Java-based Trojan horse targets computers running Apple's Mac OS X
A newly discovered Trojan horse spreading through social networking sites targets Apple's Mac OS X operating system, including the latest version, 10.6 Snow Leopard, by baiting users into clicking a link.
The Trojan, dubbed trojan.osx.boonana.a, appears as a link in messages that read "Is this you in this video?" Clicking the infected link, according to SecureMac, runs a Java applet that attempts to downloads files to the computer, including an installer that launches automatically.
But another antivirus firm, Intego, also issued a notice Wednesday suggesting that the Trojan, a Mac version of the "Koobface" worm, carries a "low risk." The security firm said that the current Mac OS X implementation is flawed, though it admitted the threat exists and is likely to become a more legitimate concern in the future.
The installer reportedly modifies the system and allows remote access to all files on the system, and checks in with control servers to report information from the infected system. The Trojan also automatically runs in the background at startup, and attempts to hide its activities across multiple files.
The virus then spreads by posting messages to social networking sites like Facebook, MySpace and Twitter.
"This is a sobering reminder that hackers are turning their efforts toward Mac OS X as Apple's marketshare grows, and users should be vigilant in protecting their computers and taking precautions when surfing the web," said Nicholas Ptacek, a security researcher at SecureMac.
The Java-based Trojan is said to be cross-platform and includes files that affect both Mac OS X and Microsoft Windows. The security firm noted there have been recent Trojan horses that targeted Windows, but this new threat is cross-platform. SecureMac has released a free tool to remove trojan.osx.boonana.a, while Intego's VirusBarrier X6 and X5 detect and remove the malware.
Last week, Apple said it may remove the Apple-produced Java runtime from future versions of Mac OS X, perhaps starting with next year's 10.7 Lion. The Java runtime shipping in Mac OS X 10.6 Snow Leopard and Mac OS X 10.5 Leopard will be supported through the support cycles of those products.
An e-mail claimed to be sent by Apple Chief Executive Steve Jobs suggested that Java updates issued by Apple are always behind the official builds created by Sun and Oracle. Some have speculated that Oracle could release its own builds of Java for the Mac instead at some point in the near future.
The Trojan, dubbed trojan.osx.boonana.a, appears as a link in messages that read "Is this you in this video?" Clicking the infected link, according to SecureMac, runs a Java applet that attempts to downloads files to the computer, including an installer that launches automatically.
But another antivirus firm, Intego, also issued a notice Wednesday suggesting that the Trojan, a Mac version of the "Koobface" worm, carries a "low risk." The security firm said that the current Mac OS X implementation is flawed, though it admitted the threat exists and is likely to become a more legitimate concern in the future.
The installer reportedly modifies the system and allows remote access to all files on the system, and checks in with control servers to report information from the infected system. The Trojan also automatically runs in the background at startup, and attempts to hide its activities across multiple files.
The virus then spreads by posting messages to social networking sites like Facebook, MySpace and Twitter.
"This is a sobering reminder that hackers are turning their efforts toward Mac OS X as Apple's marketshare grows, and users should be vigilant in protecting their computers and taking precautions when surfing the web," said Nicholas Ptacek, a security researcher at SecureMac.
The Java-based Trojan is said to be cross-platform and includes files that affect both Mac OS X and Microsoft Windows. The security firm noted there have been recent Trojan horses that targeted Windows, but this new threat is cross-platform. SecureMac has released a free tool to remove trojan.osx.boonana.a, while Intego's VirusBarrier X6 and X5 detect and remove the malware.
Last week, Apple said it may remove the Apple-produced Java runtime from future versions of Mac OS X, perhaps starting with next year's 10.7 Lion. The Java runtime shipping in Mac OS X 10.6 Snow Leopard and Mac OS X 10.5 Leopard will be supported through the support cycles of those products.
An e-mail claimed to be sent by Apple Chief Executive Steve Jobs suggested that Java updates issued by Apple are always behind the official builds created by Sun and Oracle. Some have speculated that Oracle could release its own builds of Java for the Mac instead at some point in the near future.
Comments
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
yeah, great, better remove it than fix it. What's the next thing which they will have to remove then? Safari?! jeez..
SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
Wrong. This has nothing to do with problems with Java. The writers probably use Java as it's cross-platform, but they could just as easily used platform-specific code.
The virus
Trojan != virus
The only way of protecting an OS against Trojans is making it so that the OS will only run signed code and all apps must be checked first by the OS vendor before being available to the wider public, a la iOS.
Trojans are malware that work by tricking the user into running them/installing them. They do not work by exploiting OS vulnerabilities or security holes.
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
Java is one of the safest environments in existence, so this comment makes no sense. It's way safer than native code on iOS, let alone your typical Safari browser bug requiring no plugin. But nothing's perfect.
That's also why all iOS content is signed and required to come from Apple... do we want THAT on the Mac?
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
Wrong. This has nothing to do with problems with Java (see above)
Why would anyone click "Allow" in this context?
Why not, if they didn't understand the concept of a digital signature? It's all well and good that OSX warns you that something might be up, but by using poorly understood terminology, they increase the risk that a user will blow through the warning signs.
Trojan != virus
The only way of protecting an OS against Trojans is making it so that the OS will only run signed code and all apps must be checked first by the OS vendor before being available to the wider public, a la iOS.
Trojans are malware that work by tricking the user into running them/installing them. They do not work by exploiting OS vulnerabilities or security holes.
Or to put it in layman's terms...You are the hole!
Java is one of the safest environments in existence, so this comment makes no sense. It's way safer than native code on iOS, let alone your typical Safari browser bug requiring no plugin. But nothing's perfect.
That's also why all iOS content is signed and required to come from Apple... do we want THAT on the Mac?
Yes!!
... Trojans are malware that work by tricking the user into running them/installing them...
... a la Google Pack.
exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.
SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
Yeah. I mean, why would anyone enter their password to verify an installation when they didn't initialize it (and only wanted to check out a video). If it requires a password, then what is the problem? If it doesn't require a password, since this is a cross-platform trojan, Oracle needs to get on top of their security. Or I guess we can wait for an update to Snow Leopard that blocks this trojan...
Still, it's good that this is just another trojan. You don't have to worry about getting infected unless you actively do something stupid.
exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.
How does any malware modify the system? Either by the user entering the password or by some security hole like a buffer overflow. You seem to imply that things like execution of arbitrary code due to buffer overflows (or other security flaws) do not exist, when they are being reported almost weekly for some piece of software.
Why would anyone click "Allow" in this context?
exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.
SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).
Time and again coworkers (we use Windows
The problem is that those same Windows users carry over that same bad habit when they switch to Macs.
Just say no.
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
You sound like an idiot...removing java from the OS X install has NOTHING to do with the security of Java. If there is a security hole here, it's the fault of the OS, not the plug-in.
One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).
Time and again coworkers (we use Windows
The problem is that those same Windows users carry over that same bad habit when they switch to Macs.
This is sooo true. At least dialogs in OS X seem to be less frequent and less wordy