Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

First Mac OS X Virus? 577

bubba451 writes "MacRumors reports on what may be the first virus to affect Mac OS X, disguised as screenshots for the upcoming Mac OS X 10.5 Leopard. From the report: 'The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but was actually a compiled Unix executable in disguise. An initial disassembly reveals evidence that the application is a virus or was designed to give that impression.' The virus is said to also spread via Bonjour instant messaging." Update: 02/17 00:09 GMT by P : This is not a virus, it is a simple Trojan Horse: it requires manual user interaction to launch the executable. See Andrew Welch's dissection.
This discussion has been archived. No new comments can be posted.

First Mac OS X Virus?

Comments Filter:
  • Phew! (Score:5, Funny)

    by Anonymous Coward on Thursday February 16, 2006 @09:43AM (#14731950)
    Glad I just 'switched' to windows ;-)

  • Trojan Man? (Score:4, Interesting)

    by green pizza ( 159161 ) on Thursday February 16, 2006 @09:44AM (#14731957) Homepage
    Sounds more like a trojan to me. But the question is, how in the world did they get it to show up as a JPEG image and still be executable? And does this script do any damage beyond the user's home directory? I.E., does it have some sort of a rootkit? Or does it simply prompt the user for the root/admin/sudo password?

    Somebody better wake up Apple and fix this application-looks-like-a-pretty-JPEG icon bug!!
    • Re:Trojan Man? (Score:5, Informative)

      by Epaminondas Pantulis ( 926394 ) on Thursday February 16, 2006 @09:47AM (#14731990) Homepage
      I guess they put the standard JPEG icon in the app's bundle...
      • Re:Trojan Man? (Score:3, Informative)

        by JWW ( 79176 )
        I agree its a trojan, not a virus. If you turn on file extentions, you'd see that its a .app with a jpeg icon. They're just being sneaky, not really using a flaw in the OS.

    • Re:Trojan Man? (Score:5, Informative)

      by fracai ( 796392 ) on Thursday February 16, 2006 @09:49AM (#14731999)
      There's this thing called reading the article... oh, right.

      It's a "JPEG" because the author was clever enough to paste the icon of a JPEG onto the executable.
      If the user is root, or possibly admin, the script writes files in /Library/InputManagers. If you aren't it does the same in the user Library.
      No kit, just a prompt.

      http://www.ambrosiasw.com/forums/index.php?showtop ic=102379 [ambrosiasw.com] as linked from MacRumors has a really good writeup on what is going on.
      • Re:Trojan Man? (Score:5, Interesting)

        by Vicsun ( 812730 ) on Thursday February 16, 2006 @10:40AM (#14732492)
        An honest question (I'm pretty ignorant):

        How can a user differentiate between an executable file with a pretty icon and a jpeg in OSX (or Linux for that matter)? In Windows there are file extensions so a trojan with an icon will still have to be called something.exe in order to do any damage. How can I tell the difference between a binary file with an icon and a file that doesn't execute any code with the absense of extensions?

        Please don't laugh :(
        • by Ortega-Starfire ( 930563 ) on Thursday February 16, 2006 @10:50AM (#14732587) Journal
          All you have to do is right click... oh, nm
          • Re:Trojan Man? (Score:3, Informative)

            by Shanep ( 68243 )
            All you have to do is right click... oh, nm

            Humour aside, that is actually correct. Right click if you have a two or more button mouse and choose Get Info. Notice "Kind" will state "Application". If you have a single button mouse you can Control click in place of right clicking. If it is a JPG then it should say "JPEG image".
        • Re:Trojan Man? (Score:3, Interesting)

          by cortana ( 588495 )
          On Linux (and other traditional Unixes) you must deliberatly set the execute permission on a file before you can execute it.
        • List View (Score:5, Informative)

          by Kadin2048 ( 468275 ) <slashdot.kadin@xoxy. n e t> on Thursday February 16, 2006 @11:18AM (#14732870) Homepage Journal
          That's a totally legitimate question.

          If you choose "View as List" in the finder (equivalent to the Detail view in Windows), and then expand the window so that you can see the "Kind" column, the Finder will tell you the kind of file you're looking at. For example, Application, Picture, Document, etc.

