Apple Quickly Updates Malware Definitions to Detect New SMS Scam Trojan

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Dec 13, 2012.

  1. macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Earlier this week, Russian security firm Dr. Web published a blog post announcing the discovery of a new OS X trojan horse known as "Trojan.SMSSend.3666". The malware masquerades as an installer for various software titles, but tricks users into signing up for subscriptions through their mobile devices.

    [​IMG]
    Similar trojans have affected Windows and even Android platforms for some time, but the tactic is now being used to target Mac users.

    [​IMG]
    Apple has moved quickly to address the threat, adding definitions for the malware to its "Xprotect.plist" blacklist, which is part of the basic anti-malware tools Apple launched with OS X Snow Leopard in 2009. In its original incarnation, users were required to update definitions manually, but as malware threats against OS X grew, Apple last year instituted automatic daily checks to keep users' systems updated. The anti-malware tools automatically detect when a user has downloaded a file matching the signature of known malware, alerting the user of the threat and advising them to discard the downloaded file.

    Article Link: Apple Quickly Updates Malware Definitions to Detect New SMS Scam Trojan
     
  2. macrumors 6502

    Joe-Diver

    Joined:
    Aug 2, 2009
    #2
    Gotta keep on top of it.
     
  3. macrumors 65816

    Simplicated

    Joined:
    Sep 20, 2008
    Location:
    Waterloo, ON
    #3
    So did this Trojan manage to bypass Gatekeeper?
     
  4. macrumors 604

    LimeiBook86

    Joined:
    May 4, 2002
    Location:
    Hanging around in NJ with his cutie. :)
    #4
    Glad to see Apple keeping things up to date. I haven't heard of this scam but it sure seems like it could be quite dangerous! :eek:
     
  5. macrumors member

    Joined:
    Feb 24, 2012
    #5
    And people always defended OSX for being virus/spyware free... LOL. Welcome to reality. Hopefully Apple can keep up with the variations that are no doubt going to be roaming out in the wild based on this.
     
  6. macrumors 6502a

    spyguy10709

    Joined:
    Apr 5, 2010
    Location:
    One Infinite Loop, Cupertino CA
    #6
    Again, like I always say, the only virus you can get on OSX is one you install yourself. This just prevents the user from hurting him/herself. This isn't a "virus" like everyone is saying - it's a program that phishes your personal info. It can't escalate itself privelidge-wise like with a Windows virus and become "above" your system to prevent removal or uninstallation. Nothing can do that in OSX due to it's unix base.

    Also, great job Apple for staying so on top of this :D
     
  7. macrumors 6502a

    mw360

    Joined:
    Aug 15, 2010
    #7
    I don't understand how these scams can operate without the perps being instantly tracked down and thrown in a cell. Surely somebody regulates who is and isn't allowed to charge for sending SMS messages.
     
  8. macrumors 603

    ArtOfWarfare

    Joined:
    Nov 26, 2007
    #8
    Nicely handled, it would seem.

    But really, it seems to me this is an issue phone service providers should handle. Why is the money that they handle handled so insecurely? Shouldn't our provider send us some sort of message for us to confirm that some company is going to start leaching money via our phone bill and shouldn't they block companies that they find frequently commit this kind of fraud?
     
  9. macrumors 6502a

    spyguy10709

    Joined:
    Apr 5, 2010
    Location:
    One Infinite Loop, Cupertino CA
    #9
    No it doesn't. You have to put in your password into the warning that says "this application isn't approved by apple and may cause unintended operation" or something like that.
     
  10. macrumors member

    Joined:
    Jul 5, 2006
    #10
    They must be using some other installer that some legitimate companies have used... But this does seem like something gatekeeper should be able to stop if that isn't the case!
     
  11. macrumors 6502a

    spyguy10709

    Joined:
    Apr 5, 2010
    Location:
    One Infinite Loop, Cupertino CA
    #11
    LOL welcome to reality - this isn't a virus at all. It's a fake installer that asks for your cell phone number. It's not an infection - it's a poor phishing attempt.
     
