apple
Report a problem

Intego: Phishing trojan targets OS X

Slimy   on 31 October 2007 - 23:34 · 31 comments & 21319 views

Advertisement (Why?)
Security vendor Intego claims to have found a new trojan attack that targets Apple's OS X operating system but competing security firms (McAfee, Symantec, and Trend Micro) have yet to find samples of the trojan. Intego said that malware authors spammed Mac forums with links to pornographic websites hosting the malware. If confirmed, the trojan would be the first piece of truly malicious software to be targeted at OS X, as opposed to the various proof-of-concept attacks that researchers have previously developed.

The OSX.RSPlug.A trojan allegedly disguises itself as a video codec that would provide access to a pornographic video but in reality is a piece of malware classified as a 'DNS Changer'. The software changes the way OS X would handle the DNS requests that are used to link numerical IP addresses to web URLs. The tool allows the attackers to redirect web traffic, opening the door for phishing scams.

News source: vnunet

Post a comment · Send to friend Comments · There are 31 additional comments
(1 reply) #1 +Hell-In-A-Handbasket on 31 Oct 2007 - 23:54
i find this funny, knew it was comming

but come on,,, it asks to be isntalled, user has to put in their administrator password, and gotten by lookign at britany spears "questionable" videos.....

if it was IRL, they would prolly get a Virus also,, jsut Non-Digital


also this virus,, doesnt self-propagate, its more like a program a user installs thinking its something else

Last edited by Hell-In-A-Handbasket on 01 Nov 2007 - 00:01
#1.1 GP007 on 01 Nov 2007 - 13:27
That's how trojans work. You download and run something thinking it's something else. It totally depends on the user agreeing to run it.
#2 evo_spook on 01 Nov 2007 - 00:00
I couldn't be arsed to read the article after so many "proof of concepts" especially in this case where other Security vendors are poo poo the claims, but really it asks for you administrator password? LOL
#3 whistlerxp on 01 Nov 2007 - 00:01
I was going to submit this one, I noticed on doing some digging for my submission that Intego has reported on Mac trojans before and been debunked. See here. Notable quotes include...

"On Friday, Mac programmers and security experts accused the company of exaggerating the threat to sell its security software.",

""They are spreading FUD to sell their software," said Ryan Kaldari, a programmer from Nashville, Tennessee, referring to the shorthand for fear, uncertainty and doubt."

It would seem that Intego has used dodgy tactics to sell it's mac security software before.

Anyway, hopefully this will get patched up soon enough.

#4 giga on 01 Nov 2007 - 00:15
Intego. Enough said.
#5 evo_spook on 01 Nov 2007 - 00:17
I read on OSNEWS that they have a mac product out :-)

Shouldn't this type of thing be illegal, its similar to thugs going into a restaurant with a baseball bat and commenting on how fragile everthing is.
(1 reply) #6 internetworld7 on 01 Nov 2007 - 00:47
Obviously this is fake. It's not even possible to write a virus or spyware for a Mac. Mac's are immune.
#6.1 LTD on 01 Nov 2007 - 02:01
Nope, macs aren't immune to you deciding to install software.

This example of a "trojan horse" (as if! off a porn site (can it be more obvious??) is pretty much the same as you actively deciding to take a hammer and start bashing the hell out of your mac.
(3 replies) #7 Lasker on 01 Nov 2007 - 00:53
You have to be an idiot and mental retarded to install something that you don't know what the heck is in Mac OS X. Anything that have an installer, OS X will ask for your permission to install.
#7.1 vetneufuse on 01 Nov 2007 - 02:41
So you are calling the majority of the home standard users retarded? Please give me a break. you know the average user is going to click install to anything that pops up. Somehow or other they will believe they need to do it.
#7.2 Albert on 01 Nov 2007 - 02:52
Quote - (Lasker said @ #7)
You have to be an idiot and mental retarded to install something that you don't know what the heck is in Mac OS X. Anything that have an installer, OS X will ask for your permission to install.

and that, my friend, is exactly that. only idiots and mental retards pay exorbitant price for a dumb-down Mac PCs which cannot handle the simplest malwares because of, well, stupid users.

btw, welcome to the real world, mac heads, especially the horny mac heads. heh.
#7.3 Ledgem on 01 Nov 2007 - 04:02
Quote - (Albert said @ #7.2)
only idiots and mental retards pay exorbitant price for a dumb-down Mac PCs which cannot handle the simplest malwares because of, well, stupid users.