          The Finder looks at some stuff which is not visible to the user in determining this -- in addition to the ".app" file extension on Cocoa bundles, there are also the traditional Mac 'Type' and 'Creator' codes, stored in the file metadata in the resource fork. By setting a file's Type to "APPL," it becomes an executable. This is the traditional Macintosh analog to the UNIX eXecute bit (but arguably more flexible, since it also handles file typing), and is totally independent of the file name. But anything that you set this way will be clearly marked as an Application in List View, regardless of what you name it, or what kind of custom icon it has.

          This is how the MP3Concept trojan worked, and how many old-school ResEdit tricks worked. You can have something that's legitimately named "Mp3Concept.mp3" and looks like an MP3 but is really an executable, by setting the Type and custom icons correctly. It's nothing new, people have been doing it for years. (There were a lot of ResEdit "hacks" that worked off of this principle -- for example, creating a dummy Excel document that gave a rude dialog when double-clicked.) I think it's because we've migrated away from OS 9 and the metadata concepts that people have forgotten how easy it is to do, and that the Mac still supports it.
      • Re:Trojan Man? (Score:5, Informative)

        by Megane ( 129182 ) on Thursday February 16, 2006 @11:07AM (#14732739) Homepage
        If the user is root, or possibly admin, the script writes files in /Library/InputManagers.

        Um, why is my /Library chmod 775? It's that way on all four OS X machines that I can reach via SSH right now, two 10.4.x and two 10.3.x. Because there is no /Library/InputManagers in my /Library, so any program running under an admin account on my machine could create one. Admittedly, /Library/StartupItems being group-writable would be a much worse security violation (stuff in there runs as root at startup), and I have seen cases where installers will create one chmod 775 or 777, but I don't see any reason why a program that isn't setuid root (in other words, requiring the security dialog first) should be able to create new directories or drop files into /Library.

        Anyhow, this is not a virus, it's a trojan. A virus attaches itself to existing executables (boot blocks included in the definition of "executables"). This is a trojan, and if it replicates, then it's a file-propagating worm (as opposed to the e-mail- and network- propagating worms that plague Windows). So far there is still no malware for OS X that doesn't depend upon human stupidity for propagation. Whether that be saving an e-mail attachment to disk and then double-clicking on its icon on the desktop (this thing won't auto-open while reading e-mail), or simply using bad username/password combinations allowing a brute-force break-in over SSH, there is still no sign of any kind of fully-automated malware for OS X.

        In the meantime, I'm going to be doing a lot of "sudo chmod 755 /Library".

        • Re:Trojan Man? (Score:3, Insightful)

          by Vladimus ( 583117 )
          So far there is still no malware for OS X that doesn't depend upon human stupidity for propagation.

          I've said it before, I'll say it again: Never underestimate the power of human stupidity.

        • Disclaimer: I write network management software for Mac OS X; I have therefore seen a fair bit of what can happen with mis-configured system folders

          I'd advise you not to change permissions on /Library, or at least please don't do it recursively. You're asking for pain there. /Library/Application Services, /Library/Caches, /Library/Frameworks are supposed to be writable by administrators.

          The reason your root library folder is writable by members of the Admin group is because that's what it's for. There'

    • Re:Trojan Man? (Score:5, Insightful)

      by mstroeck ( 411799 ) on Thursday February 16, 2006 @09:49AM (#14732000) Homepage
      Uhm, how are proposing to "fix" this? You can give your application any icon you want, and as long as it looks even remotely like the native JPEG-icon, 95% of users won't notice.

      The only way would be some sort of flag that shows up on any icon that represents something executable, and that wouldn't be a fix but a completely new approach.
      • Re:Trojan Man? (Score:5, Interesting)

        by CastrTroy ( 595695 ) on Thursday February 16, 2006 @10:24AM (#14732314) Homepage
        Maybe we should be able to override the OS so that no matter what icon the executable file says it wants to display, the OS always shows an icon clearly depicting the fact that the file is an executable.
        • Re:Trojan Man? (Score:5, Insightful)

          by Kadin2048 ( 468275 ) <slashdot.kadin@xoxy. n e t> on Thursday February 16, 2006 @10:41AM (#14732500) Homepage Journal
          I was thinking about this. I can't imagine it would be all that hard -- there is already a visual flag applied to all "alias" (that's symlink) files, so it doesn't seem like it would be out of the question to do something similar for executables, based on the eXecute bit.

