Mac OS X Virus/Trojan Summary

[slb]

Scary. For real - this is the first time ever I have doubted the security of my Mac.

This isn't an issue of insecurity in OS X (as stated in the article). The security of OS X has not been compromised in any way, because this requires the user to download and run it with admin privileges, either through an admin account or with an admin password. This after Safari prompts you about there being an executable in the compressed file...

This trojan is based on earlier proofs-of-concept from the past few years. Same ideas. I doubt people will remember this in a month, just like how everyone's already forgotten the hooplah over Safari's original behavior of widget auto-installation in Tiger, which caused everyone to get scared over malware back then too. Yeah, remember that?

 

[ssteve]

The best thing that apple can do to fix this problem is require any person buying a Apple computer to pass an intelligence test. If you fail you don't get to own one of their computers. The problem is stupidity and I don't think that it is the job of Apple to protect us from ourselves. My feeling is that if you are dumb enough to open a file from a source you are not sure of then you get what you deserve. Kinda like the idiot that puts his hot fast-food coffee between his legs and then burns himself when it spills. With any luck those idiots will sterilize themselves and we won't have to worry about them dumbing down the gene pool any more then it already is.

I have zero tolerance policy on stupidity.

My $0.02

WOW! This might be a little harsh, but I can't say you are wrong.

 

[Peace]

This whole thing just proves that Mac users need to start following the Unix Code of old..

Do not give a regular user admin rights..

Only log in as an admin to administer the computer.

 

[ChildOL]

Some clarity and a Fix

First I would like to clarify something even Apple got wrong... Leap.A is a VIRUS not a Trojan and not a Worm, let me explain..

There are three MAIN malwares in the computing world, with the ones above overriding the lower types based on function. (If it has worm qualities then it's a worm even if it has other qualities below it)

1. Worm (worse than a virus or trojan) (spreads over a network without any user interaction usually by exploiting a vulnerability)

2. Virus (worse than a trojan) (infects programs, files, and usually self propagates at least partly by user action)

3. Trojan (a program that acts like something that it's not, usually what the user wants, but instead has malicious intent)

Leap.A fits the bottom two (Which means it is a Virus), it fools the user into opening it by pretending to be something else like a trojan, and then self propagates and "infect" other programs like a virus (Which by the way does so without ANY prompts as soon as you open it if you are like most people and are logged in as an administrator).


This is what Apple can do to fix this problem...

Show the user (regardles of the icon) that the file is an executable, a glow would be very good... Require admin password if an application/process/script is trying to modify ANY FILE OR FOLDER on the system that is not allready known to be modifiable by it. (maybe a database where every user that is created is added and ANY known processes/programs/scripts... Any NEW processes/programs/scripts(ANYTHING executable) should be able to modify the given files/folders AFTER you give it the authority to do so via admin password and then it is added to the database and it can THEN modify THOSE files etc.)

 

[wincer]

could be the start

I have been reading about his all day. That, in my opionion, is the real problem. Yes, trojan/virus/breach, is a bad thing but I see the real problem is all the press this got. People who do this have nothing to gain. They do it for bragging rights, ego trip, etc.... The problem now is that the box has been opened. All those bad people are now going to see all the press and now the challenge. For the most part, the Mac has dodged this problem because no one cared. Now everyone cares. This could be the start of more bad things unfortunately. Users must be cautious.

 

[Eidorian]

Yeah, but everything looks so ugly with extensions on. I just want to see something more than Safari's warning. Along the lines of "Examine Application" after you download it via Safari.

When you're downloading an application you expect it to be there. But not when you're getting an image.

 

[slb]

First I would like to clarify something even Apple got wrong... Leap.A is a VIRUS not a Trojan and not a Worm, let me explain..

This thing doesn't function correctly in that regard. Really, it's barely a trojan in my definition, since I believe a trojan takes advantage of some security flaw that causes auto-execution, and there is no security flaw being taken advantage of here. In this case, the user has to download it and run it, ignoring any prompts or warnings. This isn't even spreading around in the wild across the 'net or anything.

