Slashdot Log In
First Mac OS X Virus?
Posted by
Zonk
on Thu Feb 16, 2006 09:41 AM
from the is-nothing-sacred dept.
from the is-nothing-sacred dept.
bubba451 writes "MacRumors reports on what may be the first virus to affect Mac OS X, disguised as screenshots for the upcoming Mac OS X 10.5 Leopard. From the report: 'The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but was actually a compiled Unix executable in disguise. An initial disassembly reveals evidence that the application is a virus or was designed to give that impression.' The virus is said to also spread via Bonjour instant messaging." Update: 02/17 00:09 GMT by P : This is not a virus, it is a simple Trojan Horse: it requires manual user interaction to launch the executable. See Andrew Welch's dissection.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Phew! (Score:5, Funny)
(fp?)
Re:Phew! (Score:5, Funny)
I wish I also got paid to be a crackhead.
Parent
It's not a virus... (Score:5, Informative)
You cannot be infected by this unless you do all of the following:
1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file
2) Double-click on the file to decompress it
3) Double-click on the resulting file to "open" it
You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.
Re:It's not a virus... (Score:5, Insightful)
There is no double standard here.
Parent
Re:It's not a virus... (Score:5, Informative)
In the windows scenario you have a real
In the Mac scenario you have an executable which is made to look like an image because its icon was changed. The computer itself knows that it isn't an image so it doesn't try to load it automatically from e-mail or web. This 'virus' is designed to trick the user. The user needs to double click and run the executable. It will then try to write into a protected directory and the OS will prompt the user for the admin password. If the user is dumb enough to click on a executable *and* enter the admin password there really isn't much else you can do. The executable never actually crashes any part of the OS to gain control of the OS and do something that the user doesn't authorize.
Parent
Trojan? (Score:5, Insightful)
You have to execute it yourself, and that is why it is _not_ a virus.
Reminds me of old Applescript "hacks" (Score:5, Interesting)
Another variant was useful on computers that were proteted with OnGuard or AtEase. Simply make a script that would pop up a dialog box asking for the password. An unknowning teacher would enter the password and the script would exit... leaving behind a log file with the password in it for later use.
Nothing magical about these. Very basic trojan horses.
10.5 Screenshots?! (Score:5, Funny)
I Like The Trojan Horse That Was Used (Score:5, Funny)
What wrapper will the first Linux widespread virus take? "Hey, download this PDF -- it's a transcript of a big IRC shouting match about which is better, emacs or vi! You gotta read this!"
We won't know what hit us...
Need a Universal Binary (Score:5, Funny)
When will Mac viruses get to the level of Windows when? For godsakes, this one still requires user intervention, and it doesn't even work on all OS X platforms!
Come on Apple! Microsoft has you soundly beaten in this regard
The vulnerability isn't always plugged in (Score:5, Insightful)
Never understimate the power of the incomptenece of 20% of your userbase.
Re:The vulnerability isn't always plugged in (Score:5, Insightful)
There is no way to compensate for an Administator who is computer illiterate. It's simply not possible. You can lower the bar as much as you like, however, there is a certain minimum level of knowledge which is required to safely administer a computer.
Like don't run every application you get your hand on. This is similar to don't delete all your files.
Parent
Five stages of grief (Score:5, Funny)
1. Denial and isolation
2. Anger
3. Bargaining
4. Depression
5. Acceptance
I think with the appropriate counseling, the MacOSRumors.com community will be just fine.
Re:Trojan Man? (Score:5, Informative)
Parent
Re:Trojan Man? (Score:5, Informative)
It's a "JPEG" because the author was clever enough to paste the icon of a JPEG onto the executable.
If the user is root, or possibly admin, the script writes files in
No kit, just a prompt.
http://www.ambrosiasw.com/forums/index.php?showto
Parent
Re:Trojan Man? (Score:5, Interesting)
How can a user differentiate between an executable file with a pretty icon and a jpeg in OSX (or Linux for that matter)? In Windows there are file extensions so a trojan with an icon will still have to be called something.exe in order to do any damage. How can I tell the difference between a binary file with an icon and a file that doesn't execute any code with the absense of extensions?
