Heads up, creatives! You’re precious Mac’s are (slightly) less secure than you thought. Two pieces of malware surfaced last week. From ZD net:
Two pieces of malicious software affecting Apple’s Mac OS X appeared this week: a Trojan horse with the ability to download and install malicious code of an attacker’s choice, and a hacker tool for creating backdoors, according to security vendors.
The Trojan — called ‘OSX.RSPlug.D’ by Intego, the Mac security specialist that discovered the threat — is a variant on an older piece of malicious code but with a new installer, Intego said.
“It is a downloader, and it contacts a remote server to download the files it installs,” Intego said in an advisory. “This means that, in the future, the downloader may be able to install payloads [other] than the one it currently installs.”
In other respects the Trojan is similar to previous versions of RSPlug, which first surfaced in October 2007, Intego said. It installs a piece of malicious code known as DNSChanger, which routes the user’s internet traffic through a malicious DNS server, leading users to phishing websites or pages displaying advertisements.
The Trojan is found on porn websites posing as a codec needed to play video files, a technique used to trick the user into downloading and installing it.
Intego said OSX.RSPlug.D has been widely confused with a separate threat publicized this week by several security firms. That threat is called OSX.TrojanKit.Malez by Intego and OSX.Lamzev.A by other vendors, including Symantec and Trend Micro.
OSX.Lamzev.A is a hacker tool designed primarily to allow attackers to install backdoors in a user’s system, according to Intego. However, the company dismissed the tool as a serious threat because a potential hacker has to have physical access to a system to install the backdoor.
“Unlike true malware and Trojan horses, OSX.TrojanKit.Malez requires that a hacker already have access to a Mac in order to install the code,” Intego stated.
Other antivirus vendors noted that Lamzev could be disguised as a piece of legitimate software and used to trick users into creating the backdoor themselves.
Lamzev is not related to RSPlug, despite several high-profile reports confounding the two, Intego emphasized. “This hacker tool has nothing to do with the RSPlug Trojan horse,” Intego stated.
The Mac platfrom has been virus-free for so long because it wasn’t really a very worthy target. But now that OS X has cracked 8% market share, it seems like the hackers are coming around to the idea that the Apple pond is crowded enough to fish in. (This isn’t surprising, security experts in just about any field will tell you that security through obscurity is not really security at all.)
Having said all that, this is stuff you have to give permission to, before it can install on your machine. So, keep your wits about you, and you should be alright.
Character Illustration by Squiggley Studios.
