Slashdot Mirror
New Mac Trojan Installs Silently, No Password Required
An anonymous reader writes "A new Mac OS X Trojan referred to as OSX/Crisis silently infects OS X 10.6 Snow Leopard and OS X 10.7 Lion. The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions. The threat was created in a way that is intended to make reverse engineering more difficult, an added extra that is more common with Windows malware than it is with Mac malware."
Yeah, right.
how about an article on every windows- or android-based trojan.
Not going to help you if you're hit by an in-browser drive-by attack. Chrome or Firefox with Noscript can help here.
Good call. Let me fire up my trojan botnet.
It's not a virus.
This is not a Virus, this is a Trojan. At least try to read the summary, I bet even your kids can do that.
if you actually read the article this is just some bullshit proof of concept made by a anti-virus company to shake down mac users. it's never actually been seen outside of a security website.
Sure it will. If it's not signed by Apple or an Apple developer, Gatekeeper prevents it from installing. Or do you have any proof ot can bypass Gatekeeper?
This is not a Kid, this is a Virus. At least try to read the summary, I bet even your Trojan can do that.
that a new version of OSX has just become available to purchase, better rush out and buy it.
Nullius in verba
There's a big difference between merely getting it on their machine and actually executing it. Gatekeeper is a new Mountain Lion feature that, by default, prevents any apps that are not from the Mac App Store and are not otherwise signed with an Apple-provided certificate from executing. While inflammatory, the AC's point still stands.
They don't, but you can't fix stupid, which is what trojans exploit.
When Firefox/Chrome/Safari launch a process they are still classed as being "from the app store" right?
- http://www.milkme.co.uk
The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions. The threat was created in a way that is intended to make reverse engineering more difficult...
However, blocking the threat is as simple as an ACL on your router...
That's not a trojan, that's Mountain Lion.
To catch outgoing calls.
Kids and Viruses have a lot in common. They delete all your stuff, cost tons of money in repairs. The big difference is that you usually like it more when your kids replicate.
Any executable that's downloaded is "tainted." Mach-O executables carry their certificates and checksums as metadata segments in the executable, and if you don't have those, or they don't resolve to a certificate with an Apple signature, Gatekeeper will stop it from running according to the user's preference setting.
Taintedness can be removed with
to delete it (it's stored in the filesystem extended attributes), or by launching the app from the "Open" command contextual menu. It will not launch by double-clicking, Apple-O'ing, or with Apple Events (like Firefox would do).
Don't blame me, I voted for Baltar.
So they just assign these viruses an arbitrary nickname, right? I think "Crisis" was a pretty funny shot at Apple, seeing as how they refuse to admit the last month or two has been one for them because of viruses. But if anyone can just randomly assign it a name, why not go all the way and name it Lol@Apple then the next one Lol@Apple2 etc?
How? From all the Mac users who know how to do that?
*said while holding up "sarcasm" sign*
Gatekeeper is a new Mountain Lion feature
RTFS; Mountain Lion is not the distro being compromised.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Disassemble it and follow the code. Even if some of the code is encrypted something in the virus will have to decrypt it before it can be run and you'll have that on hand too.
I'm not saying its easy but its not protected by some magic ward.
If you had a trojan you might not have kids or catch a bad virus as easily
-KI
#include bier;
Not true. Read the Ars Technica review: Gatekeeper only stops the execution of apps directly from downloading them (downloaded executables are flagged). Hell, you can right-click the app after downloading it, select "run", and it will work just fine.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
It's called "Morcut" by Sophos and they offer a free anti-virus product for Mac OS X.
They claim it's designed to access these things: mouse coordinates, instant messengers (for instance, Skype [including call data], Adium and MSN Messenger), location, internal webcam, clipboard contents, key presses, running applications, web URLs, screenshots, internal microphone, calendar data & alerts, device information, address book contents
New Version of OSX drops, shortly after new malware discovered that only affects old versions.
I smell marketing ploy.
It seems more and more these days, that malware is becoming user-mode to avoid the nasty popups that comes with trying to gain administrator mode.
Which makes sense as a lot of stuff you need to do as malware can be done strictly as usermode without needing to get admin priviledges. This one apparently checks to see if it can get admin or running in a restricted user account.
So even malware these days are learning to be friendly and compatible with users who aren't admins and not requiring admin for everything.
Obscurity is just one valid tool in a security arsenal -- but it shouldn't be the only one. Ranked high above it in importance is "user education" - a feat that's nearly impossible as we continue to dumb down the computing experience.
This threat may run on Leopard 10.5, but it has a tendency to crash. It does not run on the new Mountain Lion 10.8.
Also...
This threat has not yet been found in the wild, and so far there is no indication that this Trojan has infected users
You're right to imply that Mountain Lion users shouldn't get too cocky, but in this particular case, according to this antivirus vendor, the malware hasn't even been found in the wild—and even if it had, it doesn't run on Mountain Lion.
the JoshMeister on Security
That didn't sound right so I looked up it up. I would not have put it past Apple to require every single program be signed by them or as an approved developer to keep out "undesirables", however, that's not what's going on. https://securosis.com/blog/os-x-10.8-gatekeeper-in-depth
All libraries and frameworks, including their bundled static resources, images, strings files, and so on, must also be signed.
Don't blame me, I voted for Baltar.
In Mac land, that would imply you had some non-existent version of classic Mac OS in which development had proceeded beyond version 9. "Mac OS" is not the same as "Mac OS X"
The malware actually came out a few days ago. Slashdot is slow to report on it.
Your guess is completely wrong.
First, the way Gatekeeper works is by interposing the mechanism used for quarantining downloads. A binary compiled on your computer was never downloaded, so code you build yourself should be unaffected by Gatekeeper unless you upload and re-download it or manually set the quarantine flags for testing purposes.
Second, because Gatekeeper is tied into the quarantine system, the check occurs only the first time that you launch an application. Any application that you installed under previous releases of the OS continues to work as it always did because again, it was not just downloaded.
When a Gatekeeper check does occur, however, the behavior depends on which mode Gatekeeper is in (set in System Preferences). There are three modes: "Mac App Store" (the default), in which only apps downloaded from the Mac App Store are allowed to launch, "App Store and identified developers", in which apps downloaded from the Mac App Store or from other sites are allowed, but only if signed by a cert obtained from Apple's developer program, or "Anywhere" (essentially turning Gatekeeper off).
In that middle mode, the app is not signed by Apple at all, but by a third-party developer. That third-party developer's cert is signed by Apple, of course, but the app itself isn't.
And in all cases, you can override Gatekeeper's behavior by control-clicking the app and choosing "Open" instead of double-clicking it. This will give you the traditional set of prompts from previous OS releases in which it asks you if you want to launch this app that you've never launched before. Alternatively, you can turn Gatekeeper into "Anywhere" mode, launch the app, then change it back. Either way, once you have launched and un-quarantined a given app, Gatekeeper should never bother you again.
Check out my sci-fi/humor trilogy at PatriotsBooks.
And at $20.00 for all of your computers, Apple will make billions... (or, maybe, at least cover some of their costs).
I don't read your sig. Why are you reading mine?
the golf clap is a nasty one
Balderdash!