Slashdot Mirror
MacControl Trojan Being Used In Targeted Attacks Against OS X Users
Trailrunner7 writes "Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers have now taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in the Windows world. Researchers have found a new attack that employs two separate pieces of malware, a malicious Word document and some techniques for maintaining persistence on compromised machines, and the campaign is specifically targeted at Mac users. The command-and-control domain involved in the attack is located in China and the attack exploits a three-year-old vulnerability in the way that Office for Mac handles certain Word files, according to researchers at AlienVault, who discovered and analyzed the attacks."
Now how cool is that. A new threat is found for the Mac platform and it's in a Microsoft product of course. :D
It's an improvement on the previous round, though. Last time it was about malware that required you to actually install it
Apple exploit found in the wild... targets Microsoft product running on Apple OS.
I like the persistence bit though - use the standard plist files to maintain persistence just like any normal piece of code (like maintaining persistence by running a Windows Service).
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
Interesting that this Mac exploit only applies to Mac users who use Microsoft Word. Not saying that Macs are ultra-secure, but maybe the malware authors are just going after the low-hanging fruit, which is Microsoft software, regardless of what platform it's installed on.
Maybe this is how MS will finally put to rest the notion that Linux is more secure than Windows: they'll release MS Office For Linux, which will then open Linux users up to the same level of insecurity Windows users have had forever.
It's gone mainstream. Now that it has viruses, it's like the Miley Cyrus of computing.
Time to find something more obscure. OpenVMS on an Atom system with a retro GEOS interface. That's the ticket.
I used to like Apple before it was mainstream, but now I've moved on. Just like with White Ring and fixies.
Futurist Traditionalism
Any OS that can be pwned by an exploit in *any* software running in user mode is insecure. Sorry, but those are the facts.
The reason for using an exploit in MS-Office is because is one of the most commonly used software products on Macs since its very beginning. So developing an exploit that uses a commonly used software means a better chance of spreading it.
Actually this is what you get when you shut/put off updates.
Office 2008 on my Mac opens the Microsoft Software Updater to check for updates once a month (as long as I open a Microsoft product, including the Office suite or RDP).
Macs had a flurry of trojans that hit them last year too. Apple put out the 10.6.8 update that allowed them to deliver daily anti-malware updates, and then used it to block every variant of the trojan within a matter of hours after it first appeared. Since 10.6 or above has been the default on all new Macs for the last 2.5 years, and Software Update is enabled by default to regularly check for updates, you can bet that the vast majority of Mac users will be receiving an automatic anti-malware update sometime later this week or next to deal with the trojan.
Didn't Apple force Microsoft to continute developing Office for Mac with some legal bollocks?
Pretty sure Hipsters are still safe.
Nerds who mock hipsters however, remain ever in peril from a universe who loves to inflict identical troubles on those who mock.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Really? Aren't we just getting a little paranoid? Why not take it one step further and suggest to sandbox every application inside the VM OS?
Great idea! Is someone working on that?
Embrace, Penetrate, Ejaculate.
The upcoming Microsoft memo.
Task Mangler
Microsoft patched this in 2009
however this from OO-2 is still unpatched
http://secunia.com/advisories/38567/
I do not know what world you live on but where do you think the term "root"kit came from?
If you guess the account root and its associated Unix then you are correct.
Linux servers are heavily targeted. I met someone who worked at a bank and all their Suse servers were rootkitted with a virus for the sole purpose of hosting a phishing scheme and stolen credit card database. Sure more viruses target windows to steal the information but where do you think they store the stolen information Linux servers.
There are plenty of viruses for Unix operating systems
http://saveie6.com/
Solution
Update to version 3.2.
Seriously? That's what you are going to use to scare people away from OO? It took one click to find the solution to your petty quibble.
"On the Internet, nobody can hear you being subtle." -Linus Torvalds
Being secure by design does not mean it's immune to trojans and software exploits. The two things are not mutually exclusive. You can design a system with an eye on security (for example, not running as root by default, have the default state of network-facing services be "off", that sort of thing) but it does not mean that the software will be immune. There will always be bugs and holes - and on the Mac, there are plenty. There are relatively frequent security updates for OS X (more in the early days, but they have not dried up completely) as potential exploits are discovered and patched.
This isn't even the first trojan for OS X. The hole was patched three years ago though, so only non-updated machines are at risk*.
*note, machines still vulnerable to other OS X security threats, of which there are a few, mainly trojans. Don't download a piece of software from a torrent site claiming to be Microsoft Office.dmg, but is only a few 10's of MB - it's probably a trojan.
Apple is actually sandboxing all apps by default in 10.8 "Mountain Lion"
it's technically a bot, but one written by a crazy person.
specifically, it's from a divination app packaged into LoseThos, a 64-bit hobby OS written by a schizophrenic man on orders from god himself. it really has to be seen to be believed.
"They were pure niggers." – Noam Chomsky