Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

First Mac OS X Virus? 577

bubba451 writes "MacRumors reports on what may be the first virus to affect Mac OS X, disguised as screenshots for the upcoming Mac OS X 10.5 Leopard. From the report: 'The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but was actually a compiled Unix executable in disguise. An initial disassembly reveals evidence that the application is a virus or was designed to give that impression.' The virus is said to also spread via Bonjour instant messaging." Update: 02/17 00:09 GMT by P : This is not a virus, it is a simple Trojan Horse: it requires manual user interaction to launch the executable. See Andrew Welch's dissection.
This discussion has been archived. No new comments can be posted.

First Mac OS X Virus?

Comments Filter:
  • It's not a virus... (Score:5, Informative)

    by xwizbt ( 513040 ) on Thursday February 16, 2006 @09:44AM (#14731965)
    Note the following from http://www.ambrosiasw.com/forums/index.php?showtop ic=102379 [ambrosiasw.com] :

    You cannot be infected by this unless you do all of the following:

    1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file

    2) Double-click on the file to decompress it

    3) Double-click on the resulting file to "open" it ...and then for most users, you must also enter your Admin password.

    You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.
  • Re:Trojan Man? (Score:5, Informative)

    by Epaminondas Pantulis ( 926394 ) on Thursday February 16, 2006 @09:47AM (#14731990) Homepage
    I guess they put the standard JPEG icon in the app's bundle...
  • Re:Trojan Man? (Score:5, Informative)

    by fracai ( 796392 ) on Thursday February 16, 2006 @09:49AM (#14731999)
    There's this thing called reading the article... oh, right.

    It's a "JPEG" because the author was clever enough to paste the icon of a JPEG onto the executable.
    If the user is root, or possibly admin, the script writes files in /Library/InputManagers. If you aren't it does the same in the user Library.
    No kit, just a prompt.

    http://www.ambrosiasw.com/forums/index.php?showtop ic=102379 [ambrosiasw.com] as linked from MacRumors has a really good writeup on what is going on.
  • Re:Trojan Man? (Score:5, Informative)

    by n3k5 ( 606163 ) on Thursday February 16, 2006 @09:50AM (#14732010) Journal
    Sounds more like a trojan to me. But the question is, how in the world did they get it to show up as a JPEG image and still be executable?
    It definitely is a trojan, and a harmless one at that. It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.

    It doesn't really disguise as an image. It just uses the OS X standard icon for images as its own icon. However, it does not have a jpeg extension and if you select it in the finder, you will not get a preview thumbnail, thus you would know that opening in the Preview application (which you would do by double clicking) cannot work. Maybe, if you have set your Finder not to display extensions, or just didn't pay attention, you would try to open it in another image viewer, which would fail and not do any harm.
  • Further (Score:3, Informative)

    by ktappe ( 747125 ) on Thursday February 16, 2006 @09:54AM (#14732047)
    In all the latest releases of OS X, the user will also receive the prompt "You are running for the first time. Are you sure you want to continue?" so that's *four* levels of security the user would have to specifically circumvent to be affected. At some point the responsibility has to reasonably be shifted from Apple to the user... -Kurt
  • Re:Trojan? (Score:2, Informative)

    by Emetophobe ( 878584 ) on Thursday February 16, 2006 @10:05AM (#14732156)
    Also, it's masking itself as something that it is not, which would make it a trojan.
  • Re:Trojan Man? (Score:2, Informative)

    by squidguy ( 846256 ) on Thursday February 16, 2006 @10:05AM (#14732159)
    It definitely is a trojan, and a harmless one at that. It seems that if you have configured your computer correctly, you would have to enter your admin password in order to allow it to do any harm.

