'Opener' Malware Targets OS X

the_webmaestro writes "Macintouch.com is covering the "opener" malware, a new and potential vulnerability which affects Mac OS X. If true (it's not on HoaxBusters yet), this could become a Mac user's worst nightmare... Worse even than Microsoft Word macro viruses (heretofore the only real 'viruses' which threatened Mac users)! Normally, when ever I'd see virus alerts, I'd revel in the fact that as a Mac user, I was immune (except for the slow-down of the net, the loss in productivity of my colleagues, and the increase in SPAM--often coming from my friends and colleagues). [Sigh] Perhaps, my days of telling friends and family that there are no viruses for Macs may be coming to an end. There have been stories."

All machines are vulnerable to this

I'm not sure how this qualifies as a vulnerability. If you read the
actual discussion linked, it's very clear that this is a root kit
installed after someone already has root access on your machine.

How did it suddenly become a vulnerability that if you have root
access to someones machine, you can write a script that will
automatically install a bunch of malware? If this were a self
propagating system, or if it were packaged up as a program that users
might install by accident I could see the point. As it stands now,
it's a script that you have to run *after* you have root access.

Common sense should apply here. On *any* system, if you run untrusted
code with root level access, it could do *bad* things to your system.

Re: All machines are vulnerable to this

> I'm not sure how this qualifies as a vulnerability. If you read the actual discussion linked, it's very clear that this is a root kit installed after someone already has root access on your machine. How did it suddenly become a vulnerability that if you have root access to someones machine, you can write a script that will automatically install a bunch of malware?

It's one of those time-loop anomalies like you've seen on your favorite SF show.

Re:All machines are vulnerable to this

Yes, to make it more clear:

The linked article ONLY talks about the things this program does to a person's computer, once it is on it, and does NOT discuss how it gets onto a computer in the first place--other than by manually installing it.

It might be malicious, but unless it is possible/easy for folks to accidentally install it (like all of the Windows spyware/malware), it is not a threat, any more than is THIS piece of Linux and MacOS Malware:

#!/bin/sh
rm -Rf /

Re:All machines are vulnerable to this

it is not a threat, any more than is THIS piece of Linux and MacOS Malware:

#!/bin/sh
rm -Rf /

Oh no!! That anonymous coward is spreading the OS X virus on the internet! I must be infected too now. Please, for your own good, close this browser window immediately!!!

Re:All machines are vulnerable to this

Actually, that'd blow away your homedir and anything else with your group / world write permissions. No root required, and it'd be a major nuiscance. Not that I know offhand an easy way to trick a user into running a shell script... :)

Re:All machines are vulnerable to this

Not that I know offhand an easy way to trick a user into running a shell script... :)

I just noticed that you have "." in your $PATH.

MUH, HA, HA, HA!

Re:All machines are vulnerable to this

What about this assertion from the MacIntouch page?

John C. Welch

...Using /Library/StartupItems/ for it shows some thought about Mac OS X. One of the problems with that directory is that, while items in it run as root prior to login, you don't have to be root to create startup items in that directory, nor do they have to be owned by root to run. Any admin user can use this directory to create startup items that will run as root. That's a weakness that hopefully will get fixed. ...

Could a Trojan be written to trick the user into installing a StartUp Item?

Re:All machines are vulnerable to this

Yes, a trojan could be written to do that. It would prompt you for an admin password, even if you launched the trojan executable as an admin user, but it could definitely be done, and if done correctly, a lot of users might be duped by it. Basically, if you run executables from untrusted sources, you could get bitten by this. This is true of any operating system. Trojans are always going to be a problem. Careful users probably won't be affected by it, but others might be. This is a far cry from a worm or virus, in that there is no vector that will allow this to propagate to any significant level. That being said, it's always crucial to keep updated with the latest security patches just to be safe. For now, this is not even a concern, but it could make script kiddies' lives a little easier, especially with this added publicity.

Re:All machines are vulnerable to this

On a relatively up to date 10.2.8 running in a Mac on linux window as we speak, my user account cannot
write into [Volume Name]:System:Library:StartupItems nor into its subdirectories (haven't tried them all but a quick chown or chmod can be a solution in that case). That folder is owned by 'system' and group 'wheel'.

