First Mac OS X Virus? 577
bubba451 writes "MacRumors reports on what may be the first virus to affect Mac OS X, disguised as screenshots for the upcoming Mac OS X 10.5 Leopard. From the report: 'The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but was actually a compiled Unix executable in disguise. An initial disassembly reveals evidence that the application is a virus or was designed to give that impression.' The virus is said to also spread via Bonjour instant messaging." Update: 02/17 00:09 GMT by P : This is not a virus, it is a simple Trojan Horse: it requires manual user interaction to launch the executable. See Andrew Welch's dissection.
Phew! (Score:5, Funny)
(fp?)
Re:Phew! Thanks! (Score:2, Funny)
FUD of the day (Score:5, Insightful)
1.) Several proof-of-concept viruses have been written for OS X in the past, so this isn't the "first." They never propagate.
2.) When you download this
3.) When you run it, an admin password prompt is displayed by OS X, and you have to enter it to continue.
Like I said--FUD of the day.
Re:FUD of the day (Score:5, Informative)
What are you talking about? Admin accounts normally get password popups to do anything like this (system updates, system-wide installers, etc.). Are you saying in this specific instance it doesn't?
Re:FUD of the day (Score:4, Informative)
Re:Phew! (Score:5, Funny)
I wish I also got paid to be a crackhead.
Trojan Man? (Score:4, Interesting)
Somebody better wake up Apple and fix this application-looks-like-a-pretty-JPEG icon bug!!
Re:Trojan Man? (Score:5, Informative)
Re:Trojan Man? (Score:3, Informative)
Re:Trojan Man? (Score:4, Informative)
Regardless, this "virus" pops up an admin password prompt, like every other proof-of-concept OS X trojan that's been written in the past, which effectively stops it in its tracks. This isn't really news except to Apple-haters who can go "SEE NOW U'VE GOT VIRUSES LOLZ."
Re:Trojan Man? (Score:3)
Re:Trojan Man? (Score:5, Informative)
It's a "JPEG" because the author was clever enough to paste the icon of a JPEG onto the executable.
If the user is root, or possibly admin, the script writes files in
No kit, just a prompt.
http://www.ambrosiasw.com/forums/index.php?showto
Re:Trojan Man? (Score:5, Interesting)
How can a user differentiate between an executable file with a pretty icon and a jpeg in OSX (or Linux for that matter)? In Windows there are file extensions so a trojan with an icon will still have to be called something.exe in order to do any damage. How can I tell the difference between a binary file with an icon and a file that doesn't execute any code with the absense of extensions?
Please don't laugh
Re:Trojan Man? (Score:5, Funny)
Re:Trojan Man? (Score:3, Informative)
Humour aside, that is actually correct. Right click if you have a two or more button mouse and choose Get Info. Notice "Kind" will state "Application". If you have a single button mouse you can Control click in place of right clicking. If it is a JPG then it should say "JPEG image".
Re:Trojan Man? (Score:3, Interesting)
That said, it will definitely bite many naive mac users who think they are invulnerable, and don't realize that the Finder's default behavior, though a convenience for the computer illit
Re:Trojan Man? (Score:5, Informative)
Actually, it seems that (as of 10.4.5, anyway) it'll show as 'YaddaYadda.jpg.app' even if you have the 'Show all file extensions' switched off - a bit of experimentation shows that if the first extension (in this case '.jpg') is a recognised file-type, then the '.app' gets shown as well.
So, from a display point of view:
Basically, if it's trying to impersonate another existing file-type, it'll tell you.
Re:Trojan Man? (Score:3, Interesting)
Re:Trojan Man? (Score:3, Informative)
List View (Score:5, Informative)
If you choose "View as List" in the finder (equivalent to the Detail view in Windows), and then expand the window so that you can see the "Kind" column, the Finder will tell you the kind of file you're looking at. For example, Application, Picture, Document, etc.
The Finder looks at some stuff which is not visible to the user in determining this -- in addition to the ".app" file extension on Cocoa bundles, there are also the traditional Mac 'Type' and 'Creator' codes, stored in the file metadata in the resource fork. By setting a file's Type to "APPL," it becomes an executable. This is the traditional Macintosh analog to the UNIX eXecute bit (but arguably more flexible, since it also handles file typing), and is totally independent of the file name. But anything that you set this way will be clearly marked as an Application in List View, regardless of what you name it, or what kind of custom icon it has.