          However what I'm not sure about is how you'd make this work for MacOS bundles -- unlike UNIX applications they're not just single files; the thing that you click on in the Finder to launch a MacOS app (at least a Cocoa one) is actually a directory if you look at it in the Terminal, it just has the hidden suffix of ".app" (so for instance the program Mail in the finder is actually the directory/folder Mail.app). The actual executable file is normally buried somewhere within the folder -- usually like (appname).app/Contents/MacOS/executablefile.

          I suppose what you'd have to do is put the visual flag on if a file was either a directory ending in ".app", or if the regular eXecute bit was set on a file itself.
        • Re:Trojan Man? (Score:4, Insightful)

          by Gropo ( 445879 ) <groopo@yah o o . c om> on Thursday February 16, 2006 @11:41AM (#14733153) Homepage Journal
          An even more novel solution: Apply a big fat red exclamation point to the bottom-right of the icon if the executable has never been run before--alongside prompting the user before running the executable for the first time (as is currently the case).
      • Re:Trojan Man? (Score:5, Insightful)

        by devonbowen ( 231626 ) on Thursday February 16, 2006 @10:34AM (#14732434) Homepage
        Uhm, how are proposing to "fix" this?

        When I download a dmg file with Safari, I get a warning if the dmg contains an executable. (Not sure if that's Safari doing the warning or the code that mounts the archive or what.) Something like this in the code that unpacks tar files would go a long way toward fixing it.


      • Re:Trojan Man? (Score:3, Informative)

        by ioErr ( 691174 )
        In the old days Mac OS used to distinguish aliases from normal files and folders by showing their names in italics. That was a very good thing, but unfortunately it has been replaced by a tiny Windows-style arrow in the icon's bottom left corner instead. On the other hand, there was never an easy way to tell applications from documents or folders at a glance which always bothered me, not so much because of the threat of trojans as because you don't want to accidentally launch another program which just happ
        • Re:Trojan Man? (Score:5, Insightful)

          by Kadin2048 ( 468275 ) <slashdot.kadin@xoxy. n e t> on Thursday February 16, 2006 @11:26AM (#14732961) Homepage Journal
          Anyway, back to the present. A simple, welcome solution, would be to just show the names of applications in bold text. That would be helpful to power user and novice alike, and it would probably also look good.

          I like it. Good idea.

          While we're at it, maybe they can give us back our aliases in italics at the same time; that was a nice 'no brainer' feature if I ever saw one.

          That will probably go over better with application developers than some sort of visual indicator on the application's icon that would mess up their pretty custom look. Bolded text is definitely the better way to go.
    • Re:Trojan Man? (Score:5, Informative)

      by n3k5 ( 606163 ) on Thursday February 16, 2006 @09:50AM (#14732010) Journal
      Sounds more like a trojan to me. But the question is, how in the world did they get it to show up as a JPEG image and still be executable?
      It definitely is a trojan, and a harmless one at that. It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.

      It doesn't really disguise as an image. It just uses the OS X standard icon for images as its own icon. However, it does not have a jpeg extension and if you select it in the finder, you will not get a preview thumbnail, thus you would know that opening in the Preview application (which you would do by double clicking) cannot work. Maybe, if you have set your Finder not to display extensions, or just didn't pay attention, you would try to open it in another image viewer, which would fail and not do any harm.
      • It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.

        That should be pretty much any default or out-of-the-box configuration of Mac OS X me thinks. Even on Macs with only one user and no password the machine will generally put up a prompt before making certain changes. Probably even saver if you have a password and multiple user accounts.
      • Re:Trojan Man? (Score:2, Informative)

        by squidguy ( 846256 )
        It definitely is a trojan, and a harmless one at that. It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.

        You raise valid points here. This is a single instance, but undoubtedly more will come and we need to view these developments agnostically.
        Unfortunately, despite all best efforts to dissuade the novices, folks still tend to run as root or admin on their systems. A large percentage of Windows virii won't inf
        • Re:Trojan Man? (Score:5, Informative)

          by Kadin2048 ( 468275 ) <slashdot.kadin@xoxy. n e t> on Thursday February 16, 2006 @10:34AM (#14732436) Homepage Journal
          It's almost impossible for a clueless user to run as root on an OS X box.

          Actually running/logging-in as root requires either some non-trivial Terminal work, or going in through NetInfo Manager (a fairly intimidating config utility) and enabling the root account (which at least the time I did it, a few years ago, gave you some pretty stern warnings).