I can't believe it. You just wrote about a machine that is able to "handle malwares" as if it was something positive. I had to do a double-take there.

Please, by all means, continue enjoying your malware. Just unplug yourself from the net so the rest of us don't get spammed by your machine.
#8 LTD on 01 Nov 2007 - 01:56
I'm amazed that you have to do all of that 'installing' and give it your admin password even though apparently it's a 'trojan horse'.
#9 AgEnTsMiTh on 01 Nov 2007 - 04:01
Fake....
(6 replies) #10 RAID 0 on 01 Nov 2007 - 04:16
Not to worry, fellow geeks. A "real" virus/trojan/malware will soon be available at a Mac near you! The time is drawing near....
#10.1 LTD on 01 Nov 2007 - 04:51
Let us know when that happens, would ya?

Been like 6 years now . . .

Us mac users are getting kind of bored with surfing the net unimpeded and not wasting our cpu cycles running antivirus software. I'm getting sick of getting so much work done and enjoying my mac due to so much uptime.
#10.2 RAID 0 on 01 Nov 2007 - 05:12
Quote - (LTD said @ #10.1)
Let us know when that happens, would ya?

Been like 6 years now . . .

Us mac users are getting kind of bored with surfing the net unimpeded and not wasting our cpu cycles running antivirus software. I'm getting sick of getting so much work done and enjoying my mac due to so much uptime.


Do you enjoy playing GAMES and using ALL the software in the world (exaggerated, I know) on a mac? Forgot to add: let me know my up-time, please... since you know... what is the time my PC's been up? ????????

Last edited by RAID 0 on 01 Nov 2007 - 05:31
#10.3 mattrobs on 01 Nov 2007 - 06:30
Quote - (RAID 0 said @ #10.2)
Do you enjoy playing GAMES and using ALL the software in the world (exaggerated, I know) on a mac? Forgot to add: let me know my up-time, please... since you know... what is the time my PC's been up? ????????

That's all you have? Games, crummy Windows software, and uptime?
#10.4 whocares78 on 01 Nov 2007 - 07:32
Quote - (LTD said @ #10.1)
Let us know when that happens, would ya?

Been like 6 years now . . .

Us mac users are getting kind of bored with surfing the net unimpeded and not wasting our cpu cycles running antivirus software. I'm getting sick of getting so much work done and enjoying my mac due to so much uptime.


you can't compare running AV software to uptime, if you want to get picky i have a linux box thats been up well over a year, i have a couple of windows boxes i reboot once a month, only to install updates on. my windows servers only go down when i take them down, yet when i did work with macs that mac server we had went down daily and took about 30 minutes to come back up, mostly cause my boss was a mac head and had no idea how computers really worked and was too stupid to fix it, eventually when he was away i sorted it out.

as for the CPU cycles my AV software has used like no cpu the whole time i have written this with task manager open and uses 11 meg of ram. how is that slowing my machine down so much again, personally my computer has so much processing power now, a couple of cpy cycles every so often for AV is nothing.
#10.5 RAID 0 on 01 Nov 2007 - 08:07
Quote - (mattrobs said @ #10.3)
Quote - (RAID 0 said @ #10.2)
Do you enjoy playing GAMES and using ALL the software in the world (exaggerated, I know) on a mac? Forgot to add: let me know my up-time, please... since you know... what is the time my PC's been up? ????????

That's all you have? Games, crummy Windows software, and uptime?