So a script that needs to be installed as root is definitely not comparable to the plethora of vulnerabilities win users are exposed to. If that were the case osx and linux should have approx 5 percent of the total viruses, according to their market share. That simply doesnt happen so I consider this /. article FUD until somebody discovers what can remotely install such script. Keep your "boxen" updated, though.

I was wrong. Oops

Hm, I remember you used to be able to write directly to /Library/StartupItems without sudo-ing.

That must have been changed with some security update in the last while, because in 10.3.6 they're both

drwxr-xr-x 6 root wheel 204 15 Oct 19:22 /Library/StartupItems/
drwxr-xr-x 34 root wheel 1156 30 Sep 19:05 /System/Library/StartupItems/

Re:I was wrong. Oops

By default sudo (on all *nix systems) is configured to only request a password once within a set time period. (Read the man page for details.) It would be possible for a piece of smart malware to wait for the user to issue a sudo command. After the sudo ticket has been issued the malware could use sudo to gain root access without a password.

I do not know how this affects OSX. Some preference controls and updates require a password similar to sudo, but I do not know if sudo is used.

Re:All machines are vulnerable to this

Incorrect. You do need to authenticate. As an admin you are given slightly brouder privileges, but you are not in wheel. You need to sudo (or the GUI equv) to write to anything in /System/Lib

Re:All machines are vulnerable to this

Actually, the default account created by system setup (at least on my Mac running 10.3.5) is a regular user account for the most part. I can access admin sections of the system, but I am prompted for my password first to confirm that I want to do this. This is really no different than having a seperate user for admin rights, and I feel it's a very good solution.

Re:All machines are vulnerable to this

Users with admin rights do *not* need to login as root or to authenticate to install files in /Library/StartupItems. At the next boot, the script will be executed by root and your system is compromised without further notice.

Sorry, I can't just let this one go. As a nearby poster points out, the /Library/StartupItems directory is owned by root, and is not writable by the admin group. You would actually have to sudo or authenticate to create items in that directory (I have just confirmed this for myself).

This is on a machine running 10.3.5; I can't speak for earlier versions.

Re:All machines are vulnerable to this

/System/Library/StartupItems is owned by root and is not writable by admin. So you have to already have root access to install there. That's not really a security hole. /Library/StartupItems DOES NOT EXIST IN A DEFAULT OS X INSTALL.

It will be created if you install any 3rd party extensions that require startup services. For example on my machine, it was created by installing the Wacom tablet driver.

The permissions of /Library/StartupItems depend on who created the folder. In the case of the Wacom installer, it was created as drwxrwxr-x root/admin, so any admin user can write into it without authenticating. Since the default user is admin, this is a security hole.

Repairing permissions doesn't help, since that mechanism looks at the permissions in/Library/Receipts/*.pgk/.../*.bom to make the repairs, and will just restore whatever bad permissions the installer was using.

Re:All machines are vulnerable to this

Oh crap, it's true. When there is no existing /Library/StartupItems, the Aironet installer is creating one with 775 me:staff permissions. And even when there is, I bet it creates /Library/StartupItems/Cisco with the same permissions. Which means that any admin user (or me without doing a sudo) can change the scripts inside. Scripts that get run as root during startup.

Anyone out there who has installed Aironet wireless drivers, you might want to do something about your permissions in /Library/StartupItems.

Re:All machines are vulnerable to this

When there is no existing /Library/StartupItems, the Aironet installer is creating one with 775 me:staff permissions. And even when there is, I bet it creates /Library/StartupItems/Cisco with the same permissions.

Someone mod up parent!! This is clear example of where 3rd party driver/install software can break the "sane" security model of Unix. Windows has had this problem for a long time; it's only due to the relatively recent popularity of OSX that we'll the the issues with unix/linux.

Similar to the "so-called" vulns. in WordPress

As you already pointed out, you have to have root access to the machine then install a root kit. This is just a bunch of FUD similar to the ruckus the so-called WordPress vulernabilities that were reported last month [net-security.org]. Yes, they allowed you to redirect to any url as part of a seemingly innocent url, but you have to be logged into WordPress to exploit them. Highly overrated as severe security vulnerability.

admin access

In all of this discussion I still haven't seen a coherent account of how OS X actually works. Let me try:

1) Someone said that root isn't active by default. That's sort of true. Root obviously exists. Anyone who is in the group admin can do "sudo" to do a specific command as root. They have to type their password to use sudo. However they can't login as root or su to root, because root doesn't have a password. If you want to be able to su to root, you give root a password by "sudo passwd root" or something similar. That command is not documented by Apple. They intend that users who want to do something as root will use sudo. "sudo bash" would appear to be functionally equivalent to "su", so assigning a password to root doesn't seem necessary, and is probably not best practice.

