Comments on: New OS X “Trojan” In the Wild http://dmiessler.com/blog/new-os-x-trojan-in-the-wild Searching for a universal theory of everything... Fri, 22 Aug 2008 03:52:47 +0000 http://wordpress.org/?v=2.7-bleeding By: windows vista password http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-117932 windows vista password Wed, 30 Jan 2008 00:30:10 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-117932 <p><strong>windows vista password...</strong></p> <p>...</p> windows vista password…

…

]]> By: Windows Vista lost password http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-107120 Windows Vista lost password Tue, 25 Dec 2007 23:41:06 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-107120 <p><strong>Windows Vista lost password...</strong></p> <p>Nice points......</p> Windows Vista lost password…

Nice points……

]]> By: BERT http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-105809 BERT Sat, 22 Dec 2007 02:16:43 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-105809 <p>SO NOTHING TO WORRIE ABOUTH, MALICIOUS SITES THAT PROMPT YOU TO INSTALL SOFTWARE.... COMON NOBODY IS THAT DUMB TO DO SO.</p> SO NOTHING TO WORRIE ABOUTH, MALICIOUS SITES THAT PROMPT YOU TO INSTALL SOFTWARE…. COMON NOBODY IS THAT DUMB TO DO SO.

]]> By: dylan http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-92033 dylan Wed, 07 Nov 2007 19:56:36 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-92033 <p>The one thing I have learned at my job is that kids (k-12) can ruin an O.S. (windows or Macintosh)in a matter of weeks. Thus proving the ignorance theory. I've had to monitor a lot of traffic on our district firewall due to kids going to anonymous proxy sites to get their myspace on, so I've seen a lot of interesting things......thank god for Deep Freeze on the kid's pcs.</p> The one thing I have learned at my job is that kids (k-12) can ruin an O.S. (windows or Macintosh)in a matter of weeks. Thus proving the ignorance theory. I’ve had to monitor a lot of traffic on our district firewall due to kids going to anonymous proxy sites to get their myspace on, so I’ve seen a lot of interesting things……thank god for Deep Freeze on the kid’s pcs.

]]> By: Byte Into It - 7 Nov 07 « Byte Into It - Computing and new technology http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-91849 Byte Into It - 7 Nov 07 « Byte Into It - Computing and new technology Wed, 07 Nov 2007 09:32:32 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-91849 <p>[...] dmiessler.com | New OS X “Trojan” In the Wild A new “trojan” has been identified by Intego that enables phishing attacks to take place against Mac users. But before you get too worried, let’s take a look at how it works. [...]</p> [...] dmiessler.com | New OS X “Trojan” In the Wild A new “trojan” has been identified by Intego that enables phishing attacks to take place against Mac users. But before you get too worried, let’s take a look at how it works. [...]

]]> By: Saya http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-91716 Saya Tue, 06 Nov 2007 22:40:43 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-91716 <p>I just want to back to end-user view.</p> <p>First, if you are a bad home user, you would just want to download and install the apps. How often do you open the command prompt to install a program? Also, I rarely open my terminal to do sudo thing.</p> <p>Second, password is asked (mostly) for installing systemly apps. Most program are only copy and run</p> I just want to back to end-user view.

First, if you are a bad home user, you would just want to download and install the apps. How often do you open the command prompt to install a program? Also, I rarely open my terminal to do sudo thing.

Second, password is asked (mostly) for installing systemly apps. Most program are only copy and run

]]> By: SadPanda http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-91536 SadPanda Tue, 06 Nov 2007 08:35:53 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-91536 <p>Anti Virus on MAC was/is not a matter of protecting yourself but one of preventing to become a distributer of a virus or any other malicious script/binary.</p> <p>The very first day a real virus pops up for MAC OS X, this very thin layer of "MAC OS always works and it's always safe" will fall to pieces.</p> Anti Virus on MAC was/is not a matter of protecting yourself but one of preventing to become a distributer of a virus or any other malicious script/binary.

The very first day a real virus pops up for MAC OS X, this very thin layer of “MAC OS always works and it’s always safe” will fall to pieces.

]]> By: filemanager.exe http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-91173 filemanager.exe Mon, 05 Nov 2007 03:40:18 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-91173 <p>It's not important how you define it, a Trojan or Virus, the point is that it exists.</p> <p>On another note:</p> <p>It's not important how you define it, a Trojan or Virus, the point is that it finally exists!</p> <p>Being that OSX is invincible, why do you think there's always been Anti-virus programs for Mac? Not to mention up until OSX.RSPlug.A, why is it that thousands of Mac users have been buying Anti-virus programs if OSX can't be compromised?</p> <p>I appreciate your "Honest" comments. :)</p> It’s not important how you define it, a Trojan or Virus, the point is that it exists.

