Slashdot Mirror
New Mac OS X Trojan Hides Inside PDFs
Trailrunner7 contributes this snippet from ThreatPost: "Malware that targets Mac OS X isn't anywhere near catching up to Windows-based malware in terms of volume and variety, but it seems that OS X malware may be adopting some of the more successful tactics that Windows viruses have been using to trick users. Researchers have come across a sample of an OS X-based Trojan that disguises itself as a PDF file, a technique that's been in favor among Windows malware authors for several years now."
Macs don't have viruses O__________O
Article is shallow: users click executables disguised with a PDF icon.. Nothing to see here, move along folks!
Macs don't get viruses. The Genius Bar guy told me this yesterday...
What is it with Apple OS and exploits in PDF?
Is the kernel written by Adobe?
Must every story about Mac malware spend more time talking about how Windows is so bad than the OS X malware they are reporting?
-Lod
It's just a trojan with a PDF icon.
And it will be nerfed as soon as it's added to the OS X XProtect filter, if it hasn't already.
Trojans are nothing new, giving them fake icons is nothing new, even Mac trojans are nothing new. News this ain't.
that Macs don't have viruses!
When your OS begins to get relevant, you get to deal with the viruses. I'm fairly certain that Linux and Windows have better security than Mac OS X, but I still think the popularity of Mac OS X and Linux slowly increasing will lead to more and more of these types of attack, regardless of what the Mac and Linux fanboys say.
This trojan doesn't hide inside a PDF. It is an executable that disguises itself as a PDF.
I saw reference to this trojan the other day, but my research turned up only vague descriptions such as the one linked in the summary. From all the reading I did it seems like this is an executable of some sort, with no extension that is being e-mailed to people. None of the descriptions I've read have described how it infects the machine, but I assume the user has to run it and then agree to allow the unsigned program to run for the first time. At this point it drops a PDF on the hard drive, opens it, and then installs a bare bones apache server, which doesn't actually work as far as anyone can tell. There was some indication that this was a cross platform trojan, but no one has been able to confirm this.
So if anyone is actually in a lab with a copy of this could you please enlighten us on the following points:
So as far as I can tell this is a failed attempt to create a trojan that was released into the wild, possibly as part of testing or as an experiment. It's not really much in the way of news, but for security geeks it is quite interesting; which is why the complete failure of the security companies to provide a decent description is so frustrating. Does anyone have real information about this trojan?
Here's the plan:
1) OS X makes it brain-dead easy to not run as an admin user. Create a separate admin account first, then remove the admin privilege from your everyday account. On those rare occasions you need admin privileges, you'll be automatically asked to provide the admin account info - you don't need to even think about it.
(Somehow that isn't sinking into a lot of peoples' heads, even those who should know better)
2) Back up your stuff regularly. Again, OS X makes this brain-dead easy with Time Machine. You can use something else like a custom rsync script, but - just DO IT.
If you're running as a non-admin user, the worst that can happen is your own stuff gets hosed - and then you can get it back from your backups. But since trojans are probably only going to go after the system files, it's unlikely even your stuff will get touched.
Okay, there's one caveat. If you click on an infected file, and it asks for admin permissions and you provide it, you're screwed. But one would hope you're smart enough to realize viewing a PDF should not require admin authentication. In the end, common sense does have to enter into the picture.
BTW if you claim running as an admin is okay because you're always prompted to authenticate anyway... you're just wrong.
#DeleteChrome
Imagine I made an piece of malware.
Imagine I set it's icon to the default PDF icon on your operating system
Imagine I named it "somefile.pdf.exe" or "somefile.pdf.app"
That's what's happened here. It's not an exploit in the PDF format but rather somebody using the appearance of a 'safe' file to trick people into double clicking it. It could just as easily have been "somefile.jpg.app" or "somefile.ogg.app" with appropriate icons.
Mac OS X will display a "you've never opened this application before, are you sure you want to?" message when a user double clicks the fake-PDF, but let's be realistic: our mom's aren't going to know any better.
More malware! Whatever will we do? Better burn those Macs and get a Linux box!
Meh.
See subject line above + post parent to mine -> http://apple.slashdot.org/comments.pl?sid=2444536&cid=37503772 because Lord only knows that if that happened on another OS platform, like Windows? It'd be somekind of 'horrendous event' to be shouted from the rooftops!
Every time one of these "sky is falling, OS X is being attacked by new malware/virus/trojan" articles floats around the 'net, it seems like the source document is from one or another AV builder or a computer security outfit with things to sell. The first clue is how vapid and vague the article is, and how little useful information it provides. Another clue is when one part of the article tells the story a bit different than elsewhere in the same article. For OS X users, there are a handful of good, indepdent, computer security sites (apple.com NOT being one of them), and if it aint there, I ignore it.
In fact I've seen a big rise in the amount of non-admin Windows malware. It just infects the user that is using the system. The reason is they realize that for the vast majority of systems, the user IS the system, there is no need to infect anything else. It also lets them get an infection in an enterprise setup where users don't get admin.
Now I suppose it does make the malware slightly easier to get rid of but then it really doesn't matter, I tend to scan the things from a boot disk anyhow.
This geek idea that only the system matters is silly. True for a server maybe, not for a desktop. On a desktop, the user's data is all that matters and you don't need admin to get at that.
And it will be nerfed as soon as it's added to the OS X XProtect filter, if it hasn't already.
Black lists don't work. This even MS has figured out. So they add this particular one to the filter rather then fixing the vulnerabilities or worse yet, educating users on how to safely use computers (as opposed to telling them they are automagically protected by owning a Mac) but the malware writers simply make a new variation to get around that black list. There is so much Malware for Windows simply because a lot of it is subtle variations on the same malware to get around AV/Anti-malware.
The "protect filter" is not computer security rather it is computer security theatre.
It's just a trojan with a PDF icon
To the end user, there is no difference.
Calling someone a "hater" only means you can not rationally rebut their argument.
Trojan: (capitlized)
1. citizen/resident/native/inhabitant of Troy
2. well-known brand of condoms
trojan horse: (not capitalized)
1. A hollow wooden statue of a horse in which the Greeks concealed themselves in order to enter Troy.
2. A person or thing intended secretly to undermine or bring about the downfall of an enemy or opponent.
3. A program designed to breach the security of a computer system while ostensibly performing some innocuous function
just can't get yer shit straight, can you editors?
The Admin and the Engineer
Call this what you will but after years of enduring their "but macs don't get viruses" comments I'm rather pleased they're joining the rest of the computing world.
Linux can enjoy the same when it gets the same kind of consumer market share.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
A user space application can not receive a listen port on OSX now can it? If so, Apple needs to fix it.
Having to work for a living is the root of all evil.
Or just replace the operating system kernel.
OS X malware doesn't have to do that. Personally, I can't wait until the malware starts to complete the full circle, and we see common malware start using its own kernel extensions to hide itself completely from the system, giving us Mac rootkits.
Boot Windows, Linux, and ESX over the network for free.
Mac users can be broadly characterised as vain and tech challenged, and therefore vulnerable to a different set of social engineering vectors. It shouldn't be too hard to come up with strategies to push their buttons. Button, rather.