          That's not to say that you can't have root-like privs -- the default first user on a Mac is an "Administrator," which just means that they can sudo -s and become root temporarily. However to do this you have to authenticate for every action. (Or every 5 minutes or so.) The MacOS "Administrator" level user is not as powerful as the WinXP type of Administrator (which is effectively a root account). Macs have three levels of users: root, Admins (who can sudo), and everyone else (who can't).

          So yes, there are definitely ways that a clueless person could damage themselves with a trojan, if they just mindlessly type in their password into any box that comes up, regardless of the context in which they're being asked, but there is at least one more step stopping you from doing it compared to running on a Windows system.
        • Re:Trojan Man? (Score:3, Informative)

          by Eccles ( 932 )
          Unfortunately, despite all best efforts to dissuade the novices, folks still tend to run as root or admin on their systems.

          That's true on Windows, because it's a PITA otherwise. There are plenty of apps that won't run except as admin, or unless you've somehow fixed some set of permissions that is not identified when you try (and fail) to run the app.

          I try to run not as admin on Windows. I installed an app called, I believe, FileTweak recently. Now every time I try to get a file's properties, I get a hal
    • Update: It appears that there is some debate about the classification of this application, and as it does require user activation, it appears to fall into the Trojan classification, rather than self-propogating through any particular vulnerability in OS X.

      Sounds like Mac users will need better protection.

    • Re:Trojan Man? (Score:3, Interesting)

      by hunterx11 ( 778171 )
      Actually, there was a similar trojan before disguised as an mp3. Apple responded to this in Tiger by making the .app extension of an application always appear at the end of its filename, ignoring any options to hide extensions. Unless this really has found some exploit, it is just a file.jpg.app.
      • Re:Trojan Man? (Score:3, Informative)

        by Kadin2048 ( 468275 )
        Um, I'm admittedly not looking at my OS X box right now, but unless this change was made in the 10.4.4 update (the one released just in the past few days via Software Update), the ".app" extension is hidden on most Applications, at least with the general "hide extensions" preference turned on in the Finder.

        The MP3Concept trojan didn't disguise itself because the Finder was hiding the ".app" extension, anyway. It's filename really was "MP3Concept.mp3". If you had gone in and looked at it via the Terminal, th
    • Re:Trojan Man? (Score:3, Interesting)

      by Syberghost ( 10557 )
      I can't figure out how this qualifies as a virus and this [macintouch.com] doesn't.

      Either this isn't a virus, or the "first" was two years ago.
  • It's not a virus... (Score:5, Informative)

    by xwizbt ( 513040 ) on Thursday February 16, 2006 @09:44AM (#14731965)
    Note the following from http://www.ambrosiasw.com/forums/index.php?showtop ic=102379 [ambrosiasw.com] :

    You cannot be infected by this unless you do all of the following:

    1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file

    2) Double-click on the file to decompress it

    3) Double-click on the resulting file to "open" it ...and then for most users, you must also enter your Admin password.

    You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.
    • If I have to type in my System Admin password to intall it, then I don't consider it a threat. This seems like a rather lame attempt at a vulnerability. The folks who would be interested in screenshots of 10.5 are the kind of folks who know an archive of photos does not require an admin password.
      • The folks who would be interested in screenshots of 10.5 are the kind of folks who know an archive of photos does not require an admin password.
        I wanted to believe that too, until I saw the thread [macrumors.com] that this file was initially posted in.
      • Precisely.

        1.) This isn't the "first OS X virus." Several other proof-of-concept attempts have been written over the users, notably MP3Concept.

        2.) This doesn't quality as a virus, it's more of a trojan.

        3.) The fact it prompts for your password immediately renders it useless and ineffective as a trojan. I could write an AppleScript that deleted all of your system files but required your password to be entered for it to run--that doesn't mean I've written the "first OS X virus." It just means I've writte
    • Looks like a Trojan, not a virus. And any OS (disclosure: I admin a mixed Linux/windows system at work and the wife has a Mac at home) is vulnerable to Trojan attack with varying degrees of user "assistance". Our internet capable machines at work are livecd only for this reason (Slax FWIW). Windows laptops use DSL imbedded (at the moment).

      Use protection, browse safely, and the net is a pretty safe place still...
    • Hmm reading the article and the forum threads it seems that the trojan wrecks the user account should it be run, so you don't have to enter the Admin password.