2) There has been a lot of discussion about creating files in /Library/StartupItems. On a system that was installed from scratch a couple of months ago with the most recent OS, /Library/StartupItems is protected 755 root:wheel. On an older system it is protected 775 root:wheel. But you need to realize that wheel is *not* the admin group. My normal uid, which is an administrator, is not in wheel. The admin group is admin.

cd /Library/StartupItems

touch foo
touch: foo: Permission denied

This is on a system with 775 root:wheel.

Apple has done their best to make sure that you must type the password of an administrator before doing anything one would think of as administrator actions. Frankly I think there are enough corners in any complex OS to get unwary users to install Trojans. But some of the info in this thread has been wrong.

Re:All machines are vulnerable to this

No, you're simply wrong. Unlike Linux, by default on MacOS X, there is no root account active. Read that again - there is no root account active. You have to specifically enable it after you've installed the OS. The user created during install does have admin priviledges, but that doesn't mean that he or she has root priviledges. In fact, this has saved OS X from several vulnerabilities that afflicted Linux and other Unixes in the past.

I am not too concerned

As this Bash script (that's all it is) needs root access or physical access to the machine to propagate, I am not too concerned. Root is disabled by default on all shipping Mac's and if anyone has physical access to your machine then you are in serious trouble anyway.

Saying this though, keeping your Mac patched is probably the best idea. Some vulnerabilities in Mac OS X can give you root privs, but having the firewall on and only services that you need enabled (none are enabled by default) will protect you from those issues.

Re:I am not too concerned

Root is disabled by default on all shipping Mac's and if anyone has physical access to your machine then you are in serious trouble anyway. Right, but the initial setup of every shipping mac out there has the user create an administrative account on there machine. This person can run sudo to execute a root command. The password prompt you get before installing most mac software runs sudo. So an install program effectively runs as root and if the install program silently added this script to your system then it would run.

Re:I am not too concerned

I know this is not the best place to say this, but:

Hey! Mac developers! Quit requiring privileged steps during install!

Seriously. The Mac app architecture is designed so you can put all your files into a single bundle without littering crap all over the user's system folders.

I, for one, tend to kill any install that asks for my admin password (which is why I'm still using Preview instead of Adobe Acrobat).

If people get used to entering their admin password on every damn install, trojans like this will be all too easy. It's like software requiring a root install on Unix -- it's suspicious.

Re:I am not too concerned

And the reality, is that only the largest apps do that.

Really, I have over 200 apps on this machine and I can count on one hand (from memory) which ones used installers.

Emacs, XCode, Cisco VPNClient. Sorry, 3.

Everything else is standard mac fare, open DMG, drag n' drop and get to something more interesting.

That said, some of the programs ask for root after they're installed, which I think is a larger problem. A couple of "tweak" utilities that I use to do things which apple buries or makes hard to use do this. I even found one doing this:

echo "rootpassword" | sudo program

So, I think it would be easy to argue that malware is not my biggest problem as a mac user.

Anti-Virus

You mean my copy of Virex I get with .Mac will actually be useful now? ;)

FUD...

This is lame. A script! -this is Slashdot, you should know tthe possibilities of bash scripting. Besides, it doesn't even spread itself, don't hide its tracks...

Re: FUD...

> this is Slashdot, you should know tthe possibilities of bash scripting.

And of script bashing as well.

Normal rootkit

*chuckle*

So, this is a progression of the age-old idea of a rootkit. A program installed with administrator (root,superuser,avatar) rights to remotley control the machine.

Admitted, this one looks a bit more aggressive than some (running jack the ripper on the md5 passwords is blatant and obvious) but this is hardly any news for anyone.

What strikes me as confusing is that Mac users aren't used to this already? It's been standard issue with all Unix, Windows and some BeOS applications, that people would post "faked" binaries of some popular software that would instead own the system completely. Or for that matter, latch them on to an existing download, the same way spyware does in windows.

Overall, this isn't self-replicating, its blatantly obvious and appears quite easy to recover from. Don't fret.