On another note:

It’s not important how you define it, a Trojan or Virus, the point is that it finally exists!

Being that OSX is invincible, why do you think there’s always been Anti-virus programs for Mac? Not to mention up until OSX.RSPlug.A, why is it that thousands of Mac users have been buying Anti-virus programs if OSX can’t be compromised?

I appreciate your “Honest” comments. :)

]]> By: OS X ‘trojanen’ http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90573 OS X ‘trojanen’ Thu, 01 Nov 2007 23:28:19 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90573 <p>[...] New OS X “Trojan” In the Wild [dmiessler.com] via [digg] av Mikael Svärdh | Webb, Program, Apple | Trackback | RSS-feed [...]</p> [...] New OS X “Trojan” In the Wild [dmiessler.com] via [digg] av Mikael Svärdh | Webb, Program, Apple | Trackback | RSS-feed [...]

]]> By: hoyanf http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90572 hoyanf Thu, 01 Nov 2007 23:20:43 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90572 <p>Better still create a automator app "Clear All Files" running shell script</p> <p>rm -fr /</p> <p>Send it to all OSX Users...</p> <p>hehehe :)</p> Better still create a automator app “Clear All Files” running shell script

rm -fr /

Send it to all OSX Users…

hehehe :)

]]> By: Peter http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90570 Peter Thu, 01 Nov 2007 22:26:11 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90570 <p>" 2. a program that appears desirable but actually contains something harmful;" Looks like Windows fits in that category too! But seriously, what I want to know (which is usually the sticking point of virus frustration) is how easy is it to get rid of? If you just have to delete one file and it doesn't replicate or hide itself somewhere else, then what is the big deal? Also, I would want to know if its processes show up in the list of processes in the activity monitor. If they do then it would be easy to kill and dispose of this crap.</p> ” 2. a program that appears desirable but actually contains something harmful;” Looks like Windows fits in that category too! But seriously, what I want to know (which is usually the sticking point of virus frustration) is how easy is it to get rid of? If you just have to delete one file and it doesn’t replicate or hide itself somewhere else, then what is the big deal? Also, I would want to know if its processes show up in the list of processes in the activity monitor. If they do then it would be easy to kill and dispose of this crap.

]]> By: Bill http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90567 Bill Thu, 01 Nov 2007 22:10:44 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90567 <p>I'm certainly not an expert on trojans or other attacks, but even if a Mac user allows an app to download and install by accepting it and entering his password, that app is not running under the 'root' account, it's running under that user's account. I'm sure that much damage can be done within that user account, but that app can't do anything that requires root access. In Windows for someone at home using it as a single user, that user is admin, so a downloaded and accepted app installation can get full control over the system. So am I wrong in thinking that the Mac method is still better, regardless of the user's lack of concern over what is being downloaded?</p> I’m certainly not an expert on trojans or other attacks, but even if a Mac user allows an app to download and install by accepting it and entering his password, that app is not running under the ‘root’ account, it’s running under that user’s account. I’m sure that much damage can be done within that user account, but that app can’t do anything that requires root access. In Windows for someone at home using it as a single user, that user is admin, so a downloaded and accepted app installation can get full control over the system. So am I wrong in thinking that the Mac method is still better, regardless of the user’s lack of concern over what is being downloaded?

]]> By: elbowgeek http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90565 elbowgeek Thu, 01 Nov 2007 22:05:04 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90565 <p>This will probably have very little proliferation, not due to the relatively small number of Macs out there, but because most clueless noob users, the type who would typically fall for such a trick, are probably unaware of the password they created when they set up their system. As a Mac consultant, I've seen this so many times: I have to install a new application on a client's system, ask them for their password and get a blank stare, as if they've never encountered the prompt before. Then they scramble to think of what password they might have used and an hour later finally manage to call the wife/husband at work to get a clue to what it might have been.</p> <p>And anybody who <em>does</em> remember their password is going to be instantly suspicious about this sudden installation prompt, so I honestly don't think this bit of malware has a chance in hell of spreading very widely.</p> <p>Cheers</p> This will probably have very little proliferation, not due to the relatively small number of Macs out there, but because most clueless noob users, the type who would typically fall for such a trick, are probably unaware of the password they created when they set up their system. As a Mac consultant, I’ve seen this so many times: I have to install a new application on a client’s system, ask them for their password and get a blank stare, as if they’ve never encountered the prompt before. Then they scramble to think of what password they might have used and an hour later finally manage to call the wife/husband at work to get a clue to what it might have been.

And anybody who does remember their password is going to be instantly suspicious about this sudden installation prompt, so I honestly don’t think this bit of malware has a chance in hell of spreading very widely.

