Os X Trojan

bobw

bobw

The Late: SuperMacMod
INTEGO SECURITY ALERT

Intego Announces Protection against the First Mac OS X Trojan Horse: MP3Concept

Paris, France: 4:15pm, April 8, 2004 – Intego, the Macintosh security specialist, has just released updated virus definitions for Intego VirusBarrier to protect Mac users against the first Trojan horse that affects Mac OS X. This Trojan horse, MP3Concept (MP3Virus.Gen), exploits a weakness in Mac OS X where applications can appear to be other types of files.

The Trojan horse's code is encapsulated in the ID3 tag of an MP3 (digital music) file. This code is in reality a hidden application that can run on any Macintosh computer running Mac OS X.

Mac OS X displays the icon of the MP3 file, with an .mp3 extension, rather than showing the file as an application, leading users to believe that they can double-click the file to listen to it. But double clicking the file launches the hidden code, which can damage or delete files on computers running Mac OS X, then iTunes to play the music contained in the file, to make users think that it is really an MP3 file . While the first versions of this Trojan horse that Intego has isolated are benign, this technique opens the door to more serious risks.

This Trojan horse has the potential to do any of the following:
- Delete all of a user's personal files
- Send an e-mail message containing a copy of itself to other users
- Infect other MP3, JPEG, GIF or QuickTime files

Due to the use of this technique, users can no longer safely double-click MP3 files in Mac OS X. This same technique could be used with JPEG and GIF files, though no such cases of infected graphic files have yet been seen.

Intego VirusBarrier eradicates this Trojan horse, and Intego remains diligent to ensure that VirusBarrier will also eradicate any future viruses that may try to exploit this same technique. All Intego VirusBarrier users should make sure that their virus definitions are up to date by using the NetUpdate preference pane in the Mac OS X System Preferences.

http://www.intego.com/news/pr40.html
 
I wonder if RIAA paid to develop that trojan. It would suit RIAA's needs .. making people scared of downloading [unpaid] music.
 
This is a real stupid troyan ! But if it works... It's like the .pif files of PCs.
 
more: "First its an application that you must run by yourself. Second its a CFM application so it needs its resource fork, creater fork and file type to run.
You'd have to download this thing encoded in a format such as a Stuffit archive and the double click it to run. Basically you'd need to be pretty stupid."

http://groups.google.com/groups?hl=...-5D750C.02150821032004@news.bahnhof.s e#link6 has some interesting stuff about the virus too.


http://apple.slashdot.org/comments....ort=1&tid=126&tid=172&mode=thread&cid=8808749 - one guy downloaded the file (link of google..) and tried to open it. panther (10.3) does not allow to open it anyway.

more on ;)
 
"...It was discovered today by antivirus software company Intego, which manufactures VirusBarrier, a security suite for the Mac.... Luckily, this trojan hasn't been released into the wild... Intego offers its VirusBarrier Mac-security software for $59.95..."

Hmm... Now if this trojan hasn't actually been released, how did Intego "discover" it?

What a scam.
 
bound to happen sooner or later... some person, probably reading a forum thread of people bragging how OSX is virus proof decided to create one just for us.
 
I suspect that they "discovered" Bo Lindbergh's proof of concept code in the Google groups posting, same as Giaguara.

As the posting says - it's a proof of concept - all the program does is open the data fork (which contains the mp3 or whatever) in an appropriate app like iTunes, then open up a dialog box to demonstrate that it's also executing code. It's not really a trojan horse, just a demonstration that this method of making a trojan horse could work.

That's why, as Intego says
While the first versions of this Trojan horse that Intego has isolated are benign, this technique opens the door to more serious risks.
Click to expand...

So no wonder it's not "in the wild" - it doesn't do anything at all to spread itself, like infecting other mp3s or whatever. You couldn't even download this off Kazaa or wherever, since the resource fork and type/creator would be stripped off, and that's the part that says "contrary to the '.mp3' name, I am an application. Please start execution at this location (location of the bogus id3 field)". All you'd have would be the data fork - an mp3 file with a junked album art field in the id3 tag.
 
You'll find an interview of Intego on macbidouille http://www.macbidouille.com/article.php?id=152 (in French).

What is interesting is that some false positive are due to companies using the same trick for some time for their own purpose (hiding serials or other data in the supposed passive file) !
 
This hoax is just a shameless and despicable marketing ploy. Wired parroted the whole press release but has since pulled their article from their main listings and moved it to "Quote Marks."
 
I think it's only fair that in Intego's press release, they should have concrete proof that this trojan actually exist; reproduce the so-called "malicious Trojan Horse" and visually present how this particular thing manifest. If Intego is trying to sell their software, the company should show how their "anti-virus" will counter such a thing.

It very well maybe just a publicity stunt. So far Intego is not showing their cards, just a bunch of bluff.

To say that it now targets iTMS, last time I checked, they distribute the songs as .AAC files. Would those be affected too?
 
You must log in or register to reply here.
Back
Top