Not to worry then

Normally, when ever I'd see virus alerts, I'd revel in the fact that as a Mac user, I was immune

Not to worry then, you're still immune. It's not a virus. It's not much of a vulnerability either; and no-one has ever suggested that OS/X - or any operating system for that matter - is immune to trojan horses. And this is what this is (if it's true) - a good old fashioned trojan horse.

Worst. virus. ever

So am I missing something, or is this really just a regular bash script that does bad things if given enough priviliges? Not surprising, I guess, since the submitter spelled "spam" using all caps...

Re:Worst. virus. ever

> Not surprising, I guess, since the submitter spelled "spam" using all caps...

... and lists "proficiency in Notepad" [mac.com] on his résumé :-).

Re:Worst. virus. ever

and lists "proficiency in Notepad" on his résumé

Shoot.... I guess I should take "proficiency with pencil and paper" off of mine.

Re:Mac owners are like Volvo drivers...

You do realise, I hope, that Volvo cars are made from surplus tank chassis, refined by the very best alien technology from Area 51!

Given the desire for American and European militaries to become much more mobile and urban-friendly, it would have made so much more sense to switch to a Volvo hatchback. The milage might not have been as good as they've been used to, though.

Nice script

I don't think it's as much of a real vulnerability as it is Macintouch.com being mesmerized by looking at the code in the "new" exploit.

#!/bin/bash
:(){ :|:& };:

Oooooooh, trippy code!

Re:Nice script

Yeah, it's a fork bomb with tiny amount of obfuscation, if you can call using a non-alpha character as a function name obfuscation. Things become clearer if you format it properly, and replace the user defined function name ":" with "foo", like this:

#!/bin/bash
foo()
{
foo | foo &
};

foo

So, we define a function, "foo", which runs "foo" piped into itself as a background task, then call "foo", and off we go. Essentially you are trying to execute the infinitely long command line of:

foo | foo | foo | foo | foo...

Re:Nice script

Damn! Forgot to cover the ampersand... Each successive call of the command *also* spawns a seperate instance of itself, behaving in the same manner. Exponential growth and recursion too!

"Administration" Password Problem...

Something thats always bothered me about OSX is how easy it is to write a program that prompts the user to enter their Admin password, and how many users just enter it when requested, for any old program.

I don't really know how Apple can address this.. perhaps some sort of 'certification' system for "programs which need admin access", but I've seen how that approach got dealt with by Microsoft and I don't really see it as a solution; just more problems. (App Certification is a crappy idea..)

Really, there's just no such thing as a piss-free sandbox. *sigh*

Re: "Administration" Password Problem...

OS X does this to a certain extent in that it tells you what application is running the security dialogue and what key it's requested, but unfortunately anyone can fake that interface in seconds. One thing to sure of is that when you type in your password it is into a normal OS X password box, anything else and the program gets to see the plain text of your password and could do anything. If it's the system's password box then the system does all the authentication and the program never gets a chance to steal the password.

Bob

Re: "Administration" Password Problem...

It is very easy to pop up a dialog that looks like the standard system one asking for an admin password. A simple fix for this would be to require the user to press command-option-escape (or some other OS-caught interrupt key combination) before typing in the dialog. This would identify spoofed dialogs and allow a user to check that the program popping up the dialog is the correct one, and it's asking for sensible permissions. I suspect the reason that this is not done, is that there is no reason for trojan writers no to simply use the API calls to create the dialog, and then abuse root privilege.

The best fix for this problem is to apply common sense. Do not give your admin password to any application except an installer for software acquired from a trusted source, or the OS X system utilities.

Re:"spoof" ctrl-alt-delete

Huh? I thought control-alt-delete on Windows *can* be sent on the application level. I mean, when I use RealVNC on my Windows box, I can remotely send control-alt-delete via any VNC client.

Causing the OS to respond as if to the control-alt-delete sequence is not a problem - the OS puts up its dialog box which is presumably secure.

The concern is if an application can intercept it when you do it on your keyboard, and stop the OS from putting up the box, but instead put up its own version that looks the same.

Re: "Administration" Password Problem...

You can make it a lot worse that that. It is (somewhat) exploitable by a timing attack if your virus waits patiently for another program to start installing. There is probably some recognizable signature you can check for in ps, and just keep running it repeatedly. Once another program is installing, the virus can then jump in and do the operation that requires root, thus popping up a dialog box. The title will probably be wrong, but the timing of the dialog box will be *right*, so most users wouldn't notice except for a second box popping up later. They'll probably convince themselves that they mistyped the password the first time.