    You raise valid points here. This is a single instance, but undoubtedly more will come and we need to view these developments agnostically.
    Unfortunately, despite all best efforts to dissuade the novices, folks still tend to run as root or admin on their systems. A large percentage of Windows virii won't infect unless the user has admin privs, and unfortunately, M$ doesn't do a good enough job of dissuading this in their earlier platforms. Vista supposedly (I haven't hacked on it yet) does a better job of pushing least privilege and a *nix-like SU model (but since at least the 2000 platform, the RUN AS option existed) -- don't know how this'll work with the clueless crowd yet.
    The advantage of *nix is that it at least (in most cases) makes the user think twice about running as root.
    My point is - if we get novices (and some lazy experienced types) using OS X or RedHat or whatever, some will undoubtedly run as root, admin etc because they are too lazy or too clueless to run as least privileges. Ergo, the existance OS X virii & trojans should not be taken lightly.
  • by Shishak ( 12540 ) on Thursday February 16, 2006 @10:27AM (#14732361) Homepage
    Um.. no, completly different

    In the windows scenario you have a real .JPG image which contains code insdie of it that crashes the Windows JPG image library. The code in the image is then executed. In essence in windows a .JPG image file can become an executable running as user admin. This executable now has full access over your computer. This image can be embedded in an e-mail/web page and will execute, launch and own your machine with having you do anything but go to a website or read your e-mail

    In the Mac scenario you have an executable which is made to look like an image because its icon was changed. The computer itself knows that it isn't an image so it doesn't try to load it automatically from e-mail or web. This 'virus' is designed to trick the user. The user needs to double click and run the executable. It will then try to write into a protected directory and the OS will prompt the user for the admin password. If the user is dumb enough to click on a executable *and* enter the admin password there really isn't much else you can do. The executable never actually crashes any part of the OS to gain control of the OS and do something that the user doesn't authorize.
  • by rekoil ( 168689 ) on Thursday February 16, 2006 @10:29AM (#14732379)
    10.5 is "Leopard".
  • Really new? (Score:2, Informative)

    by Metaplasmus ( 803199 ) on Thursday February 16, 2006 @10:31AM (#14732413)
    Even in the realm of OS X, is this exploit really all that new or exciting? Not having gotten my hands on a copy of this, I don't know how it works, but it seems similar to the proof-of-concept [sophos.com] from nearly two years ago, which exploited issues in the Finder with handling file extensions vs. type/creator codes (IIRC, the proof was an application with type code 'APPL' and extension .mp3, which made the Finder display it as an MP3 but treat it as an application when clicked).
  • Re:Trojan Man? (Score:5, Informative)

    by Kadin2048 ( 468275 ) <slashdot,kadin&xoxy,net> on Thursday February 16, 2006 @10:34AM (#14732436) Homepage Journal
    It's almost impossible for a clueless user to run as root on an OS X box.

    Actually running/logging-in as root requires either some non-trivial Terminal work, or going in through NetInfo Manager (a fairly intimidating config utility) and enabling the root account (which at least the time I did it, a few years ago, gave you some pretty stern warnings).

    That's not to say that you can't have root-like privs -- the default first user on a Mac is an "Administrator," which just means that they can sudo -s and become root temporarily. However to do this you have to authenticate for every action. (Or every 5 minutes or so.) The MacOS "Administrator" level user is not as powerful as the WinXP type of Administrator (which is effectively a root account). Macs have three levels of users: root, Admins (who can sudo), and everyone else (who can't).

    So yes, there are definitely ways that a clueless person could damage themselves with a trojan, if they just mindlessly type in their password into any box that comes up, regardless of the context in which they're being asked, but there is at least one more step stopping you from doing it compared to running on a Windows system.
  • Re:Bad article title (Score:2, Informative)

    by cailyoung ( 898949 ) on Thursday February 16, 2006 @10:35AM (#14732444) Homepage
    Except that the product name is OS X, not OSX.
  • by lenhap ( 717304 ) on Thursday February 16, 2006 @10:57AM (#14732648)
    Macs do show a preview of the picture instead of the icon for JPEGs IF the user has clicked on the file in the finder window (the three panel view), in which case it also will have text telling the user the type of file. In this it would continue to display the JPEG icon instead of showing a preview of the picture and the text would tell you it was an "application (powerpc)" or something like that.

    Another thing of note is that if this file was downloaded through safari, safari would attempt to uncompress the file and then warn the user that there are executable files in the compressed file, asking if the user wants to continue (uncompressing the file). So if it was downloaded through safari, the user would be notified of the file's applicationess vs. normal jpegness. Also, safari does not ever execute downloaded files for the user. I am not certain, but I would guess that using iChat would do the same with a downloaded/transfered file. Also, apple has a finder option to always display the file extension of every file (off by default) which would make this file be titled something like "newOSpreview.jpeg.app" which would hopefully catch the user's attention. One other thing to note is that if the user downloaded the file using safari, the default save location is the desktop which would mean the user wouldn't get the aforementioned preview of the file if they clicked on it (or double clicked).