This is how the MP3Concept trojan worked, and how many old-school ResEdit tricks worked. You can have something that's legitimately named "Mp3Concept.mp3" and looks like an MP3 but is really an executable, by setting the Type and custom icons correctly. It's nothing new, people have been doing it for years. (There were a lot of ResEdit "hacks" that worked off of this principle -- for example, creating a dummy Excel document that gave a rude dialog when double-clicked.) I think it's because we've migrated away from OS 9 and the metadata concepts that people have forgotten how easy it is to do, and that the Mac still supports it.
OT - never got that (Score:3, Insightful)
And a whole bunch of other file display changes; icons don't help me as much as created date, file type, etc.
Anyway. This was a useful post.
Re:OT - never got that (Score:3, Interesting)
Oddly, it was intended to make Windows more Mac-like. The Mac GUI was heralded as being simpler and easier to use precisely because it didn't bog users down with techno-jargon like ".exe", ".com", etc. Windows decided to follow suit, while leaving the option available. The problem is, they were hiding the *one bloo
Re:Trojan Man? (Score:5, Informative)
Um, why is my /Library chmod 775? It's that way on all four OS X machines that I can reach via SSH right now, two 10.4.x and two 10.3.x. Because there is no /Library/InputManagers in my /Library, so any program running under an admin account on my machine could create one. Admittedly, /Library/StartupItems being group-writable would be a much worse security violation (stuff in there runs as root at startup), and I have seen cases where installers will create one chmod 775 or 777, but I don't see any reason why a program that isn't setuid root (in other words, requiring the security dialog first) should be able to create new directories or drop files into /Library.
Anyhow, this is not a virus, it's a trojan. A virus attaches itself to existing executables (boot blocks included in the definition of "executables"). This is a trojan, and if it replicates, then it's a file-propagating worm (as opposed to the e-mail- and network- propagating worms that plague Windows). So far there is still no malware for OS X that doesn't depend upon human stupidity for propagation. Whether that be saving an e-mail attachment to disk and then double-clicking on its icon on the desktop (this thing won't auto-open while reading e-mail), or simply using bad username/password combinations allowing a brute-force break-in over SSH, there is still no sign of any kind of fully-automated malware for OS X.
In the meantime, I'm going to be doing a lot of "sudo chmod 755 /Library".
Re:Trojan Man? (Score:3, Insightful)
I've said it before, I'll say it again: Never underestimate the power of human stupidity.
/Library permissions (Score:3, Informative)
Disclaimer: I write network management software for Mac OS X; I have therefore seen a fair bit of what can happen with mis-configured system folders
I'd advise you not to change permissions on /Library, or at least please don't do it recursively. You're asking for pain there. /Library/Application Services, /Library/Caches, /Library/Frameworks are supposed to be writable by administrators.
The reason your root library folder is writable by members of the Admin group is because that's what it's for. There'
Re:Trojan Man? (Score:5, Insightful)
The only way would be some sort of flag that shows up on any icon that represents something executable, and that wouldn't be a fix but a completely new approach.
Re:Trojan Man? (Score:5, Interesting)
Re:Trojan Man? (Score:5, Insightful)
However what I'm not sure about is how you'd make this work for MacOS bundles -- unlike UNIX applications they're not just single files; the thing that you click on in the Finder to launch a MacOS app (at least a Cocoa one) is actually a directory if you look at it in the Terminal, it just has the hidden suffix of ".app" (so for instance the program Mail in the finder is actually the directory/folder Mail.app). The actual executable file is normally buried somewhere within the folder -- usually like (appname).app/Contents/MacOS/executablefile.
I suppose what you'd have to do is put the visual flag on if a file was either a directory ending in ".app", or if the regular eXecute bit was set on a file itself.
Re:Trojan Man? (Score:4, Insightful)
Re:Trojan Man? (Score:5, Insightful)
When I download a dmg file with Safari, I get a warning if the dmg contains an executable. (Not sure if that's Safari doing the warning or the code that mounts the archive or what.) Something like this in the code that unpacks tar files would go a long way toward fixing it.
Devon
Re:Trojan Man? (Score:3, Informative)
Re:Trojan Man? (Score:5, Insightful)
I like it. Good idea.
While we're at it, maybe they can give us back our aliases in italics at the same time; that was a nice 'no brainer' feature if I ever saw one.
That will probably go over better with application developers than some sort of visual indicator on the application's icon that would mess up their pretty custom look. Bolded text is definitely the better way to go.
