First Mac Trojan Found!

From spymac front page:

The Trojan Horse, MP3Concept (MP3Virus.gen) which affects Macintosh computers running Mac OS X was identified by Intego. Intego, a Mac security specialist, released a press notice explaining that the virus code is encapsulated in the ID3 tag of an MP3 file. An MP3 file is a digital audio file. When opened the file launches hidden code which can damage or delete files. It also launches the iTunes application, so that you think you've launched a real music file. It can also infect other MP3 files. Intego further states that the first versions of this virus are benign, (i.e. they will do no harm), but the doors are opened for more serious risks.

Intego's VirusBarrier software eradicates this Trojan horse, but costs $59.95 (US). We can assume that Norton Anti-virus, Virex and other anti-viral software will be updated as soon as possible if there is a real threat here.

There is no information on the virus on the Symantec Security Response page, nor on US-CERT (US Computer Emergency Readiness Team) or on Carnegie Mellon's . If you do a search on mp3 concept (with the space) you will find information on some PC viruses though.

This information is new as of a couple of hours ago, so other anti-virus sites may not have been updated yet with information regarding this new Trojan Horse and the extent of the threat, if any.

#142284

this is cool, but I hope it doesn't evolve, so that mac users have to buy antivirus, just as windows user!

#142293

why's it cool? its horrible unless you're a :naughty: hacker

#142298

Topic moved.

-Pe7er

#142302

Well... it was going to happen sometime. .

#142304

Hahaha.

This is good for them.

Mac users are always dissing Windows. "All those worms and Bugs on Windows. I love OS X, nothing goes wrong. The grass is greener on this side Ha"

Well guess what, it looks like your grass isn't so green ANYMORE!!!!!!!!!!!!!

As much as I'd like to see all those rich folks worry it wont happen.

Thanks to Unix's stucture You find out whenerver something is happening because it'll ask you for the Root password. At least thats the way it is in Linux and Linux is an Open-Surce version of Unix, so.

Like Tuneige said it was going to happen eventually.

#142312

I'm a mac user, thanks for the vote of confidence

#142317

Very intresting Well hopefully This virus does not spread to much. Yea Windows alrdy has to many virus its Mac's turn j/k Thanks for the look out Ludge

#142318

I wish I could kill all those who makes viruses, they suck and drive me crazy. F**K THEM ALL

#142377

FROM MACNN

MacNN reader Dave Schroeder provided some more details on the Trojan Horse for Mac OS X reported first by MacNN earlier today: "This is actually a little bit of the Classic/Carbon paradigm catching up with us, and represents an oversight in the way Mac OS X handles presenting the file to the user. In the case of this proof of concept, a file can be made to appear as an ordinary mp3 file, complete with the familiar icon and .mp3 extension, and even audio content. However, the file contains a PowerPC code fragment - a piece of executable code; a little application - that can be made to do anything the author desires (limited by the permissions of the user executing it)."

"But here's how it does it: the file is really a Carbon (CFM) application, with file type APPL. The two methods of identifying files - file extensions (the new Mac OS X way) and file metadata (e.g., type/creator, resource forks; the old way) - are in conflict. So Mac OS X shows the file to you as an mp3, when in reality the behavior when double-clicked is that of an application. Therein lies the problem: since the file appears to be a legitimate mp3, a user may unwittingly double click it, executing the potentially malicious code - thus the proper description of this as a trojan horse.

"Further examination of the file, even a simple Get Info, does reveal that while it appears to be an mp3, the OS does recognize it as 'Kind: Application'. This special case - files that identify themselves as applications, but have inappropriate extensions, such as mp3 - could be easily handled by a security update. One other point about this trojan: since it is a CFM application with a resource fork, it will be rendered useless by any transfer method that does not explicitly retain the resource form (compressing with StuffIt, encoding with MacBinary, for example). All in all, an interesting story, but it really represents taking advantage of a minor oversight in the way Mac OS X displays and handles potentially conflicting file extensions versus legacy metadata. Not really big news. :-) There is a proof of concept of this trojan here (though named "virus.mp3", this is not a virus)."

UpdateDave offered some more info:

Upon closer examination, the proof-of-concept trojan actually contains its own copy of iTunes' mp3 icon. The only area where this trojan is actually taking advantage of something that could legitimately be referred to as a Mac OS X shortcoming is the ability to display itself as a file with a .mp3 file extension, while still be handled by the operating system as an application. This is, once again, a function of the type/creator metadata, which takes precedence over file extensions. This trojan is almost pure social engineering, and not really an "exploit": it's one step away from merely creating a malicious Carbon application and giving it an mp3 icon, which is trivial, and merely naming it with a .mp3 extension. The one additional feature of the trojan is that it actually is a valid mp3 file; but once double clicked, the damage is done, regardless. One might argue that by spawning iTunes and playing itself as an mp3, the trojan may hide its true intent or confuse the user for just a few moments longer, but either way, the damage has begun - and likely ended - before the user has even noticed.

The only way for Apple to "fix" this would be to universally visually identify executable applications in some fashion. Whether or not this comes to pass, the true source of real widespread damage from trojans, virii, and worms is their ability to spread. Since any raw transmission without encoding that preserves resource forks effectively neuters the trojan, and since there are no easy ways to mass-propagate a virus using Windows- and Outlook-style methods on Mac OS X, this is really not a major issue at all.

"You will likely do more damage sending out a friendly email message politely asking people to move their home directories to the trash.

#142392

So it begins...