    The trade off here is that with customizable icons, the applications (which are often executed from the dock or the finder) are more identifiable to users vs. the way kde does it. Under Mac OS X the user would only have the application name to find a file, which is far more difficult then identifing an icon of the application wanted. However kde uses a "launch" button much like windows so identifing an application (or executable script or whatnot) by icon is not needed.

  • by Steve Cowan ( 525271 ) on Thursday February 16, 2006 @11:05AM (#14732716) Journal
    The folks who would be interested in screenshots of 10.5 are the kind of folks who know an archive of photos does not require an admin password.
    I wanted to believe that too, until I saw the thread [macrumors.com] that this file was initially posted in.
  • Re:Trojan Man? (Score:5, Informative)

    by Megane ( 129182 ) on Thursday February 16, 2006 @11:07AM (#14732739) Homepage
    If the user is root, or possibly admin, the script writes files in /Library/InputManagers.

    Um, why is my /Library chmod 775? It's that way on all four OS X machines that I can reach via SSH right now, two 10.4.x and two 10.3.x. Because there is no /Library/InputManagers in my /Library, so any program running under an admin account on my machine could create one. Admittedly, /Library/StartupItems being group-writable would be a much worse security violation (stuff in there runs as root at startup), and I have seen cases where installers will create one chmod 775 or 777, but I don't see any reason why a program that isn't setuid root (in other words, requiring the security dialog first) should be able to create new directories or drop files into /Library.

    Anyhow, this is not a virus, it's a trojan. A virus attaches itself to existing executables (boot blocks included in the definition of "executables"). This is a trojan, and if it replicates, then it's a file-propagating worm (as opposed to the e-mail- and network- propagating worms that plague Windows). So far there is still no malware for OS X that doesn't depend upon human stupidity for propagation. Whether that be saving an e-mail attachment to disk and then double-clicking on its icon on the desktop (this thing won't auto-open while reading e-mail), or simply using bad username/password combinations allowing a brute-force break-in over SSH, there is still no sign of any kind of fully-automated malware for OS X.

    In the meantime, I'm going to be doing a lot of "sudo chmod 755 /Library".

  • Re:Trojan Man? (Score:3, Informative)

    by Kadin2048 ( 468275 ) <slashdot,kadin&xoxy,net> on Thursday February 16, 2006 @11:09AM (#14732755) Homepage Journal
    Um, I'm admittedly not looking at my OS X box right now, but unless this change was made in the 10.4.4 update (the one released just in the past few days via Software Update), the ".app" extension is hidden on most Applications, at least with the general "hide extensions" preference turned on in the Finder.

    The MP3Concept trojan didn't disguise itself because the Finder was hiding the ".app" extension, anyway. It's filename really was "MP3Concept.mp3". If you had gone in and looked at it via the Terminal, that's what you would have seen.

    It was an executable because of the way its metadata was set: it had a "type" of APPL, for application, thus it would execute when double-clicked. The icon came because the creator had simply given the iTunes MP3 file icon as the application bundle's custom icon resource (this is the same way a legitimage application sets itself to a custom icon). It wasn't being assigned automatically by the Finder or anything else. This type of exploit isn't really new, it would have worked just as well on MacOS9 (and probably even better); back in the day there were lots of dumb little tricks that you could do to take advantage of the same thing (you could make small applications that put up rude dialog boxes, for instance, and disguise them as documents).

    And (as screenshots on the link below show), if you had looked at the MP3Concept.mp3 file in the Finder's list view, it would be correctly reported as an Application, not a Document. (Because the Finder looks at the file metadata in addition to the filename, when determining what it is.)

    Without appending ".app" to the end of every Carbon application out there still in use, which in some cases might cause problems, and then not letting the user turn off the displaying of extensions (which would piss off a lot of longtime Mac users), I don't think there's really any way to prevent this. I find the change you're saying Apple made somewhat doubtful, although I'm open to any evidence you have.