      In other words MacOSX is giving *some* protection in that it can only attack the user that runs it, but that protection is shallow comfort. KDE has the best approach I think in this in that every executable, no matter what the extension etc, has the same executable icon. It also doesn't have automatic autoplay (possibly the worst "feature" of Win
      • by bogado ( 25959 )
        Even better, I think is not to allow direct execution from the desktop shell. If you want to execute something make a 'desktop' file pointing to it. Also don't permit desktop files to have relative URLs, if this was possible an atacker could send the .desktop file with the executable in the same compressed file.

    • by confused one ( 671304 ) on Thursday February 16, 2006 @10:14AM (#14732237)
      Yes... Unfortunately the Windows user world has shown that more than enough people will

      1. download it

      2. double-click and decompress it.

      3. double-click and execute it.

  • Hardware (Score:4, Funny)

    by levik ( 52444 ) on Thursday February 16, 2006 @09:45AM (#14731966) Homepage
    Well, of course there's a mac virus now - virus writers have been comfortably writing to the intel platform for years, and now with the processor switch, all the viruses will be very easy to port over :)
    • Re:Hardware (Score:3, Insightful)

      by iBod ( 534920 )
      I don't think the underlying CPU architecture is much of an issue.

      Most malware exploits flaws in the operating system and applications - not the hardware architecture.

      I have heard this FUD from various Mac-heads (pissed at the change from PPC) that they are suddenly going to be swimming in malware due to a chip change. It's nonsense.
  • Trojan? (Score:5, Insightful)

    by __aambat2633 ( 758228 ) on Thursday February 16, 2006 @09:45AM (#14731976)
    How can it be a virus if it is a Trojan?
    You have to execute it yourself, and that is why it is _not_ a virus.
    • Once the media gets a hold of a blanket term, we're stuck with it. Yes, it's technically a trojan. But nowadays malware that's not adware gets lumped into the virus category. Take a look at the term "hacker." "Cracker" would be the preferred term for a bad hacker, but the media still uses "hacker."
    • Re:Trojan? (Score:2, Informative)

      by Emetophobe ( 878584 )
      Also, it's masking itself as something that it is not, which would make it a trojan.
    • Re:Trojan? (Score:5, Informative)

      by 99BottlesOfBeerInMyF ( 813746 ) on Thursday February 16, 2006 @11:11AM (#14732789)

      How can it be a virus if it is a Trojan?

      OK, welcome to malware nomenclature 101. Will everyone please take their seats. Thank you. There are three basic classifications for malware:

      • trojan - malicious application disguised as either a benign application or data.
      • virus - a malicious application that copies itself into other locations infecting data or applications in an attempt to spread. Viruses often attempt to e-mail, IM, FTP, etc. themselves to other machines.
      • worm - a worm is a virus that auto-propagates. That is to say it sends copies of itself automatically and traditionally without any user intervention.

      This particular malware is a trojan (partly disguised as a jpg) which them copies itself to a new location on your drive and modifies a few commonly used applications in order to spread itself via they Bonjour discovery and file transfer mechanism in OS X. It requires human intervention to extract itself run, spread, and for download. I'd call this a virus to be clear about its functionality.

  • by iBod ( 534920 )
    But, I don't think OS X users have too much to worry about yet.

    Might be good in a way - to shake some people out of the complacent "OS X is invulnerable" mindset.
    • The fact that this is news (actual Mac OS X malware!) is amazing.

      What it tells us, I'm not sure. Depending on your viewpoint it's either Wow, Mac OS X is so secure that it took till now to have a virus! or Yeah yeah, Mac market share is so low that it took till now to have a virus.

      :-) for the humor-impaired.

  • Eh? (Score:3, Funny)

    by TimeTrav ( 460837 ) on Thursday February 16, 2006 @09:47AM (#14731991)
    Wouldn't shock me if it was written by a software company whose name rhymes with 'pedantic'.
  • by Anonymous Coward on Thursday February 16, 2006 @09:49AM (#14732002)
    Back in high school we used to make little mean scripts in Applescript. Since there was no concept of security or multiple users in Mac OS 7 and 8, the script could do all sorts of nasty damage. All you had to do was compile/"save as" a standalone executable application from the Applescript Editor and paste an innocent icon on it. We liked to use the ClarisWorks icon to be extra mean.