Please don't laugh
Parent
Re:Trojan Man? (Score:5, Funny)
Parent
Re:Trojan Man? (Score:5, Informative)
Um, why is my /Library chmod 775? It's that way on all four OS X machines that I can reach via SSH right now, two 10.4.x and two 10.3.x. Because there is no /Library/InputManagers in my /Library, so any program running under an admin account on my machine could create one. Admittedly, /Library/StartupItems being group-writable would be a much worse security violation (stuff in there runs as root at startup), and I have seen cases where installers will create one chmod 775 or 777, but I don't see any reason why a program that isn't setuid root (in other words, requiring the security dialog first) should be able to create new directories or drop files into /Library.
Anyhow, this is not a virus, it's a trojan. A virus attaches itself to existing executables (boot blocks included in the definition of "executables"). This is a trojan, and if it replicates, then it's a file-propagating worm (as opposed to the e-mail- and network- propagating worms that plague Windows). So far there is still no malware for OS X that doesn't depend upon human stupidity for propagation. Whether that be saving an e-mail attachment to disk and then double-clicking on its icon on the desktop (this thing won't auto-open while reading e-mail), or simply using bad username/password combinations allowing a brute-force break-in over SSH, there is still no sign of any kind of fully-automated malware for OS X.
In the meantime, I'm going to be doing a lot of "sudo chmod 755 /Library".
Parent
Re:Trojan Man? (Score:5, Insightful)
The only way would be some sort of flag that shows up on any icon that represents something executable, and that wouldn't be a fix but a completely new approach.
Parent
Re:Trojan Man? (Score:5, Interesting)
Parent
Re:Trojan Man? (Score:5, Insightful)
However what I'm not sure about is how you'd make this work for MacOS bundles -- unlike UNIX applications they're not just single files; the thing that you click on in the Finder to launch a MacOS app (at least a Cocoa one) is actually a directory if you look at it in the Terminal, it just has the hidden suffix of ".app" (so for instance the program Mail in the finder is actually the directory/folder Mail.app). The actual executable file is normally buried somewhere within the folder -- usually like (appname).app/Contents/MacOS/executablefile.
I suppose what you'd have to do is put the visual flag on if a file was either a directory ending in ".app", or if the regular eXecute bit was set on a file itself.
Parent
Re:Trojan Man? (Score:5, Insightful)
When I download a dmg file with Safari, I get a warning if the dmg contains an executable. (Not sure if that's Safari doing the warning or the code that mounts the archive or what.) Something like this in the code that unpacks tar files would go a long way toward fixing it.
Devon
Parent
Re:Trojan Man? (Score:5, Informative)
It doesn't really disguise as an image. It just uses the OS X standard icon for images as its own icon. However, it does not have a jpeg extension and if you select it in the finder, you will not get a preview thumbnail, thus you would know that opening in the Preview application (which you would do by double clicking) cannot work. Maybe, if you have set your Finder not to display extensions, or just didn't pay attention, you would try to open it in another image viewer, which would fail and not do any harm.
Parent
Re:Trojan Man? (Score:5, Informative)
Actually running/logging-in as root requires either some non-trivial Terminal work, or going in through NetInfo Manager (a fairly intimidating config utility) and enabling the root account (which at least the time I did it, a few years ago, gave you some pretty stern warnings).
That's not to say that you can't have root-like privs -- the default first user on a Mac is an "Administrator," which just means that they can sudo -s and become root temporarily. However to do this you have to authenticate for every action. (Or every 5 minutes or so.) The MacOS "Administrator" level user is not as powerful as the WinXP type of Administrator (which is effectively a root account). Macs have three levels of users: root, Admins (who can sudo), and everyone else (who can't).
So yes, there are definitely ways that a clueless person could damage themselves with a trojan, if they just mindlessly type in their password into any box that comes up, regardless of the context in which they're being asked, but there is at least one more step stopping you from doing it compared to running on a Windows system.
Parent
Re:Hehehe (Score:5, Funny)
Nah, that's just the title of Steve Jobs upcoming self-biography.
Parent