Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

The First Mac OS X Virus?

MacFan782040 said:
I feel like sending the Mac Military to defend us.

PS- Who would rate this positive?
Click to expand...
Perhaps, it can show us how the mac community band together in times of need?
 
Really, this is barely different from me writing a little app that just starts deleting files randomly, and then distributing it as "omgcoolapp.app". Just a little more sophisticated in what it attempts to do, and significantly more buggy ;)

It's not a virus, but it is a nice wakeup call for people who think that their computer can magically determine what "harmful" is and disable anything "harmful".
 
arn said:
Welch is continuing the dissassembly...

it appears when launched the app infects all other apps on the computer and inserts an executable stub and code into the resource forks of all the applications. When those apps launch, it runs this code. unknown what the subsequent code dose.

arn
Click to expand...
And it's using Spotlight?
 
Heb1228 said:
Still am... its not a virus.
Click to expand...

Hey, I'm not searching for AV software to install! There are STILL no viruses for Mac OS X.
Click to expand...

I fully admit my ignorance about viruses et al., so this will be my last post in this thread since I can't really contribute anything else. But if you see "virus" in subsequent posts from other people like me who are concerned members of the Mac community but who aren't as tech-savvy as we should be, please just imagine you're seeing whatever the correct term is. :)
 
Man, all this fuzz for what is a badly disguised trojan, and that's in the worst case, the analysis isn't even finised, yet.

If you double-click downloaded stuff from the net, without knowing what it is, you will get burned, Mac OS X or not, malware is just too easy to write, regardless of operating system... :rolleyes:

Screaming Virus, virus! will probably not help after manually running something you shouldn't... common sense before double-clicking will... ;)

Edit: I cannot believe this made the front page... It's a page two story, and barely that... :rolleyes:
 
So I don't get it.... It inserts this piece of code in each of the programs installed on the computer and then what? Does it propogate to other computers? Does it just really slow down everything by having many copies of it running at once? Will it eat my first born child?
 
A few important points

-- At this time, I would classify this as a Trojan, not a virus

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- It requires the admin password if you're not running as an admin user, otherwise it can't copy its payload into your applications

-- It is a PPC executable, and appears to fail on Intel executables

-- We don't yet know what the code does that executes when you launch an application after this trojan has done its thing

For more updates as they come, please go here:

http://www.ambrosiasw.com/forums/index.php?showtopic=102379
 
This can be classified as the first harmful OS X trojan. OS X has had trojans before, but they were pretty harmless and Apple had a patch out in a week. We can still claim no viruses for OS X.
 
dull

...all we need to do now is get Apple Mail to send it to every person in our address books and we can have fun just like our windoze (you can't play games on a mac) friends.

Is this another non story just so we can toss a non story at people who argue that a Mac will be just as crap as windows given time and enough crazy automation in our email clients?
 
No Permission, No Virus

Mitthrawnuruodo said:
Man, all this fuzz for what is a badly disguised trojan, and that's in the worst case, the analysis isn't even finised, yet.

If you double-click downloaded stuff from the net, without knowing what it is, you will get burned, Mac OS X or not, malware is just too easy to write, regardless of operating system... :rolleyes:

Screaming Virus, virus! will probably not help after manually running something you shouldn't... common sense before double-clicking will... ;)
Click to expand...

Look before you click.....
 
Mitthrawnuruodo said:
Man, all this fuzz for what is a badly disguised trojan, and that's in the worst case, the analysis isn't even finised, yet.

If you double-click downloaded stuff from the net, without knowing what it is, you will get burned, Mac OS X or not, malware is just too easy to write, regardless of operating system... :rolleyes:

Screaming Virus, virus! will probably not help after manually running something you shouldn't... common sense before double-clicking will...
Click to expand...
And Safari should have presented a warning prior to downloading an executable file. I don't believe other browsers would.
 
iMeowbot said:
A bit of Zappa would make for some good listening while reading his thread.
Click to expand...
Ulp - I happen to own that MOI track! Also [playlistId=548647&s=143441&i=548625]It's the End of the World As We Know It[/playlistId].

The difference between this program ("latestpics") and previously publicized Trojan horses is that latestpics (apparently) has an intent of real harm, rather than being a demonstration of a security weakness, such as the one described here.

The software released by latestpics apparently has an attribute of a computer virus: trying to replicate itself.

There are two weaknesses inherent in a desktop operating system: the software and the person using the computer. This one seems to be trying to take advantage of both.

Removing the installed code appears to be a nontrivial task, but so far I have not seen a report of data destruction, just the code trying to install itself within applications folders.

What we know is preliminary. More information is certain to surface.
 
quagmire said:
This can be classified as the first harmful OS X trojan. OS X has had trojans before, but they were pretty harmless and Apple had a patch out in a week. We can still claim no viruses for OS X.
Click to expand...

How can we classify it as harmful? Do we have any confirmation of what it's actually *doing* other than copying itself all over the place?
 
Dr Q, are we doing anything to the original poster? or is there too little information to yield anything useful?
 
xsedrinam said:
And Safari should have presented a warning prior to downloading an executable file. I don't believe other browsers would.
Click to expand...

Safari doesn't know what the hell's inside of a tarred and gzipped file, nor does any other browser.

I'm curious to know what this li'l fella does. And also wondering why everyone is so upset. If I sent you a shell script with a certain rm command in it, that copies itself to all shared network drives, it would probably do much worse than this one. Whoever wrote this trojan is being very nice to us. We had no warning and no real defense, so what was to stop this chap from nuking all our hard drives? He might just want to prove a point, which he has done adequately by getting everyone's panties into a twist :p

It's important to keep that in mind -- a little bit of humility (and not underestimating the creator) will go a long way. Be nice, concentrate on bettering your personal behavior (like that nice bearded Spock fellow has said), once bitten twice shy, and all that.
 
I don't know what the definition of a virus is, but when Mac OS Tiger first came out there was a vulnerability where if you browsed to a directory on the Internet that only contained a widget file it would automatically install itself as a widget on your dashboard. Apple since has you confirm if you want to install widgets.
 
Safari does display a warning, but I'm not sure if it does that for all tarred zipped files. I mainly use Firefox.
 
Wow this is really cool. Everyone thinks Macs are imune to viruses and I'm glad that someone proved that they are very wrong. The only reason Macs rarely get viruses is because such a small percentage of people use them. This is great...I'll finally be able to shut up my Mac loving friends.

By the way I don't support the making of viruses I think its bad. I just think its cool someone proved the Mac lovers wrong.
 
Perhaps Apple should make it so that it won't automatically run executable from archives?

It was a handy touch but it always annoys me in a way..
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back