  12. macrumors 6502a

    mw360

    Joined:
    Aug 15, 2010
    #12
    From wikipedia:

    This is neither. Its a plain old scam.
     
  13. macrumors regular

    Joined:
    Mar 22, 2010
    #13
    Could you elaborate more on that?
     
  14. macrumors 68030

    macs4nw

    #14
  15. macrumors 6502

    Joe-Diver

    Joined:
    Aug 2, 2009
    #15
    LOL....please learn what a virus is.....and take a look at file permissions (UID/GID)....then maybe you'll understand what is actually happening here.
     
  16. macrumors G5

    gnasher729

    Joined:
    Nov 25, 2005
    #16
    Since this application is neither a virus nor spyware I'd say people are quite right.
     
  17. PowerPCMacMan, Dec 13, 2012
    Last edited by a moderator: Dec 13, 2012

    macrumors 6502a

    PowerPCMacMan

    Joined:
    Jul 17, 2012
    Location:
    PowerPC land
    #17
    In the PowerPC days, viruses and malware in OSX was unheard of. While I agree the move from PPC was a much needed one, the switch to Intel meant trouble ahead for OS X on x86 hardware. Now Apple is getting viruses and malware. Terrible if u ask me.

     
  18. macrumors Nehalem

    GoCubsGo

    Joined:
    Feb 19, 2005
    #18
    Oh I send unwanted texts to people all of the time. What's the big deal? :D
     
  19. macrumors 68000

    Joined:
    Jul 15, 2005
    #19
    I don't think it gives you any option to open it if Gatekeeper is active. You can right click it and hit 'Open' or turn off Gatekeeper but I don't think it gives you an option to run it as most people would click okay anyways.
     
  20. 0815, Dec 13, 2012
    Last edited: Dec 13, 2012

    macrumors 68000

    0815

    Joined:
    Jul 9, 2010
    Location:
    here and there
    #20
    Somehow I am not worried about this 'Trojan'

    Anything that requires me launching an installer and than requiring me to type in my password and cell phone number is not scary at all - its a lame phishing attempt that I laugh about.

    I would be worried if it installs automatically in the background and than accesses my address book to get my cell phone number - but even than I would not respond to that SMS to get charged money.

    Honestly, I don't get the people that did type in their cell phone number - it is almost impossible to protect those people from their own stupidity.

    Anyway, glad to see that Apple is trying to protect people from their own stupidity.
     
  21. macrumors 6502a

    spyguy10709

    Joined:
    Apr 5, 2010
    Location:
    One Infinite Loop, Cupertino CA
    #21
    Sure- to install something in OS X (that does anything without you clicking the icon, like a service or anything like that) requires you to put your password in a box that prevents privilege escalation (basically the OS has complete control over all applications, not the other way around - a virus). If you don't have a password, you just leave the box blank. A program can't put a password into the system, only the user into the system. This prevents programs from replicating (a virus) or taking over the system (like many trojans).
     
  22. mw360, Dec 13, 2012
    Last edited by a moderator: Dec 13, 2012

    macrumors 6502a

    mw360

    Joined:
    Aug 15, 2010
    #22
    How'd you explain Android malware, or iOS malware then? It's really not the CPU that's vulnerable, is the OS. And by the way, OSX, Windows 7/8, and Android aren't even that vulnerable now, it's the users that are the weak link in the chain.
     
  23. macrumors member

    Joined:
    Sep 17, 2012
    #23
    And again, you are wrong about Windows. Or maybe you are stuck in a time loop about a decade ago.

    Nothing can "escalate itself privelidge-wise [sic]" in Windows either. You have to have the permissions and even then explicitly allow extended "privelidges" [sic]. Unless someone is a dolt and disables all the default security that exists in Windows.
     
  24. macrumors 6502a

    spyguy10709

    Joined:
    Apr 5, 2010
    Location:
    One Infinite Loop, Cupertino CA
    #24
    It charges you like those "insert your phone number here for unlimited ringtones!! *$9.99 per month" websites.
     
  25. macrumors 68000

    iGrip

    Joined:
    Jul 1, 2010
    #25
    This is NOT a real trojan. Apple has zero malware. People seem to forget that.
     

Share This Page