Slashdot Mirror
New Mac Trojan Installs Silently, No Password Required
An anonymous reader writes "A new Mac OS X Trojan referred to as OSX/Crisis silently infects OS X 10.6 Snow Leopard and OS X 10.7 Lion. The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions. The threat was created in a way that is intended to make reverse engineering more difficult, an added extra that is more common with Windows malware than it is with Mac malware."
And trojans aren't viruses unless you're going to show how this is self-replicating.
Not going to help you if you're hit by an in-browser drive-by attack. Chrome or Firefox with Noscript can help here.
It's not a virus.
if you actually read the article this is just some bullshit proof of concept made by a anti-virus company to shake down mac users. it's never actually been seen outside of a security website.
There's a big difference between merely getting it on their machine and actually executing it. Gatekeeper is a new Mountain Lion feature that, by default, prevents any apps that are not from the Mac App Store and are not otherwise signed with an Apple-provided certificate from executing. While inflammatory, the AC's point still stands.
Maybe ya'lls need to install "Little Snitch".
That is, if you slipped into Slashdot under false geek creds, and don't know how to configure and monitor pf.
"Flyin' in just a sweet place,
Never been known to fail..."
Gatekeeper is a new Mountain Lion feature
RTFS; Mountain Lion is not the distro being compromised.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
They pulled that comment just a few months ago. Earlier this spring you would have found a claim that it doesn't get PC viruses (Don't be pedantic and claim that it doesn't get PC viruses because PC refers to windows viruses, that's a specious argument and it's a deliberate ploy to claim Macs don't get viruses). So yes, almost every currently deployed Mac was sold with the claim that Macs don't get viruses, directly from Apple.
http://www.redmondpie.com/apple-removes-its-virus-immunity-claim-for-mac-from-official-website-not-so-safe-from-viruses-after-all-huh/
http://www.forbes.com/sites/timworstall/2012/06/26/yes-apples-machines-really-can-get-viruses/
This threat may run on Leopard 10.5, but it has a tendency to crash. It does not run on the new Mountain Lion 10.8.
Also...
This threat has not yet been found in the wild, and so far there is no indication that this Trojan has infected users
You're right to imply that Mountain Lion users shouldn't get too cocky, but in this particular case, according to this antivirus vendor, the malware hasn't even been found in the wild—and even if it had, it doesn't run on Mountain Lion.
the JoshMeister on Security
Your guess is completely wrong.
First, the way Gatekeeper works is by interposing the mechanism used for quarantining downloads. A binary compiled on your computer was never downloaded, so code you build yourself should be unaffected by Gatekeeper unless you upload and re-download it or manually set the quarantine flags for testing purposes.
Second, because Gatekeeper is tied into the quarantine system, the check occurs only the first time that you launch an application. Any application that you installed under previous releases of the OS continues to work as it always did because again, it was not just downloaded.
When a Gatekeeper check does occur, however, the behavior depends on which mode Gatekeeper is in (set in System Preferences). There are three modes: "Mac App Store" (the default), in which only apps downloaded from the Mac App Store are allowed to launch, "App Store and identified developers", in which apps downloaded from the Mac App Store or from other sites are allowed, but only if signed by a cert obtained from Apple's developer program, or "Anywhere" (essentially turning Gatekeeper off).
In that middle mode, the app is not signed by Apple at all, but by a third-party developer. That third-party developer's cert is signed by Apple, of course, but the app itself isn't.
And in all cases, you can override Gatekeeper's behavior by control-clicking the app and choosing "Open" instead of double-clicking it. This will give you the traditional set of prompts from previous OS releases in which it asks you if you want to launch this app that you've never launched before. Alternatively, you can turn Gatekeeper into "Anywhere" mode, launch the app, then change it back. Either way, once you have launched and un-quarantined a given app, Gatekeeper should never bother you again.
Check out my sci-fi/humor trilogy at PatriotsBooks.