Viruses on OS X

[lurk]

I am curious what kind of local root exploits are there in PHP? You have made a big accusation that I find hard to believe as it implies a fundamental failure in the basic structure of the OS (both Linux and Darwin).

[Andrew Adamson]

Originally Posted by lurk

You have made a big accusation that I find hard to believe as it implies a fundamental failure in the basic structure of the OS (both Linux and Darwin).

I wouldn't say 'fundamental failure' of the OS. If you regularly visit Secunia.org, you'll see that exploits like this are pretty routine. Specifically, regarding PHP and permission escalation, see http://secunia.com/advisories/13481/. There are plenty more if you dig.

I guess I should point out that I am not a security wonk. I am a programmer. Because I write things with my client's security in mind, the security of the products I use is important to me. So I try to keep my eyes and ears open about vulnerabiilties. Also, I live in Japan, while I maintain banking and credit card accounts in Canada -- so a key logger or rootkit could pretty much ruin my day. As a result, I regularly visit Secunia, I watch the processes that are running, I read my logs. I try to be safe.

I guess, regarding TommyWillB's comments, all I can say is that 'novice users' 'installing things' was the chief reason Windows is the security nightmare it is (in my opinion). Simply saying that 'it's your fault; if you installed it, you should have known what you were doing' is not enough for Microsoft users, so it shouldn't be for anyone else. Furthermore, certain vulnerabilities can mean things get installed without the user's help. So, leaving things like PHP installed when the overwhelming majority of Mac users don't know what PHP is and certainly would never use it, is dumb enough. Leaving it installed when vulnerabilities exist now and will probably exist for some time to come is dumb and risky. And leaving it installed when vulnerabilities in other products might be used to run PHP scripts locally, dumb and VERY risky.

I'm real sorry for saying this, but I get the impression that I am beating a dead horse here. Just because 'Product X' (PHP, iTunes, AppleScript...) is cool, just because it's been around forever, just because everyone and their cousin uses it, doesn't mean it is secure. Before you say something is secure, you should first try to find out if it is not. Otherwise, assume it is not.

[Tetano]

Originally Posted by lurk

I am curious what kind of local root exploits are there in PHP?

you may check in this forum....

[HomunQlus]

People, it's done. It's true. There's the first trojan known to me for OS X. It puts in some entries into the start up files and opens some back doors that allow intruders to run commands on root level.

http://www.sophos.com/virusinfo/analyses/maccowhanda.html

[Lt Major Burns]

so... er, what do we do? none of us have anti-virus software

[HomunQlus]

On the link I posted, I think on the bottom, they give you instructions or tool of some sort to remove it. Have to check that out either

[Lt Major Burns]

i assume it's a patch for Sophos antivirus - it's just not a recognised file

[HomunQlus]

Hmm.... maybe they release something for OS X in particular, some sort of removal tool. We can also watch the Apple download sites, maybe they're aware of that also and provide something