Re:Trojan Man? (Score:5, Informative)
It doesn't really disguise as an image. It just uses the OS X standard icon for images as its own icon. However, it does not have a jpeg extension and if you select it in the finder, you will not get a preview thumbnail, thus you would know that opening in the Preview application (which you would do by double clicking) cannot work. Maybe, if you have set your Finder not to display extensions, or just didn't pay attention, you would try to open it in another image viewer, which would fail and not do any harm.
configured correctly? (Score:2)
That should be pretty much any default or out-of-the-box configuration of Mac OS X me thinks. Even on Macs with only one user and no password the machine will generally put up a prompt before making certain changes. Probably even saver if you have a password and multiple user accounts.
Re:Trojan Man? (Score:2, Informative)
You raise valid points here. This is a single instance, but undoubtedly more will come and we need to view these developments agnostically.
Unfortunately, despite all best efforts to dissuade the novices, folks still tend to run as root or admin on their systems. A large percentage of Windows virii won't inf
Re:Trojan Man? (Score:5, Informative)
Actually running/logging-in as root requires either some non-trivial Terminal work, or going in through NetInfo Manager (a fairly intimidating config utility) and enabling the root account (which at least the time I did it, a few years ago, gave you some pretty stern warnings).
That's not to say that you can't have root-like privs -- the default first user on a Mac is an "Administrator," which just means that they can sudo -s and become root temporarily. However to do this you have to authenticate for every action. (Or every 5 minutes or so.) The MacOS "Administrator" level user is not as powerful as the WinXP type of Administrator (which is effectively a root account). Macs have three levels of users: root, Admins (who can sudo), and everyone else (who can't).
So yes, there are definitely ways that a clueless person could damage themselves with a trojan, if they just mindlessly type in their password into any box that comes up, regardless of the context in which they're being asked, but there is at least one more step stopping you from doing it compared to running on a Windows system.
Re:Trojan Man? (Score:3, Informative)
That's true on Windows, because it's a PITA otherwise. There are plenty of apps that won't run except as admin, or unless you've somehow fixed some set of permissions that is not identified when you try (and fail) to run the app.
I try to run not as admin on Windows. I installed an app called, I believe, FileTweak recently. Now every time I try to get a file's properties, I get a hal
Re:Trojan Man? (Score:2)
Replying to myself here (and green pizza [slashdot.org] and squidguy) in order to clear up a mistake, I had misunderstood information from another source: Apparently you only have to enter your admin password if you are root (highly unlikely, so I don't know why some sources say 'most users' would have to enter it); otherwise it leaves your system files alone and only touches wha [slashdot.org]
Re:Trojan Man? (Score:2)
Sounds like Mac users will need better protection.
Re:Trojan Man? (Score:2)
Re:Trojan Man? (Score:3, Interesting)
Re:Trojan Man? (Score:3, Informative)
The MP3Concept trojan didn't disguise itself because the Finder was hiding the ".app" extension, anyway. It's filename really was "MP3Concept.mp3". If you had gone in and looked at it via the Terminal, th
Re:Trojan Man? (Score:3, Interesting)
Either this isn't a virus, or the "first" was two years ago.
Re:MOD PARENT UP - IT IS A VIRUS (Score:3, Insightful)
Face it trollboy: if you would have done some more effort to see how it works, you would see from your own quoted definitions that this is not a virus. A virus spreads between different computers without any user interaction. However, this thing is only able to send the fake JPEG file to other computers via a few IM progr
It's not a virus... (Score:5, Informative)
You cannot be infected by this unless you do all of the following:
1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file
2) Double-click on the file to decompress it
3) Double-click on the resulting file to "open" it
You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.
Re:It's not a virus... (Score:3, Insightful)
Re:It's not a virus... (Score:3, Informative)
Re:It's not a virus... (Score:3, Insightful)
1.) This isn't the "first OS X virus." Several other proof-of-concept attempts have been written over the users, notably MP3Concept.
2.) This doesn't quality as a virus, it's more of a trojan.
3.) The fact it prompts for your password immediately renders it useless and ineffective as a trojan. I could write an AppleScript that deleted all of your system files but required your password to be entered for it to run--that doesn't mean I've written the "first OS X virus." It just means I've writte
Good point (Score:2)
Use protection, browse safely, and the net is a pretty safe place still...