HA! HAHAHHAHAHAHAH! No, really, you made me laugh. The majority of software IS for WINDOWS, not Apple. Plus, anything I want to do on a mac, I can do on my home built box. Including, but not limited to, running OS X. So what can you do on a mac, that you can't do on a PC? Video editing? Music making? Picture editing? Really, I'd like to know.
#10.6 whistlerxp on 02 Nov 2007 - 00:58
Quote - (RAID 0 said @ #10.5)
Quote - (mattrobs said @ #10.3)
Quote - (RAID 0 said @ #10.2)
Do you enjoy playing GAMES and using ALL the software in the world (exaggerated, I know) on a mac? Forgot to add: let me know my up-time, please... since you know... what is the time my PC's been up? ????????

That's all you have? Games, crummy Windows software, and uptime?


HA! HAHAHHAHAHAHAH! No, really, you made me laugh. The majority of software IS for WINDOWS, not Apple. Plus, anything I want to do on a mac, I can do on my home built box. Including, but not limited to, running OS X. So what can you do on a mac, that you can't do on a PC? Video editing? Music making? Picture editing? Really, I'd like to know.


QuickLook and use apps that look nice, work well and follow HIG.
#11 whocares78 on 01 Nov 2007 - 07:24
i think this is funny, yes i laugh at other OS misfortune if it's real, which it still may not be it may just shut up the OSX is unbreakable comments which we all know are not true adn are sick of hearing.

as for the you have to be stupid to install this, thats why the majority of viruses get on machines because of IDIOTS.

hell if all users were smart and knew how to keep a machine clean then we wouldn't have half the viruses out in the wild.

this is the same old argument yet again, the MAC fan boys will say it doesn't matter the windows fanboys will say mac sux and in the end everythign will be the same. and mac users won't decide to run AV software and will keep saying there are no viruses for osx and that proof of concept viruses don't count. blah blah blah.
(5 replies) #12 hotdog963al on 01 Nov 2007 - 09:15
YOU HAVE TO DOWNLOAD IT, RUN IT - AND - TYPE IN YOUR ADMIN PASSWORD TO GET INFECTED!!
#12.1 MadDog on 01 Nov 2007 - 13:46
I work in IT and have seen it happen... Never underestimate the stupidity of the end user.
#12.2 InsaneNutter on 01 Nov 2007 - 17:58
To be honest I can see a lot of people doing that too, some people just install anything.
#12.3 NeoTrunks on 01 Nov 2007 - 18:39
Quote - (InsaneNutter said @ #12.2)
To be honest I can see a lot of people doing that too, some people just install anything.


So, it's essentially an exploit of human intelligence (or lack thereof), rather than an exploit of the OS.
#12.4 vetJoel on 01 Nov 2007 - 23:05
Quote - (NeoTrunks said @ #12.3)
Quote - (InsaneNutter said @ #12.2)
To be honest I can see a lot of people doing that too, some people just install anything.


So, it's essentially an exploit of human intelligence (or lack thereof), rather than an exploit of the OS.

It's called social engineering.
#12.5 whocares78 on 02 Nov 2007 - 07:19
Quote - (NeoTrunks said @ #12.3)
Quote - (InsaneNutter said @ #12.2)
To be honest I can see a lot of people doing that too, some people just install anything.


So, it's essentially an exploit of human intelligence (or lack thereof), rather than an exploit of the OS.


and thats how the majority of viruses infect machines. are you surprised??


ever heard of kevin mitnick, he did mist of his hacking through social engineering, things like pretending to be suport adn asking for passwords, there was even a test in the UK i thik where people were giving out chocolates to people that told them thier password, and a ridiculous amountof people told them their password.
#13 Niels. on 01 Nov 2007 - 09:15
Finally... it was about time! Now, bring on the viruses/malware/malicious stuff that have been bothering us (ex ) windows users for years and years.
#14 ishtar on 01 Nov 2007 - 09:17
Ha Ha Ha
#15 giga on 01 Nov 2007 - 16:14
For the uninformed: http://dmiessler.com/blogarchive/new-os-x-trojan-in-the-wild

In other news, if someone sends you an email that says to run sudo rm -rf / on the command line (and enter your admin password when it asks you to) — don’t do it. Interesting attack method — send someone malicious software and ask them to install it as administrator. The defense? Don’t install it.



Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)