Again, no security flaw in OS X being exploited. The user has to run it--a social engineering attack.

 

[iBlue]

Yeah, but everything looks so ugly with extensions on......

but my helmet doesn't match my motorcycle... and my seatbelt doesn't sit right with my pretty dress... my glasses make me look funny...
pick your battles is all i'm sayin' here

 

[ChildOL]

This thing doesn't function correctly in that regard. Really, it's barely a trojan in my definition, since I believe a trojan takes advantage of some security flaw that causes auto-execution, and there is no security flaw being taken advantage of here. In this case, the user has to download it and run it, ignoring any prompts or warnings. This isn't even spreading around in the wild across the 'net or anything.

Again, no security flaw in OS X being exploited. The user has to run it--a social engineering attack.

Read my entire post, what you describe is a Worm and it is not a worm but a Virus.

 

[Eidorian]

but my helmet doesn't match my motorcycle... and my seatbelt doesn't sit right with my pretty dress...
pick your battles is all i'm sayin' here

*sobs*

 

[autrefois]

here's an idea...

That is something that people should know how to do, thanks for posting it in case there are people on here who don't know.

You realize though this is under the "advanced" tab, right? Do we expect all Mac users to be advanced? I know you didn't name it that way, but I would think someone who is a new and/or casual computer user might not want to click on something that says "advanced" for fear of messing something up.

I'm not saying people shouldn't set their preferences to show extensions, just that the average person probably wouldn't find that. Maybe Apple should just have it turned "on" by default instead of having users look around for it.

 

[iBlue]

*sobs*

i think it looks fine. honestly i'd rather see extensions but maybe i just got used to it over time.

 

[Nemesis]

Force Field

Now we just have to see how Apple compares to Microsoft on turn around updates.
I find it amusing that the first possible malicious code to attack the mac platform was released here at our nice forum.

I think that we an a find an answer in Star Trek episodes; modern OS should have a "sickbay" surrounded by force field. In other words, all applications should execute itself first time in some sort of "memory bubble" that is completely isolated from the rest of applications and then monitored for a few seconds to see what they actually do.

Then full report will be displayed -- what application is trying to do, who made it and so on.

Also, there's should be a digital signature included in every executable file, which says who is the author and what's the purpose of the application. All authors should first distribute their apps to Apple, receive a digital signature back and then integrate it in their app.

When the app is first launched at user's computer, OS should check its signature by connecting with Apple's support website. In fact, this is very similar to SSL certificates integrated in todays web shops.

If an application doesn't have that digital signature, a user is then automatically warned by OS about the potential hazard if they run that app without "force field". Apple doesn't know what application is, there's no digital signature in it and OS warns us. This is a great protection measure.

I believe this is the only way to stop distributing Trojans and other malevolent software coming from everywhere around and authors will be encouraged to write "proper" applications instead.

Nemeis

 

[Doctor Q]

I read the whole thing on the Symantec website, but I'm still a little confused. What would the end-user see? I know what the malware technically did, but what did it visually do? What was it's purpose?

You see a Terminal window open, where it tries to execute commands. If you are not logged in as an administrator, you also see a number of error messages go by.

How do you patch against users downloading and running applications from people they don't know?

By making them more aware of what they are doing, when it's unusual behavior. Knowing what is "unusual" may require heuristics. However, simpler rules can suffice. For example, there is nothing wrong with running iPhoto for the first time, but that's worthy of a warning ("first time execution of this program - OK?") because it makes sense to warn users when the user first runs other applications. Another choice: provide additional warnings when files have multiple recognized extensions, such as myfile.jpg.app.

True, there is no patch for stupidity, but apple could publish the writer's address and phone number.

It's not stupid to click a link and follow your usual habits. Perhaps careless, but anyone can make a mistake now and then. A certain percentage of ordinary users (not brilliant technology geeks, but not dummies either) will fall for a Trojan horse out of habit. You can't blame people for not being on guard at all times, especially when the threat is new.