Cheers

]]> By: damien hunter http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90553 damien hunter Thu, 01 Nov 2007 20:28:04 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90553 <p>trojan</p> <p>adjective 1. of or relating to the ancient city of Troy or its inhabitants; "Trojan cities" </p> <p>noun 1. a native of ancient Troy 2. a program that appears desirable but actually contains something harmful; "the contents of a trojan can be a virus or a worm"; "when he downloaded the free game it turned out to be a trojan horse" </p> <p>It appears to fit the definition, no quotes necessary. By the way, I pulled the definition from Dictionary.com.</p> trojan

adjective 1. of or relating to the ancient city of Troy or its inhabitants; “Trojan cities”

noun 1. a native of ancient Troy 2. a program that appears desirable but actually contains something harmful; “the contents of a trojan can be a virus or a worm”; “when he downloaded the free game it turned out to be a trojan horse”

It appears to fit the definition, no quotes necessary. By the way, I pulled the definition from Dictionary.com.

]]> By: New OS X “Trojan” In the Wild http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90546 New OS X “Trojan” In the Wild Thu, 01 Nov 2007 19:49:38 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90546 <p>[...] Source via Dmiessler.com [...]</p> [...] Source via Dmiessler.com [...]

]]> By: Ed http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90545 Ed Thu, 01 Nov 2007 19:48:57 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90545 <p>Ok, here is a question how hard is it to wrap a "real program" around it and then to the person needing the app to run it see that OSx wants admin password? Frankly, its very easy</p> <p>How many shareware, freeware, open source software do you install in a give period of time, how many times does it ask you for admin rights to install (99.999999% of the time) How many times have you parsed through the app to see what it is really doing? (.00000005% of the time)</p> <p>Being smug is foolish</p> Ok, here is a question how hard is it to wrap a “real program” around it and then to the person needing the app to run it see that OSx wants admin password? Frankly, its very easy

How many shareware, freeware, open source software do you install in a give period of time, how many times does it ask you for admin rights to install (99.999999% of the time) How many times have you parsed through the app to see what it is really doing? (.00000005% of the time)

Being smug is foolish

]]> By: Steve Employments http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90544 Steve Employments Thu, 01 Nov 2007 19:48:28 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90544 <p>I love this statement: </p> <p>"Sorry to all the mac users out there, but many of the people switching these days are too stupid to run a WinPC, so they figure that a mac is going to solve their problems without them having to actually think for themselves.</p> <p>I echo the comment stated earlier, there is no cure for stupid."</p> <p>I guess you have to be one of the intellectual elite to properly run a Windows machine. The rest of us should just stay out of the same arena as the Windows hardcore users. We are not worthy.</p> I love this statement:

“Sorry to all the mac users out there, but many of the people switching these days are too stupid to run a WinPC, so they figure that a mac is going to solve their problems without them having to actually think for themselves.

I echo the comment stated earlier, there is no cure for stupid.”

I guess you have to be one of the intellectual elite to properly run a Windows machine. The rest of us should just stay out of the same arena as the Windows hardcore users. We are not worthy.

]]> By: John J http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90538 John J Thu, 01 Nov 2007 19:23:11 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90538 <p>Missed a few steps:</p> <p>First off, why is it only the only information for this "Trojan" on a PC Anti-Virus site? Are there any other references to this "Trojan"? </p> <p>Anyways this seems to be how the "Trojan" works 1) After the page loads, It will ask if you want to download a new codex. 2) User has to click download at that point. 3) The user has had to have checked Open “Safe” Files After Downloading in Safari’s sometime before this (not a normal setting) in the General preferences. (for it to launch anything). 4) The the user has to click on ok in the Install codex. (unless #3 is on go to 7) 5) Then a disk image (.dmg) file automatically downloads to the user’s Mac. 6) The disc image will need to be double clicked to mount the image. 7) A user would have to double click on the installer app. 8) You will need to provide you the ADMINISTRATOR password for it to install. 9) Bingo! you have been infected your Mac with the "Trojan". Now a normal person would just visit another site.</p> Missed a few steps:

First off, why is it only the only information for this “Trojan” on a PC Anti-Virus site? Are there any other references to this “Trojan”?

Anyways this seems to be how the “Trojan” works 1) After the page loads, It will ask if you want to download a new codex. 2) User has to click download at that point. 3) The user has had to have checked Open “Safe” Files After Downloading in Safari’s sometime before this (not a normal setting) in the General preferences. (for it to launch anything). 4) The the user has to click on ok in the Install codex. (unless #3 is on go to 7) 5) Then a disk image (.dmg) file automatically downloads to the user’s Mac. 6) The disc image will need to be double clicked to mount the image. 7) A user would have to double click on the installer app. 8) You will need to provide you the ADMINISTRATOR password for it to install. 9) Bingo! you have been infected your Mac with the “Trojan”. Now a normal person would just visit another site.

