Omg - A Mac Virus!!!

[Thurrdome]

Look at this:

http://www.techworld.com/security/news/index.cfm?newsid=5392&inkc=0

:confused: :confused: :confused: :eek: :eek:

It's about time someone came up with one!!!

[TwoRails]

It had to happen some time...

[ComputerNut]

I stick with my motto (which im sure many people here do): There is NO such thing as a 100% secure OS.

[FLG]

The only reason why Mac hasent been exploited as mutch as windows is because the amount of people using Mac is alot less then the vast majority of us using windows.

Same goes for Firefox, and Opera as opposed to IE.

[Statica]

I wish these sites would report the complete details of the virus rather than just the most sensational bits of it.
From: Securityfocus (http://www.securityfocus.com/brief/142)

There are also a number of steps that require user interaction for a system to be infected: the user must first be sent the infected file (manually by email, or automated via iChat instant messaging), then the user must double-click and decompress the image, open the image, and finally provide his administrator account and password for the code to be installed. Once installed, the malicious code attempts to hook the launching of any application in a user's application library, and then inject code into application executables. However, a bug in the virus' coding prevents the launching of any application executable after infection.
(IMO, if the user is that callous, they deserve to get infected anyway)

If you read further, it also has a blurb about why OSX and other NIXes are more resilient, than Windows (XP and lower) platforms (Vista, I might add is going to have LUA). It has everything to do with priveleges being used. FLG, I've heard that statement come up time and time again, but sooner or later people are going to have to realize that the architecture has a lot to do with why some platforms are "easier" to get into than others. As a comparison take a look at the infection method on a typical Windows platform
Step 1: Read an email

[HAL9000]

Umm... you gotta know as well as I do Statica... some users are just that dumb... and dumber.

[FLG]

Statica your 100% right, though the fact that Mac isnt as widely used does play a role in this. Im sure if we turned the tables and had Mac as the most widely used OS there would be more exploits for it then there are now...as many as windows?? Most likely not, but more none the less.

[David M]

The last I read Macs were about 4% of the home computer market. You don't need any more proof than the size of the shelves in the computer stores that hold the Mac software vs the size of the shelves that hold the PC software. If I were a little dirtbag who wrote viruses, I would not bother writing them for 4% of the computers either.

Waiting for the Mac fans to weigh in on this. :D

[Mac Medic]

Woohoo, Mac virus..... Don't think it'll spread too fast though considering the user has to actually get the file first, decompress it, install it and provide admin credentials for it to run!!!!!.... Humm, some people maybe that stupid though. I still think you'll see windows virii slow to a crawl too when vista gets released considering it'll require user intervention to install a program also.

[HAL9000]

I think you give people too much credit... people are dumb enuf to do what a program says. How about I create a little amusing game with the virus implanted... just do the install... whoops.. the install requires the admin password... gawd.. I really wanna play.... types in password.. wheee this is fun.

Anyone ever deal with the clowns that received an e-mail saying... oooh.. new virus... NO antivirus detects it... go to your Windows folder and do a search.. it will have a little teddybear icon.. DELETE IMMEDIATELY.... do you realize how many idiots did this?

[tomster2300]

I've learned to ignore any of those emails about how current viruses are destroying the world and you need to do this and that to protect yourself. It's better to continue maintaining a solid defense all the time then to go out looking for a problem when you get word of it.

[HAL9000]

I actually got one about a month ago that of all places, SEARS announced a virus... I never knew they were into virus detection too.

[enhanced08]

Anyone ever deal with the clowns that received an e-mail saying... oooh.. new virus... NO antivirus detects it... go to your Windows folder and do a search.. it will have a little teddybear icon.. DELETE IMMEDIATELY.... do you realize how many idiots did this?

uhh... I have to admit, I was one of the ones who did this! :o My IT teacher told me about it years ago, before I knew what I do now about computers. I assume he got it in his email and told me about it, I have never gotten an email about it myself.



This teacher is also the guy who told me that there were no viri for Macs and that there was some "contest" that if someone could get a virus on a Mac the Apple CEO or someone high up there would give them $100k! He's full of it sometimes but is a good guy overall.

[Mac Medic]

This actually wasn't the first supposed Mac OS X Virus either. Anyone remember the Trojan (just a proof of concept, not malicious) that spoofed itself as an MP3 file? It was just an application in an MP3 wrapper (extention.mp3 instead of .app). Apple fixed this bug when that appeared. So now anyone who gets this .jpg will see that it's .app (provided file extensions are turned on) and hopefully will know better. I have no doubt some people will install it but it hasn't spread yet and I just don't see it happening. I'm personally not aware of a single infection. Compare that to the 1000's of windows infection that occur without any user intervention and you may begin to see why I credit people with a little common sense, it just hasn't spread and I still honestly believe that the same thing will happen under Vista where you will supposedly have to authenticate before installing an application.

[Mac Medic]

This teacher is also the guy who told me that there were no viri for Macs and that there was some "contest" that if someone could get a virus on a Mac the Apple CEO or someone high up there would give them $100k! He's full of it sometimes but is a good guy overall.

