Java-based Trojan horse targets computers running Apple's Mac OS X

Posted:
in macOS edited January 2014
A newly discovered Trojan horse spreading through social networking sites targets Apple's Mac OS X operating system, including the latest version, 10.6 Snow Leopard, by baiting users into clicking a link.



The Trojan, dubbed trojan.osx.boonana.a, appears as a link in messages that read "Is this you in this video?" Clicking the infected link, according to SecureMac, runs a Java applet that attempts to downloads files to the computer, including an installer that launches automatically.



But another antivirus firm, Intego, also issued a notice Wednesday suggesting that the Trojan, a Mac version of the "Koobface" worm, carries a "low risk." The security firm said that the current Mac OS X implementation is flawed, though it admitted the threat exists and is likely to become a more legitimate concern in the future.



The installer reportedly modifies the system and allows remote access to all files on the system, and checks in with control servers to report information from the infected system. The Trojan also automatically runs in the background at startup, and attempts to hide its activities across multiple files.



The virus then spreads by posting messages to social networking sites like Facebook, MySpace and Twitter.



"This is a sobering reminder that hackers are turning their efforts toward Mac OS X as Apple's marketshare grows, and users should be vigilant in protecting their computers and taking precautions when surfing the web," said Nicholas Ptacek, a security researcher at SecureMac.



The Java-based Trojan is said to be cross-platform and includes files that affect both Mac OS X and Microsoft Windows. The security firm noted there have been recent Trojan horses that targeted Windows, but this new threat is cross-platform. SecureMac has released a free tool to remove trojan.osx.boonana.a, while Intego's VirusBarrier X6 and X5 detect and remove the malware.



Last week, Apple said it may remove the Apple-produced Java runtime from future versions of Mac OS X, perhaps starting with next year's 10.7 Lion. The Java runtime shipping in Mac OS X 10.6 Snow Leopard and Mac OS X 10.5 Leopard will be supported through the support cycles of those products.



An e-mail claimed to be sent by Apple Chief Executive Steve Jobs suggested that Java updates issued by Apple are always behind the official builds created by Sun and Oracle. Some have speculated that Oracle could release its own builds of Java for the Mac instead at some point in the near future.
«1345

Comments

  • Reply 1 of 94
    cimcim Posts: 197member
    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
  • Reply 2 of 94
    Why would anyone click "Allow" in this context?



  • Reply 3 of 94
    29922992 Posts: 202member
    Quote:
    Originally Posted by CIM View Post


    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.



    yeah, great, better remove it than fix it. What's the next thing which they will have to remove then? Safari?! jeez..
  • Reply 4 of 94
    alfiejralfiejr Posts: 1,524member
    exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.



    SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
  • Reply 5 of 94
    mr. hmr. h Posts: 4,698member
    Quote:
    Originally Posted by CIM View Post


    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.



    Wrong. This has nothing to do with problems with Java. The writers probably use Java as it's cross-platform, but they could just as easily used platform-specific code.



    Quote:
    Originally Posted by AppleInsider View Post


    The virus



    Trojan != virus



    The only way of protecting an OS against Trojans is making it so that the OS will only run signed code and all apps must be checked first by the OS vendor before being available to the wider public, a la iOS.



    Trojans are malware that work by tricking the user into running them/installing them. They do not work by exploiting OS vulnerabilities or security holes.
  • Reply 6 of 94
    boogabooga Posts: 1,077member
    Quote:
    Originally Posted by CIM View Post


    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.



    Java is one of the safest environments in existence, so this comment makes no sense. It's way safer than native code on iOS, let alone your typical Safari browser bug requiring no plugin. But nothing's perfect.



    That's also why all iOS content is signed and required to come from Apple... do we want THAT on the Mac?
  • Reply 7 of 94
    mr. hmr. h Posts: 4,698member
    Quote:
    Originally Posted by CIM View Post


    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.



    Wrong. This has nothing to do with problems with Java (see above)
  • Reply 8 of 94
    Quote:
    Originally Posted by Phone-UI-Guy View Post


    Why would anyone click "Allow" in this context?