Re:It's not a virus... (Score:3, Interesting)
In other words MacOSX is giving *some* protection in that it can only attack the user that runs it, but that protection is shallow comfort. KDE has the best approach I think in this in that every executable, no matter what the extension etc, has the same executable icon. It also doesn't have automatic autoplay (possibly the worst "feature" of Win
Re:It's not a virus... (Score:3, Insightful)
Re:It's not a virus... (Score:4, Insightful)
1. download it
2. double-click and decompress it.
3. double-click and execute it.
Re:It's not a virus... (Score:5, Insightful)
There is no double standard here.
Re:It's not a virus... (Score:3, Informative)
On Linux MIME scanning is used to make this type of attack significantly harder. A files icon is assigned by the operating system according to what type of file it actually appears to be, and executables cannot choose their own
Re:It's not a virus... (Score:4, Insightful)
I think people are misunderstanding how OS X handles file type icons. The file isn't presenting itself as a file of another type. If you did a Get Info, it would still say Application. On OS X, you can copy and paste any icon into file in the Get Info window. I have cool Mario icons for my various external USB drives. Someone just copied and pasted the JPEG icon in this case.
The fact that clicking this thing prompts for a password means OS X is correctly protecting you from this kind of an attack. Beyond that, anyone entering the password and enabling admin access for this program is at fault, not OS X.
Re:It's not a virus... (Score:3, Insightful)
I understand just fine what's going on here. The problem is that humans go by icon to determine file type, whereas the machine goes via some other mechanism. The fact that you can find out what the machine thinks it is via some other route isn't relevant - the same was true of Windows yet the exploit still worked on signif
Re:It's not a virus... (Score:3)
It does not use the Operating System's JPEG handling code. Its an executable, like any other. Running this program is no different than dragging your home directory to the trash; both require user stupidity.
Re:It's not a virus... (Score:5, Informative)
In the windows scenario you have a real
In the Mac scenario you have an executable which is made to look like an image because its icon was changed. The computer itself knows that it isn't an image so it doesn't try to load it automatically from e-mail or web. This 'virus' is designed to trick the user. The user needs to double click and run the executable. It will then try to write into a protected directory and the OS will prompt the user for the admin password. If the user is dumb enough to click on a executable *and* enter the admin password there really isn't much else you can do. The executable never actually crashes any part of the OS to gain control of the OS and do something that the user doesn't authorize.
Re:nitpick, panther=10.3 (Score:3, Informative)
Hardware (Score:4, Funny)
Re:Hardware (Score:3, Insightful)
Most malware exploits flaws in the operating system and applications - not the hardware architecture.
I have heard this FUD from various Mac-heads (pissed at the change from PPC) that they are suddenly going to be swimming in malware due to a chip change. It's nonsense.
Re:Hardware (Score:2)
Trojan? (Score:5, Insightful)
You have to execute it yourself, and that is why it is _not_ a virus.
Re:Trojan? (Score:2)
Re:Trojan? (Score:2, Informative)
Re:Trojan? (Score:5, Informative)
How can it be a virus if it is a Trojan?
OK, welcome to malware nomenclature 101. Will everyone please take their seats. Thank you. There are three basic classifications for malware:
This particular malware is a trojan (partly disguised as a jpg) which them copies itself to a new location on your drive and modifies a few commonly used applications in order to spread itself via they Bonjour discovery and file transfer mechanism in OS X. It requires human intervention to extract itself run, spread, and for download. I'd call this a virus to be clear about its functionality.
Had to happen really (Score:2, Insightful)
Might be good in a way - to shake some people out of the complacent "OS X is invulnerable" mindset.
Re:Had to happen really (Score:2)
What it tells us, I'm not sure. Depending on your viewpoint it's either Wow, Mac OS X is so secure that it took till now to have a virus! or Yeah yeah, Mac market share is so low that it took till now to have a virus.
:-) for the humor-impaired.
Eh? (Score:3, Funny)
Surely you can't mean... (Score:2)
Reminds me of old Applescript "hacks" (Score:5, Interesting)
Another variant was useful on computers that were proteted with OnGuard or AtEase. Simply make a script that would pop up a dialog box asking for the password. An unknowning teacher would enter the password and the script would exit... leaving behind a log file with the password in it for later use.
Nothing magical about these. Very basic trojan horses.
Re:Reminds me of old Applescript "hacks" (Score:2, Funny)
Consider the source... (Score:4, Insightful)
Hmmm, First Virus to ask for your password? (Score:2, Insightful)
Re:Hmmm, First Virus to ask for your password? (Score:3, Insightful)
Or just install a keylogger and sit in the background waiting till you enter your root password thorough normal use.