First I would like to clarify something even Apple got wrong... Leap.A is a VIRUS not a Trojan and not a Worm...

Really, it's barely a trojan in my definition, since I believe a trojan takes advantage of some security flaw that causes auto-execution, and there is no security flaw being taken advantage of here.

Leap.A is a Trojan if you follow some dictionary definitions, and not a Trojan if you follow other dictionary definitions. You can't settle this issue definitively because the meaning of the phrase has not been agreed upon. If you consider the reasons for these names (Trojans fool users by pretending to be something else, viruses infect other software), then both names fit. You can find definitions to agree with this. You can also find definitions to agree with ChildOL's interpretation. Please... no more "once and for all" answers to this terminiology question.

 

[Doctor Q]

Here's a suggestion I haven't seen mentioned in these forums before: disk undo.

Mac OS X can be fine-tuned to try to help users avoid common traps, but it will never be foolproof, due to human nature and to the limits of software quality (sophisticated evolving software cannot be 100% bug-free). So we can use all the tricks/tools/help we can get.

In many cases, the damage from a Trojan horse, virus, worm, or even a user error is recognized shortly after it occurs (the wrong things happen, windows flash by, things stop working, unexpected error messages appear, etc.).

If you could "roll back" everything that happened to your disk over the last 2 minutes, you could undo the damage in many of these situations. Not all of them, such as when you have no clue something bad happened (e.g., a keylogger was quietly installed) or when unwanted communications are made to other systems (e.g., email propagation).

But sometimes a disk-based undo function would be a lifesaver.

We already have journaled filesystems. A step further and we could have a disk-writelog for a certain number of writes or a certain length of time. If, with a few clicks, you could undo disk activity to a previous state, we'd have a valuable tool to help us, at the small expense of the additional I/O to track disk writes.

I'll leave it up to Apple to figure out how to protect the disk undo function itself from malicious software trying to cover its tracks.

 

[EricNau]

Here's a suggestion I haven't seen mentioned in these forums before: disk undo.

...

Wouldn't that be just like restore in windows?

 

[niter]

I was discussing this issue with my husband the other day...just because we both have Apple computers it does not mean that we need to get lazy about our computer care. It does not take a virus to destory all your personal stuff--what if you drop the laptop or it gets stolen?

When we had PCs we regularly backed up our data and always had a virus monitor. We never got viruses and had little PC problems, but just incase, restoration to the past weekend was really only an hour or two away if the situation arose. Since I have gotten my iBook, I have been exceedingly lazy about stuff like that. I recognize that just because my computer is a Mac does not mean it is immune to being stolen, immune to breaking, immune to any number of non virus related destruction. I have started to resume backing up my stuff. I get Norton for free so I figure might as well use it. I continue, like when I had a PC, to have no troubles--I just enjoy my OS a lot more now

Honestly, I think making a fuss over this trojan only feeds the fuels for someone else to make another one. My files are safe so bring it. What is the worst that can happen? Reformat, reinstall a few programs, and just drag my files from the CD to the computer? Bah! Apple touts how easy it is to set yourself up on a new Mac, so there really isn't anything a virus can do that is devastating unless it physically makes my comptuer catch on fire.

 

[Marlor]

This vulnerability could affect every operating system, in fact Windows has had similar problems. All Unices are vulnerable to similar tricks, and if a user has their mind set on opening a file, they will do so no matter how many warnings you display.

So, this is a basic problem that I cannot think of a solution for. It is not really a virus in the traditional sense, and is not a big deal, but the mainstream press has picked it up now, so we can expect all sorts of snide remarks from pro-Windows commentators.

 

[slb]

I'm going to rant a little because the coverage this goofy thing is getting is starting to annoy.

Read my entire post, what you describe is a Worm and it is not a worm but a Virus.

That's a pretty crappy virus if it spreads by having you download it and run it yourself. Here's what Ambrosia says:

-- This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- If you're not running as an admin user, it will silently fail to infect most applications

-- It doesn't actually do anything other than attempt to propagate itself via iChat

You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.