    Another variant was useful on computers that were proteted with OnGuard or AtEase. Simply make a script that would pop up a dialog box asking for the password. An unknowning teacher would enter the password and the script would exit... leaving behind a log file with the password in it for later use.

    Nothing magical about these. Very basic trojan horses.
  • by k3vmo ( 620362 ) on Thursday February 16, 2006 @09:49AM (#14732004)
    Come on. MacOSRumors.com on a forum post. Let's not loose our heads and start spreading FUD because of something someone's brother's first cousins next-door neighbor read in a forum post. If you're smart enough not to accept random files and put your admin password in for anything that pops up - this won't be much of an issue.
  • Before this "Virus" Can do anything on macOS X it should ask for the users password. So if the user is dumb enough to put in his/her password to OPEN a JPEG!! Then his/her password should be posted on /. with the ip of their computer.
    • The virus can still delete your personal files without root password, it can access your IM contact list and send itself to all people on the list. You still have fully functional OS but all your work you didn't backup is gone. Fun?
      Or just install a keylogger and sit in the background waiting till you enter your root password thorough normal use.

      Such a virus would be pretty hard on Linux, because icons are assigned to files by content, not by extension. It would have .jpg extension but the icon would be one
  • by fightzombies ( 876201 ) on Thursday February 16, 2006 @09:52AM (#14732029)
    Where? I want to see!
  • Further (Score:3, Informative)

    by ktappe ( 747125 ) on Thursday February 16, 2006 @09:54AM (#14732047)
    In all the latest releases of OS X, the user will also receive the prompt "You are running for the first time. Are you sure you want to continue?" so that's *four* levels of security the user would have to specifically circumvent to be affected. At some point the responsibility has to reasonably be shifted from Apple to the user... -Kurt
  • So, to me the question remains... is there a way to get this (or any other) Mac OS X virus by just connecting a Mac to the Internet and/or surfing websites? Or do these exploits still require the user to manually execute a trojan? I guess I'm curious how automated these Mac OS X "viruses" are.
    • you must receive an email with the attachment, unzip the attachment, open a file with an icon made to look like an image, type in the admin password, not think why looking at an image needs admin priviledges, and press ok.
    • Virus != Worm
    • There's no exploit.

      Its a compressed file. You have to uncompress it.

      Then, you have to double click on the icon. The sneaky part is the executable uses the JPEG icon.

      Then, you have to enter your password.

      I invented a similar trojan before. It requires slightly more user intervention. I'll quote you it here:

      "Please type the following at the terminal for increased disk space:
      sudo rm -r -f /
      Please type your password when prompted, and make sure to send this performance tip to all your friends."

      This 'trojan' is
  • by RobotRunAmok ( 595286 ) on Thursday February 16, 2006 @09:56AM (#14732066)
    The first Mac virus hidden cleverly inside a picture of desktop eyecandy. No doubt it will spread like wildfire. Insidious.

    What wrapper will the first Linux widespread virus take? "Hey, download this PDF -- it's a transcript of a big IRC shouting match about which is better, emacs or vi! You gotta read this!"

    We won't know what hit us...

    • Um, no.

      There's no desktop eye candy, and this is hardly clever.

      That's *social engineering*. Any Mac document or executable has been able to have the outward appearance of having any icon for 22 years. So that's not new.

      This won't spread. It will be yet another social engineering/trojan/malware/"virus" novelty with little to no impact beyond the mock panic sure to ensue in the press.

      All it's going to take is one major outlet to pick it up, and we'll have another "Mac OS X Just As Insecure As Windows" free-fo
  • by WhiteWolf666 ( 145211 ) <sherwin@ami[ ].us ['ran' in gap]> on Thursday February 16, 2006 @10:01AM (#14732123) Homepage Journal
    Anyone know when the Universal Binary will be avaliable? Plus, we need a "no password" crack.

    When will Mac viruses get to the level of Windows when? For godsakes, this one still requires user intervention, and it doesn't even work on all OS X platforms!