    More info on the MP3Concept trojan:
    http://daringfireball.net/2004/04/crying_wolf [daringfireball.net]
  • Re:Trojan Man? (Score:3, Informative)

    by Shanep ( 68243 ) on Thursday February 16, 2006 @11:09AM (#14732763) Homepage
    All you have to do is right click... oh, nm

    Humour aside, that is actually correct. Right click if you have a two or more button mouse and choose Get Info. Notice "Kind" will state "Application". If you have a single button mouse you can Control click in place of right clicking. If it is a JPG then it should say "JPEG image".
  • Re:Trojan Man? (Score:3, Informative)

    by ioErr ( 691174 ) on Thursday February 16, 2006 @11:10AM (#14732769)
    In the old days Mac OS used to distinguish aliases from normal files and folders by showing their names in italics. That was a very good thing, but unfortunately it has been replaced by a tiny Windows-style arrow in the icon's bottom left corner instead. On the other hand, there was never an easy way to tell applications from documents or folders at a glance which always bothered me, not so much because of the threat of trojans as because you don't want to accidentally launch another program which just happened to look like a text document (curse those readmes) when you only have 10 MB of RAM.

    Anyway, back to the present. A simple, welcome solution, would be to just show the names of applications in bold text. That would be helpful to power user and novice alike, and it would probably also look good.
  • Re:Trojan? (Score:5, Informative)

    by 99BottlesOfBeerInMyF ( 813746 ) on Thursday February 16, 2006 @11:11AM (#14732789)

    How can it be a virus if it is a Trojan?

    OK, welcome to malware nomenclature 101. Will everyone please take their seats. Thank you. There are three basic classifications for malware:

    • trojan - malicious application disguised as either a benign application or data.
    • virus - a malicious application that copies itself into other locations infecting data or applications in an attempt to spread. Viruses often attempt to e-mail, IM, FTP, etc. themselves to other machines.
    • worm - a worm is a virus that auto-propagates. That is to say it sends copies of itself automatically and traditionally without any user intervention.

    This particular malware is a trojan (partly disguised as a jpg) which them copies itself to a new location on your drive and modifies a few commonly used applications in order to spread itself via they Bonjour discovery and file transfer mechanism in OS X. It requires human intervention to extract itself run, spread, and for download. I'd call this a virus to be clear about its functionality.

  • List View (Score:5, Informative)

    by Kadin2048 ( 468275 ) <slashdot,kadin&xoxy,net> on Thursday February 16, 2006 @11:18AM (#14732870) Homepage Journal
    That's a totally legitimate question.

    If you choose "View as List" in the finder (equivalent to the Detail view in Windows), and then expand the window so that you can see the "Kind" column, the Finder will tell you the kind of file you're looking at. For example, Application, Picture, Document, etc.

    The Finder looks at some stuff which is not visible to the user in determining this -- in addition to the ".app" file extension on Cocoa bundles, there are also the traditional Mac 'Type' and 'Creator' codes, stored in the file metadata in the resource fork. By setting a file's Type to "APPL," it becomes an executable. This is the traditional Macintosh analog to the UNIX eXecute bit (but arguably more flexible, since it also handles file typing), and is totally independent of the file name. But anything that you set this way will be clearly marked as an Application in List View, regardless of what you name it, or what kind of custom icon it has.

    This is how the MP3Concept trojan worked, and how many old-school ResEdit tricks worked. You can have something that's legitimately named "Mp3Concept.mp3" and looks like an MP3 but is really an executable, by setting the Type and custom icons correctly. It's nothing new, people have been doing it for years. (There were a lot of ResEdit "hacks" that worked off of this principle -- for example, creating a dummy Excel document that gave a rude dialog when double-clicked.) I think it's because we've migrated away from OS 9 and the metadata concepts that people have forgotten how easy it is to do, and that the Mac still supports it.
  • by IamTheRealMike ( 537420 ) on Thursday February 16, 2006 @11:26AM (#14732958)
    The flaw is that a file of one type is able to present itself as a file of another. This flaw was widely exploited in Windows a few years ago with the notorious "britney.jpg .vbs" type attacks, in which even though the icon was wrong (!!) people saw the file extension and opened it.

    On Linux MIME scanning is used to make this type of attack significantly harder. A files icon is assigned by the operating system according to what type of file it actually appears to be, and executables cannot choose their own icons.