That last statement is basically saying, "you can't run it unless you run it yourself." Like with any program. Duh.

I go with the trojan definition, and there have been many trojans written to target OS X over the years, using the same idea, in fact. The real news is when one actually spreads in the wild over the Internet, which hasn't happened because OS X hasn't been exploited to spread anything in that way. In other words, there's nothing for Apple to patch, since there is no security flaw. This thing isn't even around anymore because the file was quickly deleted from the original MacRumors forum post.

Now we're seeing paranoid people enabling file extensions and switching to non-admin accounts as if there's an actual virus floating around that will infect you at any moment. I'm sitting here smacking my forehead.

I could write a program that deletes all the files in your Documents folder and garbles Spotlight metadata and link it on the MacRumors forum as "iTunes-speed-enhancer.tgz," but just because a few people ended up running it doesn't mean an OS X trojan is spreading in the wild that warrants national news coverage (and now I see it's on DrudgeReport, too). It means a few people on MacRumors got tricked into running a file I posted. It's not news that double-clicking a program on your computer will run that program on your computer.

Now Symantec and others will make a lot of noise trying to get you to buy Antivirus to protect you from the 0 viruses going around on the net. Symantec actually has it listed under "Latest Threats" on their front page. Lame.

There was bigger reason to worry back when Safari auto-installed widgets. This is a lot of nothing. Nothing has changed that has opened any doors to anything; it was always possible to run malicious software on your computer if you execute it yourself. OS X is just as secure as it was before, and no flaw is being exploited in the OS, and there's no mechanism in OS X for this to silently spread to you or others. YOU have to run this program. Turn your file extensions back off if you want to, for Pete's sake! Just don't download and run any old program you find off a messageboard; that's common sense. Didn't Safari give its standard prompt that there was an executable in the compressed file when you downloaded it? That prompt is there for this exact reason.

I'd like to thank MacRumors for announcing this in the way they did, which has now been picked up by Reuters, who gets so many details wrong, it's ridiculous (from referring to it first as a virus and then a worm, to claiming it's the first trojan found to target Macs, to waiting until the end of the article to mention you have to actually download it and run it yourself...sort of an all-volunteer virus). Now people will read it on Reuters and think there's some big virus spreading to Macs over the Internet, the first one of its kind, when what actually happened is a few people on a messageboard were tricked into running a proof-of-concept UNIX executable on their systems. That's it. Thanks a lot, MacRumors, you turned an isolated incident on the MacRumors forums into "The First OS X Virus Attacking Mac Users Everywhere!" appearing in an Associated Press article near you. Grumble.

To sum up:
1.) It's not the "first trojan to target OS X." When people say there have been no trojans or viruses for OS X in the past five years, they're referring to the fact that none have actually spread anywhere on a measureable scale. But there have been lots of test examples written before, and people pointed out this icon thing back during the 10.2 days.
2.) It's not exploiting any flaws in OS X.
3.) You have to download it and run it yourself. Don't open random crap from the net, as Apple has always recommended, and common sense dictates. Hey, it was OS X Leopard screenshots; I symphathize with the temptation.
4.) It's not news that someone posted a buggy executable to a messageboard and tricked some forum posters into running it by calling it something it wasn't. I'm totally shocked this has hit Reuters, as if Leap.A is actually spreading around all over the net. I really wonder if there are zero copies of it running on anyone's computers as I type this. There wouldn't be news of a "new Linux worm" if I linked a malicious script in a Slashdot post that tried to send itself to your Gaim buddies.
5.) This doesn't "open the doors" for anything. Malicious software has always had the ability to run on OS X, Linux, and any other secure operating system. It's really easy for such software to do that when the user runs it themselves! An all-volunteer trojan.

So, there. Some may disagree with me. I think this is all blown way out of proportion and will be forgotten in a couple of weeks (like the Safari automatic widget installation was, which was a real behavioral flaw in OS X that was since modified and also got some coverage in the tech press).