This is actually true, there was a contest for $7000 (I think it's still running but it's not Apple doing it) for the first virus or piece of malicious code that installs "itself" (without user intervention) and is able to run. This .jpg/.app doesn't meet the criteria though as the user has to go through a few steps to install it. And yes, OS X is still virus free.


Securityfocus
"As major media outlets scramble to label this new malicious code as the first virus for OS X, the poorly-written Trojan is in fact not a true virus. It is also not the first example of malicious code to appear on modern Macs, but is perhaps the most virus-like malicious code that the Apple community has seen this decade. Nearly six years after Apple first released OS X, the popular operating system remains virus free - the only question is, for how much longer."

[HAL9000]

A virus is a virus is a virus no matter how it is installed.. whether it be automatically or installed by the id-10-t behind the keyboard... so say it is not would be to say that if I intentionally injected myself with a flu virus and got sick, that it wasn't actually a virus and I was never sick.

[rspassey]

A virus is a virus is a virus no matter how it is installed.. whether it be automatically or installed by the id-10-t behind the keyboard... so say it is not would be to say that if I intentionally injected myself with a flu virus and got sick, that it wasn't actually a virus and I was never sick.

Nice analogy! I agree completely.

[Mac Medic]

Well, not according to securityfocus.

[HAL9000]

Goodie for them

[TwoRails]

So, if someone has to click on something or run something to get infected, then it's not a virus?...

[Mac Medic]

No, I don't think so. I think what they're saying is that a program that masquerades as something else is a Trojan, goodie for them I say.

[enhanced08]

A virus should be defined as something that casuses harm to a computer without the user knowing. Even if the user has to click "install" to do this, if they knew it was a virus then I doubt they would install it.

[rspassey]

if they knew it was a virus then I doubt they would install it.

Wanna bet on that?

[Mac Medic]

I'll take that bet. I guarantee you that if you take 100 people, give them a file and "specifically tell them" that it's a virus that NONE of them will install it. How much???

[rspassey]

If you tell then verbally, that is different, but if in a files installation process in one of the pages where you have to click agree and read a long user agreement (which I never read) there was a line that stated "This is a virus!" - there will still be people who will install it, simply because they don't take the time to read it.

[TwoRails]

I'll go along with that. That's the old "wet paint" sign syndrome :eek: :)

[HAL9000]

Didn't I just give you an example of a person WILLINGLY installing a virus... oooh... new game... I'm gonna download it..... ok... click... installing... hmm.. wonder what it needs the admin password for... oh well... who cares... I really wanna play.... ******** ... WHHHHEEEEEE... this game is fun (virus is playing in the background)

gee... was that so hard?... The user WILLING installed.... now for a Windows example... Kazaa.... right there in the terms of agreement that nobody reads... blah blah blah... give us the right to... blah blah blah... agree too.... click click... all installed willingly.

[enhanced08]

I wasn't talking about in the EULA, i meant "Here is a program, its a Virus. Wanna install it?" Like if they know its a virus before hand not them thinking its a game or something.

[Mac Medic]

Yeas Hal, you did give an example, unfortunately it's irrelevant to what Ryan said, he thinks if people "know" it's a virus they'll still install it, your example isn't someone knowingly installing a virus, rather installing a program that contains a virus of which they're unaware. People install software every day, if you start to install an app and the computer asks for a password it's normal behavior for the machine. People just have to be careful of the source of the programs that they install but regardless of that they still aren't knowingly installing a virus. I'll still take that bet..

[HAL9000]

Then you would stand to lose money... do you honestly read EVERY EULA.... I'm willing to call a person a liar who claims he does.

[Mac Medic]

No, of course not, but no one said anything about the EULA.

"Quote:
Originally Posted by enhanced08
if they knew it was a virus then I doubt they would install it.

Wanna bet on that?"

Thats the point here, i they "knew" it was a virus. If a user had a disk with a virus on it and they know it's a virus, they have no doubt it's a virus, they have been told it's a virus, the disk is labeled "VIRUS, do not install", how many would load it? I say none. The EULA doesn't matter, social engineering is not part of the equation here and it's not a trojan, just a disk labeled virus. None of them would install it.

[HAL9000]

Well if we're picking on words here... lets change that... if they were NOTIFIED that it was a virus then.

[786ARS]

is a virus a virus if someone knows its a virus?

[rspassey]

Well if we're picking on words here... lets change that... if they were NOTIFIED that it was a virus then.

This is getting all so confusing...

There is a big difference between verbally telling someone that it is a virus and having that hidden away in the EULA, but both are ways that the 'User' would be aware that they are, in fact, installing a virus.

I have never once read a EULA, so I could have installed lots of viruses that <i>tell</i> me that they are viruses. Fortunetly, I haven't, but the same can't be said about the <i>average</i> computer user, with the <i>average</i> computer intelligence. Hal's example is true, I bet that I could whip up a version of my Tron LightCycles program I made this year, and alter it so that EULA would say that this is a virus (even though it wouldn't really be - I am not mean enough to code a virus) - and there would still be people who would install it to play the game.

In fact, I might consider doing a little study of this at school... I will try to make a way that I can see how many people download it, and how many people install it. Though I wouldn't really include a virus, it would still be interesting to see what the results would be.