    Why not, if they didn't understand the concept of a digital signature? It's all well and good that OSX warns you that something might be up, but by using poorly understood terminology, they increase the risk that a user will blow through the warning signs.
  • Reply 9 of 94
    Quote:
    Originally Posted by Mr. H View Post


    Trojan != virus



    The only way of protecting an OS against Trojans is making it so that the OS will only run signed code and all apps must be checked first by the OS vendor before being available to the wider public, a la iOS.



    Trojans are malware that work by tricking the user into running them/installing them. They do not work by exploiting OS vulnerabilities or security holes.



    Or to put it in layman's terms...You are the hole!
  • Reply 10 of 94
    Quote:
    Originally Posted by Booga View Post


    Java is one of the safest environments in existence, so this comment makes no sense. It's way safer than native code on iOS, let alone your typical Safari browser bug requiring no plugin. But nothing's perfect.



    That's also why all iOS content is signed and required to come from Apple... do we want THAT on the Mac?



    Yes!!
  • Reply 11 of 94
    anonymouseanonymouse Posts: 6,570member
    Quote:
    Originally Posted by Mr. H View Post


    ... Trojans are malware that work by tricking the user into running them/installing them...



    ... a la Google Pack.
  • Reply 12 of 94
    macosxpmacosxp Posts: 152member
    Quote:
    Originally Posted by Alfiejr View Post


    exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.



    SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.



    Yeah. I mean, why would anyone enter their password to verify an installation when they didn't initialize it (and only wanted to check out a video). If it requires a password, then what is the problem? If it doesn't require a password, since this is a cross-platform trojan, Oracle needs to get on top of their security. Or I guess we can wait for an update to Snow Leopard that blocks this trojan...



    Still, it's good that this is just another trojan. You don't have to worry about getting infected unless you actively do something stupid.
  • Reply 13 of 94
    2 cents2 cents Posts: 307member
    So this malware asks for my ok to install? Yawn. Next.
  • Reply 14 of 94
    Does it need user's password to do the initial install? The article was very vague in this aspect.
  • Reply 15 of 94
    noirdesirnoirdesir Posts: 1,027member
    Quote:
    Originally Posted by Alfiejr View Post


    exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.



    How does any malware modify the system? Either by the user entering the password or by some security hole like a buffer overflow. You seem to imply that things like execution of arbitrary code due to buffer overflows (or other security flaws) do not exist, when they are being reported almost weekly for some piece of software.
  • Reply 16 of 94
    wigginwiggin Posts: 2,265member
    Quote:
    Originally Posted by Phone-UI-Guy View Post


    Why would anyone click "Allow" in this context?







    Quote:
    Originally Posted by Alfiejr View Post


    exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.



    SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.



    One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).



    Time and again coworkers (we use Windows ) will try to show me a problem they are having with their computer, and when I look over their shoulder they will click OK on anything that pops up in front of them. When I make them first stop and actually read the warning, much of the time that tells them what the problem is...if only they had stopped to read it the first time!



    The problem is that those same Windows users carry over that same bad habit when they switch to Macs.
  • Reply 17 of 94
    welshdogwelshdog Posts: 1,653member
    And if you run Little Snitch you'll get two warnings, the one shown above and one from Little Snitch asking you if you want to allow the trojan to connect to an external server.



    Just say no.
  • Reply 18 of 94
    allblueallblue Posts: 393member
    I use FireFox as my browser, with the add-ons AdBlock Plus, FlashBlock, Ghostery , BetterPrivacy and NoScript all running on top of OSX and therefore have no worries at this point.
  • Reply 19 of 94
    Quote:
    Originally Posted by CIM View Post


    And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.



    You sound like an idiot...removing java from the OS X install has NOTHING to do with the security of Java. If there is a security hole here, it's the fault of the OS, not the plug-in.
  • Reply 20 of 94
    Quote:
    Originally Posted by Wiggin View Post


    One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).



    Time and again coworkers (we use Windows ) will try to show me a problem they are having with their computer, and when I look over their shoulder they will click OK on anything that pops up in front of them. When I make them first stop and actually read the warning, much of the time that tells them what the problem is...if only they had stopped to read it the first time!



    The problem is that those same Windows users carry over that same bad habit when they switch to Macs.



    This is sooo true. At least dialogs in OS X seem to be less frequent and less wordy
Sign In or Register to comment.