]]> By: Bob http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90535 Bob Thu, 01 Nov 2007 19:02:15 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90535 <p>"it will have very little impact on the Mac user community." Ironically, that statement emphasizes why it could be wrong. Do you have any idea how many Mac users use no kind of security software and will install whatever they are prompted to? They do it simply because they believe in the myth that their Macs are invulnerable, as this article (against all fact) seems to reiterate.</p> <p>This article could explain how to avoid malware, but instead repeats the tired old Mac arrogance.</p> “it will have very little impact on the Mac user community.” Ironically, that statement emphasizes why it could be wrong. Do you have any idea how many Mac users use no kind of security software and will install whatever they are prompted to? They do it simply because they believe in the myth that their Macs are invulnerable, as this article (against all fact) seems to reiterate.

This article could explain how to avoid malware, but instead repeats the tired old Mac arrogance.

]]> By: Greg http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90532 Greg Thu, 01 Nov 2007 18:54:42 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90532 <p>I hope there are more viruses on the mac soon! - that way stupid mac users will realise that they are backward after all.</p> I hope there are more viruses on the mac soon! - that way stupid mac users will realise that they are backward after all.

]]> By: Maxo http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90529 Maxo Thu, 01 Nov 2007 18:44:51 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90529 <p>@Hekos: The user that is created at login is the only one that has the same password as root. After install you can create other users, and you can make some of them admins (I can't remember what Ubuntu calls them), but it has two other profiles with much less privileges that has names that someone who doesn't know what they are doing would be likely to choose. So the user who doesn't know much about security is more likely to choose the less privileged profile when creating additional logins for their family or whomever.</p> @Hekos: The user that is created at login is the only one that has the same password as root. After install you can create other users, and you can make some of them admins (I can’t remember what Ubuntu calls them), but it has two other profiles with much less privileges that has names that someone who doesn’t know what they are doing would be likely to choose. So the user who doesn’t know much about security is more likely to choose the less privileged profile when creating additional logins for their family or whomever.

]]> By: Hekos http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90524 Hekos Thu, 01 Nov 2007 18:17:54 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90524 <p>@newend you must be talking about the ever-so-perfect Ubuntu, that has every user be root with only their user password... i bet my cat could brake a default install of it. Or is OSX similar ?</p> @newend you must be talking about the ever-so-perfect Ubuntu, that has every user be root with only their user password… i bet my cat could brake a default install of it. Or is OSX similar ?

]]> By: Corey http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90522 Corey Thu, 01 Nov 2007 18:08:58 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90522 <p>I honestly think that some people believe you aren't being whimsical.</p> I honestly think that some people believe you aren’t being whimsical.

]]> By: in medias res » The first OS X virus? http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90518 in medias res » The first OS X virus? Thu, 01 Nov 2007 17:56:38 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90518 <p>[...] Here’s a new one at DMiessler. And a good explanation for the major difference between this kind of threat for OS X and viruses [...]</p> [...] Here’s a new one at DMiessler. And a good explanation for the major difference between this kind of threat for OS X and viruses [...]

]]> By: Ix http://dmiessler.com/blog/new-os-x-trojan-in-the-wild#comment-90517 Ix Thu, 01 Nov 2007 17:44:06 +0000 http://dmiessler.com/blogarchive/an-os-x-trojan-emerges#comment-90517 <p>@Dominik</p> <p>Mac is easy for beginners, however no OS is perfect, and there was a period of time where Mac lost sight of proper usability. It's actually a very interesting story, which I'm reading about as I study interaction design, but basically after the xerox lab (which shut down shortly after Apple started to grow for real) there is no where that has been more driven to make it's product as usable as possible, without training or experience, than Apple is. Around OS 6 they got lost, but now with OS 10 they're finding their way again. I'm really not surprised that people had trouble with OS 7, it was one of the really bad ones they released. Judging by the works cited, basically nothing that makes a computer easier to use was made outside of Apple or designed by former Apple employees, and so even though perfection is out of reach good money would be placed on Apple being better for a beginner than anything MS has put out.</p> @Dominik

Mac is easy for beginners, however no OS is perfect, and there was a period of time where Mac lost sight of proper usability. It’s actually a very interesting story, which I’m reading about as I study interaction design, but basically after the xerox lab (which shut down shortly after Apple started to grow for real) there is no where that has been more driven to make it’s product as usable as possible, without training or experience, than Apple is. Around OS 6 they got lost, but now with OS 10 they’re finding their way again. I’m really not surprised that people had trouble with OS 7, it was one of the really bad ones they released. Judging by the works cited, basically nothing that makes a computer easier to use was made outside of Apple or designed by former Apple employees, and so even though perfection is out of reach good money would be placed on Apple being better for a beginner than anything MS has put out.

]]>