News, info, and opinion by Mac users, for Mac users.

February 16, 2006

security

Reports emerge of Mac OS X trojan horse or worm

Posted Feb. 16, ’06, 10:26 AM PT by Cyrus Farivar
Category | Security

When I woke up this morning, it seemed that the impossible had happened. Since 2001, when OS X was first released, there have been zero reports of virii, worms, or other malware for the Mac. Early this morning, it was reported on the Ambrosia Software discussion boards of the first reports of a worm/trojan horse for OS X, disguised as a package of screenshots for OS X 10.5 Leopard.

Macworld.com News Editor Peter Cohen is on the case:

Reports indicate that someone has let loose a “trojan horse” or worm for Mac OS X users. The program is hidden within a package that purportedly contains screenshots of Apple’s as-yet unannounced next major revision to Mac OS X. Whether it’s a trojan horse or worm seems to vary depending on the source of the information.

The package, called “latestpics.tgz,” first surfaced recently on a Mac rumors Web site. Independently verified by Ambrosia Software president Andrew Welch, he’s dubbed it the “Oompa-Loompa Trojan,” because the files in question check for the presence of an attribute called “oompa” — an apparent reference to the movie and book “Charlie and the Chocolate Factory.”

Welch provides extensive details on the Ambrosia Software discussion forums.

When unpacked, the archive includes an application that resembles a JPEG file. When it’s clicked on, the file executes and attempts to propagate itself via the buddy list of Apple’s instant messaging software iChat.

Check in at Macworld’s News Page for further information later in the day as the story develops.


Leave a comment

 



Visit other IDG sites: