News, info, and opinion by Mac users, for Mac users.

October 31, 2007

security

Roh-oh: Headless Trojan Horseman haunts the Mac

Posted Oct. 31, ’07, 1:42 PM PT by Dan Pourhadi
Category | Security

evilDMG2.jpgThis seems fitting for Halloween — the whole spooky-and-invisible-ghoul-attacks thing. Apparently Intego — a security firm that develops the Mac anti-virus software VirusBarrier — has discovered an actual, honest-to-goodness Trojan Horse for the Mac, code-named OSX.RSPlug.A. (Remember, this isn’t a virus — viruses self-propagate, or move from one computer to another on their own. This does not.)

The horsey, found on several porn sites (I felt dirty writing that), masquerades as a QuickTime codec. When a user tries to view one of the site’s videos — horrible! horrible! — he’s told QuickTime can’t read the file, and that he has to download an updated version of the video codec for it to play. Shameless that he is, he downloads the disk image and installs the software.

The software, of course, isn’t a video codec at all, but rather a Trojan Horse that modifies his DNS settings! (Thunder! Crash! Dramatic music!) Macworld sums up the untamed horse’s nasty behavior:

When the malicious DNS server is active, it hijacks some web requests, leading users to phishing web sites (for sites such as Ebay, PayPal and some banks) or to web pages displaying ads for other pornographic web sites, according to Intego.

Result: No porn for you! Oh, and your credit card info in the hands of evil, evil people.

But what does it all mean? How do you know if you’re infected? How do you exorcise your Mac of this evil? Thankfully, Rob “Freakin’ Genius” Griffiths answers all of these haunting questions in great detail at Macworld.

There is one sentence in Rob’s article that stands out, and should act as a mantra for all mankind:

Rule #1: Do not install software from untrusted sources, especially if that software comes as an installer package and requests your administrator’s password!

Word.


3 Comments

Dave-O said:

Actually worms self propagate. Viruses traditionally are attached to files or programs. When you open an infected file, the virus infects other files on the system, when you share those files (or the original) you spread the virus. Trojan horses do not necessarily have any mechanism to spread, just a payload in a file or program. You must share the trojan-infected file to spread the exploit.

October 31, 2007 1:54 PM
wesg Author Profile Page said:

Props for using that image. "Trust me.dmg" definitely got a laugh.

October 31, 2007 2:23 PM
Tim Author Profile Page said:

It's funny how you automatically used the word "He" as in - only men would visit such sites :)

November 7, 2007 5:56 AM

Leave a comment

 



Visit other IDG sites: