News, info, and opinion by Mac users, for Mac users.

February 16, 2006

security

Not the first malware

Posted Feb. 16, ’06, 9:10 PM PT by Derik DeLong
Category | Security

While the FUD machine churns about OSX/Oomp-A, there are a couple things I’d like to address before we all get ragingly out of control. I’m no self proclaimed security expert, but I think I can add some insight.

First, the nomenclature. Everyone has a different concept of how this piece of malware should be classified. Certainly, this is a trojan at least. It looks like one thing when in fact, it is another and does something bad. Ok. Is this a virus? If by virus, you mean it hacks at applications, making them into copies of the malware, sure. However, it renders the application in question completely impotent. It no longer runs. So really, the application isn’t so much “infected” as replaced. That leaves worm, which basically means the malware can propagate itself between hosts.

The argument for worm is weak at best. This malware uses iChat to try to initiate transfers of itself to people on the buddy list of the infected Mac. However, in order to be effective, the person on the other end must both accept the transfer and then run the contents of the transfer. That’s two layers of the user initiating the program, which then puts it back firmly into trojan behavior. It falls all the way back to social engineering and to be blunt, you can’t really save users from themselves when they’re determined to undermine their own machine.

Finally, some are calling this OS X’s first malware. It’s not. There has been a trojan floating around on peer to peer (P2P) networks that gives itself the icon for a Microsoft Word for Mac and is in reality a simple program that deletes your home directory. After that came SH.Renepo.B, aka Opener, which was basically a data collection script. Neither attempted to spread, but they were both most definitely malware. As such Leander Kahney is dead wrong.

The only thing that concerns me about this whole thing is the way in which the InputManager bundle API is being leveraged to do the malware’s dirty work without requiring a user’s interaction (as soon as that’s necessary, the problem is the thing touching the keyboard and mouse). What about you readers, is there a really big problem here or a hell of a lot of hype?


1 Comments

Jim Hughes said:

Derik,
It is definitely a lot of hype.
But that is what also helps the Mac community stay on top of "Malware" problems.
You never see this response from Windows users. There never was this type of re-action, even in the early days when viruses were lower in number.
Jim

February 22, 2006 10:11 AM

Leave a comment

 



Visit other IDG sites: