New Mac Trojan Installs Silently, No Password Required

An anonymous reader writes "A new Mac OS X Trojan referred to as OSX/Crisis silently infects OS X 10.6 Snow Leopard and OS X 10.7 Lion. The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions. The threat was created in a way that is intended to make reverse engineering more difficult, an added extra that is more common with Windows malware than it is with Mac malware."

Comments

Re:Macs don't get viruses.

[Desler]

And trojans aren't viruses unless you're going to show how this is self-replicating.

Re:But Macs Don't Get Viruses

[SilverJets]

It's not a virus.

but it's never been seen in the wild

[Anonymous Coward]

if you actually read the article this is just some bullshit proof of concept made by a anti-virus company to shake down mac users. it's never actually been seen outside of a security website.

Re:but what about mountain lion

[Anubis IV]

There's a big difference between merely getting it on their machine and actually executing it. Gatekeeper is a new Mountain Lion feature that, by default, prevents any apps that are not from the Mac App Store and are not otherwise signed with an Apple-provided certificate from executing. While inflammatory, the AC's point still stands.

Re:cool ... good that I use OS 10.5

[rhsanborn]

They pulled that comment just a few months ago. Earlier this spring you would have found a claim that it doesn't get PC viruses (Don't be pedantic and claim that it doesn't get PC viruses because PC refers to windows viruses, that's a specious argument and it's a deliberate ploy to claim Macs don't get viruses). So yes, almost every currently deployed Mac was sold with the claim that Macs don't get viruses, directly from Apple.

http://www.redmondpie.com/apple-removes-its-virus-immunity-claim-for-mac-from-official-website-not-so-safe-from-viruses-after-all-huh/

http://www.forbes.com/sites/timworstall/2012/06/26/yes-apples-machines-really-can-get-viruses/

Re:but what about mountain lion

[the JoshMeister]

From Intego, the company who first blogged about this malware (emphasis mine):

This threat may run on Leopard 10.5, but it has a tendency to crash. It does not run on the new Mountain Lion 10.8.

Also...

This threat has not yet been found in the wild, and so far there is no indication that this Trojan has infected users

You're right to imply that Mountain Lion users shouldn't get too cocky, but in this particular case, according to this antivirus vendor, the malware hasn't even been found in the wild—and even if it had, it doesn't run on Mountain Lion.