This is a common vulnerability to just about any shared medium, and why users need to be careful even just running untrusted programs as a user. The unix equivalent is well timed "password" prompts from malware when the user runs something else they expect to generate such a message, such as ssh.

Re: "Administration" Password Problem...

Something thats always bothered me about OSX is how easy it is to write a program that prompts the user to enter their Admin password, and how many users just enter it when requested, for any old program.

Well, it's not like it's real hard for me to spoof a Windows dialog box asking for your administrator password (and I bet most users would give it, even though Windows has no concept of 'sudo'), or even telling you that your Internet Connection is too slow.

But it's not just OS X - any OS that has a GUI equivalent of sudo (which now includes FC2, RHEL, SuSE, among others) is easy enough to spoof with a dialog box. FC2 and RHEL just have some python libraries you import, and you're all set, and you get a userhelper dialog, just like the one displayed by the system utilities (system-config-packages, for example), and off you go.

The thing is, there is no good way around this. "Certification" is a problem, since getting your program certified (well, getting the CA) costs a *shitload* of money (yes, yes, CAcert [cacert.org], I saw them at USENIX too, except I wasn't real comfortable having my driver's license scanned by a bunch of people I'd never met), and that would rule out the smaller developers. Plus, it's not like the CA used to sign the programs can ever get stolen, or anything (*cough* Microsoft/VeriSign *cough*).

A key combination (like how XP claims pressing Ctrl-Alt-Del to log in makes your computer "more secure") is a pretty stupid idea, and anything will be able to intercept it before the OS does if it tries hard enough.

The best thing I can think of is that unless the software is produced by Apple (verified via some key), the dialog box to request the admin password says something that says "Admin privileges are being requsted by foo.pkg/bar.app located at /Users/joeuser/Desktop/downloadz. According to the metadata, this is required in order to install the following files or do the following operation. This software claims to be produced by FooCorp, at the URL www.foocorp.com". And then maybe that might make the user think harder about what they're doing. Sure, there's no reason why you wouldn't be able to fake it to look like Word or iDVD or something, but hopefully users might take a second or to and think "But, wait, I *have* iDVD, why am I installing a new version". And those that don't are going to get screwed anyway by giving all their money to the son of the former president of Nigeria, or by replying to "Citibank"'s request for their account number and PIN.

Really, I'm convinced education is the only way to fix this. What would be kind of cool would be like what the Justice Department did with online pyramid schemes - setting up fake web pages that lured people in and then told them that they could have been duped and lost millions if they clicked on the "Click here to sign up" link. Apple or someone could make a package that purports to be 10.4 preview release, yet has spelling errors and l33t-speak in the installer text, and then when you give it your admin password, it tells you why you're a moron and how not to do that in the future. But I suspect that wouldn't go over well - people don't like having stupidity pointed out to them.

Re: "Administration" Password Problem...

A key combination (like how XP claims pressing Ctrl-Alt-Del to log in makes your computer "more secure") is a pretty stupid idea, and anything will be able to intercept it before the OS does if it tries hard enough.

Not if the OS is written correctly. Secure attention sequences (the official name for this idea) work, when implemented correctly.

I've noticed that XP seems to have introduced a setting (on by default, even!) which stops it from working, though, which is remarkably daft IMO.

Hardly news

Yeah.. I could write a bunch of distructive shellscripts. But

#!/usr/bin/bash
rm -rf /*

Isn't an OSX/BSD/Linux vulnerability is it? It's just a shell script. The worrying thing is when you have some way of penetrating an OS's security to install these things.. The desctruction isn't the hard part gettin in to plant the bomb is.

Re:Hardly news

It was a " " SPACE that made it happen. And that's exactly what would break 95% of all shell scripts, because most UNIX guys don't expect a space to be in a filename. That's why they'll claim "GUI sux, I can write a shell script in 30 seconds that can do all that." - and then ship that.

Lame script kiddie

Overall this script looks pretty lame. A good "rootkit" should do everything possible to not make itself noticeable.

Doing things like changing preferences and turning on 5 different methods of remote access is a bit obvious.

What's really obvious is running john the ripper on the machine that was hacked. Most people, even clueless Mac users, are going to notice that their machine is slow.