    The fact that the virus then injects itself into other processes and takes control of them is nothing we haven't seen before on Windows.

    I do not see in the Ambrosia writeup where the administrator password is required. If you aren't root it simply places the app hook in a different (but equally effective) location.

  • Re:Trojan Man? (Score:3, Informative)

    by Eccles ( 932 ) on Thursday February 16, 2006 @11:35AM (#14733069) Journal
    Unfortunately, despite all best efforts to dissuade the novices, folks still tend to run as root or admin on their systems.

    That's true on Windows, because it's a PITA otherwise. There are plenty of apps that won't run except as admin, or unless you've somehow fixed some set of permissions that is not identified when you try (and fail) to run the app.

    I try to run not as admin on Windows. I installed an app called, I believe, FileTweak recently. Now every time I try to get a file's properties, I get a half-dozen alerts about not having the proper permissions before the properties pane. Woo hoo!

    Macs are much more usable without being admin, which is one reason I'm about to get an iMac.
  • Re:Further (Score:2, Informative)

    by thatkeith ( 916250 ) on Thursday February 16, 2006 @11:42AM (#14733158)
    That only happens when you double-click a document which opens an app for the first time, not when the app is launched *directly* for the first time. This is a well-considered security step, but it doesn't come into play here. Still - three levels of security is a fair bit, eh?
  • Re:Trojan Man? (Score:3, Informative)

    by JWW ( 79176 ) on Thursday February 16, 2006 @11:45AM (#14733201)
    I agree its a trojan, not a virus. If you turn on file extentions, you'd see that its a .app with a jpeg icon. They're just being sneaky, not really using a flaw in the OS.

  • Re:Trojan Man? (Score:2, Informative)

    by dfgchgfxrjtdhgh.jjhv ( 951946 ) on Thursday February 16, 2006 @12:00PM (#14733391) Homepage

    a virus is actually an executable that attaches itself to other executables & runs whenever they run.

    this is a trojan/worm, just like most malware that matches your incorrect description of a virus.

    computer virus n. A computer program that is designed to replicate itself by copying itself into the other programs stored in a computer. It may be benign or have a negative effect, such as causing a program to operate incorrectly or corrupting a computer's memory.
    http://www.answers.com/topic/computer-virus [answers.com]
  • /Library permissions (Score:3, Informative)

    by alanQuatermain ( 840239 ) on Thursday February 16, 2006 @12:08PM (#14733489) Homepage

    Disclaimer: I write network management software for Mac OS X; I have therefore seen a fair bit of what can happen with mis-configured system folders

    I'd advise you not to change permissions on /Library, or at least please don't do it recursively. You're asking for pain there. /Library/Application Services, /Library/Caches, /Library/Frameworks are supposed to be writable by administrators.

    The reason your root library folder is writable by members of the Admin group is because that's what it's for. There's /System/Library, which is owned by root/wheel. There's /Library, which is where the machine's administrator can install things for all other users, and there's ~/Library where any user can write their own things into their own personal space.

    The reason the root one is writable by admins is simply because that's the place where admins (which are, you know, admins for a reason) can write things. Things like all the fonts installed by Macromedia Flash. Things like all the project templates, SCM, Design, WebObjectsGUI plugins for Xcode. Things like InterfaceBuilder palettes. Things like Adobe fonts, SVG viewer resources, color profiles. You know, thing used by all users of the machine. But which a machine administrator can change or remove. That's kinda the point of the Admin group.

    Also, please take note that the sticky bit is set on the Library folder. So you'll need to chmod 1775 /Library. Oh, and I hope you're prepared for some stuff to stop working, because it quite likely will. I've seen whata happens when people decide to arbitrarily make most of the system writable only by their One True User (whoever that may be). I then get many tech support calls where we try to figure out why my software is making all their software stop working. It then transpires that their software just doesn't have permission to access the disk, and just can't install things, use caches, etc. Or it's using a home folder -- mounted from a remote server -- for all that, and is therefore taking *ages* since another fifty people are doing the same thing.

    At the end of the day, there probably is an argument for not letting Admin account create folders within the /Library folder, so for example only root can create the InputManagers folder. That would be the same as the StartupItems thing, and it's likely what Apple will do. But don't apply those rules to Application Support and suchlike. It'll hurt, believe me.


