Slashdot Mirror
New Mac Virus Discovered, Making the Rounds
sl4shd0rk writes "A new Mac OS X exploit was discovered Friday morning by Kaspersky Labs which propogates through a zipfile attachment. The attachment tricks the Mac user into installing a variant of the MaControl backdoor via point-and-grunt. Embedded in the virus is an encrypted IP address belonging to a server in China which is believed to be a C+C server. Once installed, the virus opens a backdoor allowing the attacker on the C+C server to run commands on the compromised machine. Shortly after Kaspersky's announcement, AlienVault Labs claims to have found a similar version of the Mac malware which infects Windows machines. The Windows version appears to be a variant of the Gh0st RAT malware used last month in targeted attacks against Central Tibetan Administration. Both viruses are suspected of being tools in a campaign to attack Uyghur Activists."
I know its overly popular these days to call any malware, trojan or other malicious bit of software a virus, but they really dont meet the definition. Frankly, I cant think of a real virus being released in quite some time. Which just seems lazy to me.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Malware, not virus. Virii aren't installed by the users themselves...
Thank you very much.
Pardon my crystallized forebrain, but what's "point-and-grunt" ? Is that one of those newfangled hipster Fail-on-Rails thingamabobs that goes into the weird rounded USB thing on my tee-vee ?
-Billco, Fnarg.com
Only reason it's a big deal is because Apple used to advertise OS X "doesn't get PC viruses." So when a Mac gets one, now everyone jumps on it with a /. article to show apple was wrong.
BTW Apple just removed their claim: http://www.huffingtonpost.com/2012/06/25/mac-virus-apple_n_1625110.html
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Oh, so its like windows in bootcamp then?
It's hard to blame Mac when you open an infected file. People have been unwittingly installing Malware and other infecting programs onto Macs for years. This is very different from one that propagates without the help of the user. It's a non story.
this isn't a virus, it doesn't replicate. It's an email trojan. It's not a Mac or PC exploit, because it exploits the person not the machine. And it's got a very specific target. Thanks for the warning, I won't, and don't click on attachments anyway.
There was an unknown error in the submission.
Only reason it's a big deal is because Apple used to advertise OS X "doesn't get PC viruses." So when a Mac gets one, now everyone jumps on it with a /. article to show apple was wrong.
Well, it's still true that OS X doesn't get Windows viruses. Perhaps a tautology, but true nonetheless....
This sig has exceed its monthly bandwidth allotment.
Clearly this is propaganda perpetrated by Mac-Haters.
Requiem for the American Dream
The GP pointed out that a trojan horse is not a virus. Trojans need user interaction while viruses are self-propagating. Saying that most users can't tell the difference between them (as you appear to be insinuating) is just plain silly.
You've said this twice now. None of the previous commenters has said that Macs are immune to viruses. Either your English comprehension is lacking or you're deliberately trying to stir things up.
This story isn't covering a virus either. It is a malicious application but one that relies on an idiot running an application from a stranger and ignoring the warning suggesting that maybe you shouldn't open it.
Kaspersky discovered that if users willingly execute files that turn out to be malicious, their computers will be backdoored.
In other news, I discovered that fire produces heat. Please front-page this important announcement immediately.
Wake me up when they find something that can infect a Mac connected to the internet when no is one using it. You know, kind of like "install windows, connect to internet, pwned in 15 minutes"?
Anyone can do a user-mode trojan that says "PLEEZE INSTAWL ME! I'M A UPGRAYD!"
That was only an issue with Pre- WindowsXP-SP2 computers. SP2 was released 8 years ago. With SP2 Windows firewall came enabled by default, which protected unpatched services (like SMB) from being connected directly to the internet.
Comment removed based on user account deletion
I know Slashdot editors are famously lazy ('sup, guys!) but why does the summary they posted say "The attachment tricks the Mac user into installing..." when TFA* clearly says "the [attack] described here relies on social engineering to get the user to run the backdoor"? You know, just like every single other Trojan out there?!?** The attachment itself is totally benign until someone clicks on it several times. (Even if you view the message with webmail with Safari's "Open 'safe' files after downloading" in its (admittedly brain-dead) default "checked" position***, you still have to click on the attachment link in your webmail and then double-click the visible file to run it.) The only way this actually happens is if someone reads the email and takes a few steps on their own. As always, the attachment itself does nothing.****
Slashdot has been a techy news site for a decade and a half now. You'd think errors as blatant as this would get caught by the editors, even with their usual lack of checking.
You know what would be an awesome site? Exactly what Slashdot is, but with better editors. (And maybe lay off the JavaScript some.)
Anyway: sky is blue, water is wet, sun rises in the east, and all computers--by definition--are vulnerable to trojans. Film at 11.
And by the way, WTF is "point-and-grunt"? Does that imply that users are dumbly clicking on things? If so, doesn't that also imply that the users just might be the problem? Trojans are trivially easy to write. Here's one in one line:
Voila. Type that into Terminal, email it to all of Slashdot, and wait for a great disturbance in the Force, as if millions of home directories suddenly cried out in terror and were suddenly silenced.
* I know no one here reads them, but I think the submitter should, right? Even if they don't, they should just submit the URL and not make up shit for the summary.
** Which is to say, like every single Mac "virus" of the last decade as well.
*** Apple even puts "Safe" in quotes, so they obviously know that's not an ideal term. They should set it to "off" by default--and then remove the option.
**** Unlike the bad old days with Outlook Express' infinitely more brain-dead "Hey, let me run that executable attachment for you!" setting.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Gatekeeper is not mandatory.
Why, no, I haven't meta-moderated lately. Thanks for asking!
I never believed that anyway. What IS interesting, however, is that every AV vendor now actively prevents analysis of how many virus infections exits per platform, which is actually a very significant bit of data.
Windows malware numbers in the millions (30M, last time I was able to get a figure), whereas OSX malware numbers somewhere in the 40K by now. That's a shade over 1% of the exposure that Windows platforms have - which still makes it a heck of a lot less risky.
The only drive-by infection (Java based) has now been addressed, so I'd say that if you don't install stuff you don't know you're still better off using OSX (or Linux, I'm hoping someone who actually understands usability will get involved on that platform).
But there is no excuse not to install anti virus software on OSX - facts are still better than myth..
Insert
Embedded in the virus is an encrypted IP address belonging to a server in China which is believed to be a C+C server.
Not only does it misuse the term "virus", as you mentioned, but it also misuses the term "encrypted". The correct term here is "obfuscated". The obfuscation code might happen to contain something that looks very similar to AES, but it isn't encryption (and it certainly isn't AES) if the "key" can just be recovered from the executable.
Or maybe she installed a program and it was bundled, like about a hundred other programs that can be installed via bundling. Just try and install a Java update without it asking to install a toolbar.