BTW it was inevitable, it had to happen. It will evolve! (don't kid yourselves)

#142404

A trojan/virus every 3 years isen't bad

#142409

damn, we arent virus free on the mac any more, that title has been snatched way

#142429

some of you have no manners. don't laugh at others' misfortunes.

#142434

Quick Question is there any OS that's worm free

#142440

This is great, now all the mac zelots cannot complain about windows being so insecure.

#142467

hahhahaha.

OMG.. A WORM... as in ONE!

I suddenly feel a deep sense of regret because of my switch... nah, i dont..

Papichulo, ease on that coffe will ya...

Read Photo678's post.

#142534

there's a good short article about this at wired

about this.

The company that released the info has a pretty pathetic spin.

Anyways, sounds like its something for apple to fix and not a reason to buy Intego software.

#142661

OK, this wasnt a real virus/trojan, it was just a proof-of-concept.

That said, it does show a flaw in OSX (that Windows has as well). That's that you can mask the file extension to "hide" a file's true type.

This is the problem with relying on file extensions. It makes no sense why OSX would do this, it has access to unix "magic" that can determine a file type using MIME, rather than the extension (which can obviously be fake).

Example, run "file virus.mp3" on the trojan (on OSX or *nix), and it'll show it's an executable, even though the extension is mp3. You can't trick it (without doing very serious work).

Luckily, OSX has it much better than Windows. On OSX, you're not running as root, so any really evil trojan will have to ask you for your root password. It's basic security, if an MP3 is asking for your root password, don't give it to it.

Unfortunately, many commercial apps (Adobe I'm looking at you) don't know how to play nice with UNIX, and cache your password once they get it (during the install). That means that if you have an app that caches your root password, the trojan wouldn't even need to prompt you. That's stupid, your password shouldn't be stored by other apps (and especially not in clear text). It's useless having a shadowed passwd file if it's in 12 other locations.

That's one reason I'm not thrilled about commercial app support coming to Linux. These companies don't care one bit about security. This is why Windows users HAVE to run as root, because so many apps require it. Believe it or not, Windows NT has a decent permissions system (plus ACL), and that should really help things (not stop the problem by any measure, there are lots of other flaws in the security model), but no user can take advantage of that because most apps wont work properly if run as a less powerful user.

On that note, OSX's default file permissions are pretty crappy as well. Lots of files in the system directories are owned/deletable by regular users. That means a virus COULD break your system even as a normal user. This was basically poor planning on Apple's part. The UNIX permissions system is strong, but useless if you don't take advantage of it.

To compare, on almost all Linux (and real UNIX) systems, you could run "rm -rf /" (delete whole drive) as a normal user and you'd still have a working system, the permissions would protect you. (All that user's personal files would be wiped out though). On OSX if you did that, your system would almost always get killed.

It just goes to show you, easy and secure really don't go well together.

#142677

Originally posted by contrasutra@Apr 10 2004, 10:56 PM

That's one reason I'm not thrilled about commercial app support coming to Linux. These companies don't care one bit about security. This is why Windows users HAVE to run as root, because so many apps require it. Believe it or not, Windows NT has a decent permissions system (plus ACL), and that should really help things (not stop the problem by any measure, there are lots of other flaws in the security model), but no user can take advantage of that because most apps wont work properly if run as a less powerful user.

To compare, on almost all Linux (and real UNIX) systems, you could run "rm -rf /" (delete whole drive) as a normal user and you'd still have a working system, the permissions would protect you. (All that user's personal files would be wiped out though). On OSX if you did that, your system would almost always get killed.

It just goes to show you, easy and secure really don't go well together.

Excellent post my friend

You make a very valid statement. I personally admire Windows NT's security as far as permissions go, especially with Windows 2003 Server where they've tried to lockdown as many permissions as possible. If you compare it to Windows 2000, you'll see that a lot of the file permissions are set to Full Control by default. Not a very nice thing to have if you're paranoid about security as I am at my job as a network admin. In sharp contrast, Windows 2003 tries to restrict permissions as far as possible and requires the administrator to manually configure the permissions as required. 2000 makes it easy, not secure just as your last statement simply emphasizes.

#142722

hmmm, someone on another forum suggested typing su rm at the OS X terminal as a method for increasing framerates on games. I looked it up and saw what it did. Others just typed it and lost their system folder. Luckily OS X allows to to do an archive install to preserve an existing home directory.

#142751

Contra, that's an absolutely superb post.

For what it's worth, I haven't run as root for ages...

Being a developer and running as root is just asking for trouble - how d'you know your apps will run for people who don't have root access?

What I do, then, is always have a console open with root permissions, in case I need to do root-y tasks...

Like you say - Windows has a great security model, but lots of apps just don't honour it. Funnily enough everything from MS does (save for Visual Studio, but that just requires "Debugger" priveleges), as do most open source apps and iTunes...

Adobe, Corel, and games manufacturers, I'm looking at you <_<

That, dear friends, is how this Windows box stays uninfected (well, that and a good firewall, among other things)...

For anyone who cares: A brilliant article on how to develop code as a non-admin, as part of A .Net developer's guide to Windows Security

#142765

Excelent Contra!

Simply the best post I've ever read here. lol really!

I dropped outta the OS 10 GUI and into a (don't know what to call it) "full screen" Darwin command prompt and doing a "rm -rf /". And right now I am sitting at my PC looking at A LOT of white on pure black "rm: %filename%: permission denied"s

I am using version 10.3.2... did Apple fix somthing? This command may work the way you said it would with Jaguar or Puma.

It even doesn't work to delete the applications I gave permission ot install. I am sure all my sh!t is gone that I've used, like documents and pictures. And maybe the Mac OS 9 stuff.

#143062