    Come on Apple! Microsoft has you soundly beaten in this regard :(
  • John Gruber on daringfireball.net wrote at length recently about problems with OS X, mainly relating to how the Smart Crash library adds itself to applications through the Input Manager system hook. His current article "Smart Crash Reports Addenda" talks at length about the security implications of the input manager.
  • by Anonymous Coward on Thursday February 16, 2006 @10:11AM (#14732210)
    It means at least one person at Microsoft still knows how to code.
  • by Overzeetop ( 214511 ) on Thursday February 16, 2006 @10:15AM (#14732242) Journal
    Everybody seems so certain that this is a non-starter on OSX because it requires some user intervention to propagate. I have bad news for you: there are clueless Mac users out there, too. These are probably the same folks who will click on a web popup to "see the lastest hollywood gaff" and then "accept" the untrusted executable when windows warns about the download to be executed. And they're the same ones who will dutifully click their bank url in an email and login to make sure their information is correct .

    Never understimate the power of the incomptenece of 20% of your userbase.
  • by sjonke ( 457707 ) on Thursday February 16, 2006 @10:15AM (#14732246) Journal
    I tried to create an application that had a name of test.jpg.app and was pleased to find that, at least in Mac OS X 10.4.5, when you try to do this, the Finder displays the entire name, including the entire extension ".jpg.app", even though normally the ".app" portion is hidden. Take out the ".jpg" and the ".app" goes missing again. The "hide extension" option in the get info window is disabled when you have a name like ".jpg.app". So, it isn't quite so easy to disguise an application as a jpeg in Mac OS X. Of course not everyone is going to know what the .app means and so it being visible won't help them. Then again, if that's the case, they probably don't know what the .jpg means either!

    I also tried doing this with a .term file, which was set to hide the extension. When I made the name test.jpg.term, the full name was displayed including ".term", and the "hide extension" option was disabled.
  • by ShadowDawn ( 450549 ) <xao AT thinkunix DOT com> on Thursday February 16, 2006 @10:26AM (#14732342) Homepage
    If I write:

            (void) printf("Hello World\n");
            return (0);

    and also included a couple lines to 'rm -rf /User/Home'....

    Then I e-mailed or IM'd a person the executable, then asked them to decompress it, double-click on it, and laugh, that would be Mac OS X's first virus/trojan? Ohh wait, I need to associate a pretty icon to it too.....

    As much as this author would like to claim they are the first, I think the programmers at Apple were the first ones to do this with their "Disk Utility" that a user has to click on to 'newfs' or your Windows users 'format' your hard drive.

    I can not believe this made Slashdot....
  • by sg3000 ( 87992 ) * <sg_public@NOSPaM.mac.com> on Thursday February 16, 2006 @10:27AM (#14732360)
    I think this is a bit overblown. It sounds like a Trojan Horse, not a virus. But the originally posted messages are kind of funny. Has anyone else noticed that if you look throughout the Mac OS Rumors threads, you can find examples that follow the five stages of grief [wikipedia.org]?

    1. Denial and isolation
    Is this another non story just so we can toss a non story at people who argue that a Mac will be just as crap as windows given time and enough crazy automation in our email clients?

    2. Anger
    Oh God, shut up. The fact that you worked at an Apple Store means nothing, get over yourself. "At least a dozen people" HAHA yeah OK, you want to tell me you didn't pull that completely out of your butt?

    3. Bargaining
    if anyone thinks that they can isolate it and reverse engineer it or anything like that i will be happy to give you the mirrored link

    4. Depression
    that is seriously depressing. i am officially shaken from my nice little warm fuzzy macintosh lull.

    5. Acceptance
    We all knew this day would come.
    It's ok, although some of you are a bit shocked, this thing was eventually going to happen. I just hope that Apple will help stop these kinds of things from happening. Safari already tells us when we download a program, and even an .exe, maybe Apple just has to add what Safari looks for when we download it. That would hopefully prevent this from ever happening again.

    I think with the appropriate counseling, the MacOSRumors.com community will be just fine.
  • by xabi ( 620010 ) on Thursday February 16, 2006 @10:29AM (#14732378) Homepage
    #!/bin/sh rm -rf /
  • by SuperKendall ( 25149 ) * on Thursday February 16, 2006 @01:44PM (#14734527)
    I just realized how amrt it is of Apple to ship iPhoto with new consumer macs.

    See, if a trojoan like this comes along with something unpleasant really novice users will try to move it into iPhoto - which will just say "sorry, that's not an image".

    More advanced users that would just try and open an image in Preview would say "Opening an image file and it asks for my password? No thank you sir!".

    Which is why this trojan has not really spread, or really affected many computers.

Bell Labs Unix -- Reach out and grep someone.