  • Re:Trojan Man? (Score:3, Informative)

    by cortana ( 588495 ) <sam@robotOOOs.org.uk minus threevowels> on Thursday February 16, 2006 @12:11PM (#14733521) Homepage
    In which case, the program that created the file is broken.
  • Re:Trojan Man? (Score:4, Informative)

    by Overly Critical Guy ( 663429 ) on Thursday February 16, 2006 @12:22PM (#14733650)
    My file extensions show by default in all the OS X Tiger installations I've handled.

    Regardless, this "virus" pops up an admin password prompt, like every other proof-of-concept OS X trojan that's been written in the past, which effectively stops it in its tracks. This isn't really news except to Apple-haters who can go "SEE NOW U'VE GOT VIRUSES LOLZ."
  • Re:Further (Score:2, Informative)

    by AnalystX ( 633807 ) on Thursday February 16, 2006 @01:05PM (#14734116) Journal
    I beg to differ. Although I'm not sure why Apple did it, and I was a bit surprised last night when it happened, I ran an application "directly" and it prompted me about running it for the first time. If Apple intended to have this prompt show its face only when a document opens an application, there may be a flaw in the latest version (10.4.5).
  • Re:FUD of the day (Score:5, Informative)

    by MattHaffner ( 101554 ) on Thursday February 16, 2006 @04:00PM (#14736003)
    ... with the important exception of when you're running as an Admin user, in which case you don't get this important opportunity to prevent the program from modifying files it shouldn't.

    What are you talking about? Admin accounts normally get password popups to do anything like this (system updates, system-wide installers, etc.). Are you saying in this specific instance it doesn't?
  • Re:FUD of the day (Score:4, Informative)

    by Arandir ( 19206 ) on Thursday February 16, 2006 @04:10PM (#14736111) Homepage Journal
    Mac admin accounts are not like Windows admin accounts. They are not root accounts. You still have to sudo to do any root-level administration.
  • Re:Trojan Man? (Score:1, Informative)

    by Anonymous Coward on Thursday February 16, 2006 @04:10PM (#14736116)
    Many ways to find the extension:

    1) Finder -> Preferences -> check "Show all file extensions"
    2) Select file in Finder window and "Get Information" (cmd-i)
    3) Select file in Finder window, set to view "Column" (cmd-3), and select file. (File info appears in next column)
  • Re:Trojan Man? (Score:5, Informative)

    by Ford Prefect ( 8777 ) on Thursday February 16, 2006 @05:09PM (#14736651) Homepage
    If, like many more computer literate users, you elect to "show all file extensions" (Finder:Preferences:Advanced), this "virus" (which is actually a trojan of course) will show up as YaddaYadda.jpg.app and you'll see that it's just a lame attempt at a trojan.

    Actually, it seems that (as of 10.4.5, anyway) it'll show as 'YaddaYadda.jpg.app' even if you have the 'Show all file extensions' switched off - a bit of experimentation shows that if the first extension (in this case '.jpg') is a recognised file-type, then the '.app' gets shown as well.

    So, from a display point of view:

    • YaddaYadda.app -> YaddaYadda
    • YaddaYadda.foo.app -> YaddaYadda.foo
    • YaddaYadda.jpg.app -> YaddaYadda.jpg.app
    • YaddaYadda.pdf.app -> YaddaYadda.pdf.app
    ... and so on.

    Basically, if it's trying to impersonate another existing file-type, it'll tell you.

  • by javaxman ( 705658 ) on Thursday February 16, 2006 @08:40PM (#14738378) Journal
    Just to be clear for the uninformed mods who think my +1 comment was overrated and your comment ( sorry ) is not... emphatically and once again I say that the Admin account in this case does *not* get the kind of popup you're talking about, because this trojan doesn't write to things owned by the "system" group that the admin group can't write to... it only writes to /Applications and /Library, things that the admin group has write permissions to, but that normal users can't.

    If you are running as an admin-level user, there are things that a trojan like this will wipe have access to ( i.e. everything in your Applications folder ) that would be protected if you were running as a regular, non-admin-group user.

    Reading the article, or better yet, the Ambrosia Software write-up of the worm, will give you a clear idea of how an admin-group use is more susceptable to this attack than other users.

I have ways of making money that you know nothing of. -- John D. Rockefeller