problems. (Probably both.)

Now, x86 has inherent security issues, and non of the current crop from INTEL (or AMD, et. al.) fix the real problems, but that's not what I'm talking about. (PPC and ARM have some of the same issues, and issues of their own.)

The attitude problem is visible in the execution of the switch, although it was also visible in the "secrecy" surrounding their maintaining the parallel code base until the switch.

A code base that includes multiple CPU architectures, the different the better, is an essential part of security.

But that has nothing to do with the current use of this feature (local execution) as a pseudo-vulnerability, other than as parallel evidence of the inability of large computer companies to face certain realities about computer security. (And as evidence that the kiddies are taking notice of the Mac, which means, yes, this will be used for capturing sudo passwords and making botnets as much as for stealing credit card numbers, which is why Apple's response is anything but satisfying.)

But, no, Microsoft's tools are not any sort of a solution. If anything, they just prolong the mess. And the way they use DRM only makes it that much harder to secure in any real sense. They use bits and pieces of some of the right tools to solve the wrong problems.

Red Hat is probably the best Linux distribution for this kind of stuff, but you have to shut off the stupid SELinux NSA-trap before you can start.

The best defense is to keep valuable stuff off your PCs. That being a kind of not-very-good solution, the next best option is to use multiple bank accounts and get the bank to put tight charge limits on the accounts that you use on the web, even they will try there best to talk you out of it, and may even refuse to set up the separate accounts for you, in which case you have to use more than one bank. (Actually, we all need to use more than one bank anyway.)

Hmm. This belongs in a blog entry, more than in this reply.