Such a virus would be pretty hard on Linux, because icons are assigned to files by content, not by extension. It would have
Re:Hmmm, First Virus to ask for your password? (Score:2)
It's a
10.5 Screenshots?! (Score:5, Funny)
Further (Score:3, Informative)
Virus Acid Test (Score:2)
Re:Virus Acid Test (Score:2)
Re:grow up (Score:2)
Re:Virus Acid Test (Score:2)
Its a compressed file. You have to uncompress it.
Then, you have to double click on the icon. The sneaky part is the executable uses the JPEG icon.
Then, you have to enter your password.
I invented a similar trojan before. It requires slightly more user intervention. I'll quote you it here:
"Please type the following at the terminal for increased disk space:
sudo rm -r -f
Please type your password when prompted, and make sure to send this performance tip to all your friends."
This 'trojan' is
I Like The Trojan Horse That Was Used (Score:5, Funny)
What wrapper will the first Linux widespread virus take? "Hey, download this PDF -- it's a transcript of a big IRC shouting match about which is better, emacs or vi! You gotta read this!"
We won't know what hit us...
Re:I Like The Trojan Horse That Was Used (Score:2)
There's no desktop eye candy, and this is hardly clever.
That's *social engineering*. Any Mac document or executable has been able to have the outward appearance of having any icon for 22 years. So that's not new.
This won't spread. It will be yet another social engineering/trojan/malware/"virus" novelty with little to no impact beyond the mock panic sure to ensue in the press.
All it's going to take is one major outlet to pick it up, and we'll have another "Mac OS X Just As Insecure As Windows" free-fo
Need a Universal Binary (Score:5, Funny)
When will Mac viruses get to the level of Windows when? For godsakes, this one still requires user intervention, and it doesn't even work on all OS X platforms!
Come on Apple! Microsoft has you soundly beaten in this regard
Input Manager as an infection vector (Score:2, Insightful)
There is some good news in all this (Score:3, Funny)
The vulnerability isn't always plugged in (Score:5, Insightful)
Never understimate the power of the incomptenece of 20% of your userbase.
Re:The vulnerability isn't always plugged in (Score:5, Insightful)
There is no way to compensate for an Administator who is computer illiterate. It's simply not possible. You can lower the bar as much as you like, however, there is a certain minimum level of knowledge which is required to safely administer a computer.
Like don't run every application you get your hand on. This is similar to don't delete all your files.
You can't man a .app look like a .jpg in OS X (Score:3, Insightful)
I also tried doing this with a
Let me get this straight... (Score:3, Insightful)
#include
main()
{
(void) printf("Hello World\n");
return (0);
}
and also included a couple lines to 'rm -rf
Then I e-mailed or IM'd a person the executable, then asked them to decompress it, double-click on it, and laugh, that would be Mac OS X's first virus/trojan? Ohh wait, I need to associate a pretty icon to it too.....
As much as this author would like to claim they are the first, I think the programmers at Apple were the first ones to do this with their "Disk Utility" that a user has to click on to 'newfs' or your Windows users 'format' your hard drive.
I can not believe this made Slashdot....
Five stages of grief (Score:5, Funny)
1. Denial and isolation
2. Anger
3. Bargaining
4. Depression
5. Acceptance
I think with the appropriate counseling, the MacOSRumors.com community will be just fine.
Just finished my new OSX Virus. (Score:3, Funny)
The brilliance of shipping iPhoto with new Macs (Score:3, Interesting)
See, if a trojoan like this comes along with something unpleasant really novice users will try to move it into iPhoto - which will just say "sorry, that's not an image".
More advanced users that would just try and open an image in Preview would say "Opening an image file and it asks for my password? No thank you sir!".
Which is why this trojan has not really spread, or really affected many computers.
Re:Hehehe (Score:2)
When was that?
Apple have always put a premium on style and their performance per buck was always behind the curve - even since the original 68000 Macintosh. You had one because it was cool, not for blistering performance.
Re:Hehehe (Score:2)
When was that?
Macintosh IIfx
Macintosh Quadra 900 and 950
Daystar quad PowerPC 604e Mac clone
Ugly and fast. Like a good muscle car.
Re:Hehehe (Score:2)
Even so, with exception of the Daystar clone, they were still reasonably stylish compared to the Wintel beige boxes.
Re:Hehehe (Score:3, Funny)
Re:Hehehe (Score:5, Funny)
Nah, that's just the title of Steve Jobs upcoming self-biography.
Re:You want security... (Score:2)
yet.