 

[Doctor Q]

I think this is all blown way out of proportion and will be forgotten in a couple of weeks (like the Safari automatic widget installation was, which was a real behavioral flaw in OS X that was since modified).

Then all will be quiet until the next security issue arises, when it too will be called "the first Mac OS X Trojan horse" by those with short memories.

 

[bankshot]

Despite much confusion on this detail, most users were not prompted for the administrator password before the file modifications took place. (The Application directory is writable by the Admin accounts which most Mac OS X user accounts are established as, by default.)

Funny, I just posted the following in another thread earlier today:

I've always said that Apple made a big mistake making the first account that's created (and usually the only one that's ever used) an admin. They should have made the installer create a normal account, but then ask for a separate, "administration" password. The installer would then create a special, hidden "admin" user behind the scenes, and novice users would never have to know it was technically a separate account. Then installers and other programs needing admin rights would just ask for the admin password, rather than an admin name/password pair. This would have been just as easy for the user, and far more secure.

Unfortunately there are millions of Macs out there running with elevated privileges every moment they're turned on. While it's not nearly as bad as running as root (which can silently modify anything, down to the lowest level of the OS; an admin needs explicit permission to modify much of the lower levels), it still gives trojans and viruses an easy way to inject malicious code into commonly used apps. Everything under /Applications is typically writable by admins, so a malicious program only needs to modify some of the commonly used ones like Safari, iChat, etc, to virtually guaratee they get run every time the computer boots. And it can do so silently, without needing to pretend to be a legitimate program asking for admin rights. Not good. Hopefully this doesn't bite Apple (and us!) in the butt when the first real virus comes along.

Why, oh why, doesn't Apple just listen to me more often? ​

Not much more to say here.

 

[iMeowbot]

The best thing that apple can do to fix this problem is require any person buying a Apple computer to pass an intelligence test.

That goes against everything the Mac is about. The real genius of Macintosh is that you don't have to be a genius to use it.

 

[killermink]

Whats in a name?

Can anyoen tell me why its called Leap? And what was wrong with Oompa that the other dude suggested - at least that made sense to me...

 

[slb]

Then all will be quiet until the next security issue arises, when it too will be called "the first Mac OS X Trojan horse" by those with short memories.

MP3Concept is one from 2004 that uses the same trick as this one to get you to run it! It disguised itself as an MP3 using the same icon trick and displayed a dialog box on execution. I believe this was before Safari began auto-scanning and prompting you when you were downloading an executable, as it does now (nobody is mentioning this feature!).

This is why it's annoying me that the news sites are acting like this is something new. There are some Mac users here acting like their worldview of OS X has been shattered. There's nothing to worry about; get a grip. I remember all the "trojans" and "viruses" back in the 10.1-10.3 days. When people say OS X has no viruses and trojans, they don't mean OS X hasn't been targeted by people. They mean none have measurably spread, which is 100% true. OS X just has no known mechanisms for automatically spreading such things. Contrast with the recent WMF vulnerability in Windows which allowed executable code to silently and automatically execute just by viewing a website or email.

It's even more annoying that national press like freakin' Reuters is now acting like the first Mac trojan has been discovered, because it's total misinformation that will be used against Macs by certain elements in the press. Who are these "security experts" being referenced in the articles, claiming this is the first of its kind? I'm very annoyed at and disappointed with MacRumors announcing this as the first OS X trojan without referencing past proof-of-concept trojans like MP3Concept that use the exact same icon trick! These things simply aren't spreading around in the wild. They're goofy little programs you have to download and run yourself. Once you do that and give it admin privileges, a program can do anything it wants. Several proof-of-concept OS X trojans have been tested with this in mind in the past five years.

Someone in a forum posted a link and tricked some people into running their executable. A minor incident in the MacRumors forums is now national news about "The First OS X Virus!" Congrats, guys.

 

[dubnluvn]

One would think that these virii writers would be more productive with their script-writing time. Do us all a favor...erase DEBT!!! I'm sure if a few dozen got together...