Even brute force DES attacks are not feasible if your passowrd is not dictionary based, so cracking the password isn't going to be quick.

Re:Lame script kiddie

Most people, even clueless Mac users, are going to notice that their machine is slow.

{karma burnoff time}

Is that before, or after they run the script?

;)

Security in Mac OS/X Tiger

I do not think this could be classified as a virus. I am concerned however with the next release of Mac OS/X. It seems to contain a new feature that is integrated throughout the system called "Automator". It allows users to easily create and run scripts that perform cross-application batch-jobs. I wonder how it is integrated with mail and if it could pose a security risk in the same way Visual Basic Scripts do in Windows...

Re:Security in Mac OS/X Tiger

Automator is just a friendly GUI on top of AppleScript, which has been around since System 7.

"OS X virus" is the new "Apple is dying"

I wish people would just get off Apple's back. OS X has no viruses yet but it seems that people are all hot and bothered by the idea of finding the first one. What gives?

Anyone care to tell me how this so-called virus spreads? How does it propagate itself? Until we get to that point, I'm not going to accept that this is for real. And until then, those shouting that the sky has officially fallen on Cupertino can shut the hell up. I've heard this a dozen or so times over the last year-and-a-half and it's getting tiresome.

What is it about Apple that non-Apple users hate so much that requires this constant vigil for anything that could be a virus? And then the subsequent shouts of "Yep, take that smarmy Mac users... it's finally happened!" And this usually coming from people who beforehand would argue that the only reason Macs have no viruses is because of low market share. That argument disappears when it becomes inconvenient.

I've used Macs for over a decade now and most of that time was dominated by two phrases repeated ad nauseum. "Apple is dying" and "But there's no software!"

And now those have been replaced by this ongoing Quest for the Holy Virus.

I'm not saying OS X is invincible or that a virus will never hit Mac users, but when it happens, there will be little doubt about it. Until then, can we all just lay off the panic button?

Real Virus

Worse even than Microsoft Word macro viruses (heretofore the only real 'viruses' which threatened Mac users)!

I'm going to find a Mac user and sneeze on them... then they'll know what a real virus is!

(Seriously, we seem to have forgotten this is an analogy... don't make me communicate some worms!)

I looked up "virus for the Mac"

... and came up with Intego and FUD.

Make no doubt about it. There is a French company that writes Mac software called Intego.

THEY ARE the ones spreading this new rumor, just as they spread the "trojan horse" myth a few months back.

It's time to sell some more software - so it's time spread some more FUD.

A previous story I had done on this [jackwhispers.com]

Anti-Mac FUD?

Something about the writing style of this story really strikes me as sensationalist.

"Oh woe is me! I have a Mac but someone might (cringe) hack it! And think of all those people who trusted me when I recommended Macs as safe! The world should be ending around 3pm today Eastern Time...."

And it's not even a vulnerability! Geez, it's almost enough to make me think this is just someone grinding an axe.

Macs have always had viruses

I can remember downloading lists of known viruses when I was at University, between 1990 and 1994. Sure, the Mac was doing well (the total of all known viruses was under a hundred, compared to those for DOS/Windows, which exceeded 22,000.) But the number was certainly not zero.

OS X has the advantage of being BSD-based, which means that there are greater protections against malware. Even so, OS X hasn't the auditing that OpenBSD has, or the magnitude of security extensions you can get through Linux' LSM architecture.

Which brings me to Linux. Sure, I'll tell people that there are no Linux viruses. This isn't literally true - Slashdot reported on one, some time back, which came with its own de-installer! - but it's near-enough true.

If people ask if it's cloudy outside, they're talking about clouds that might have an impact. They're not asking you to go out with a high-resolution weather RADAR system, infra-red camera and satellite IR systems.

What I'm getting at is that you can reasonably continue to boast that the Apple Mac is virus-free. "Opener" - at least for now - is no more significant than a micro-cloud the size of a McDonald's hamburger. For now. Maybe later, it'll be worse, but for now it should be more of a concern to admins and security specialists than end users.

Re:warning: contains destructive virus

Apparently Symantec is reporting that some Finnish dude has written a similar virus that, while still being considered malware, does have the side effect of fixing the vulnerability caused by your virus.

The source code for the virus is:

rm /bin/rm

To counter this, Russian spammers have written an even more harmful version of the first virus, containing hidden taunts at the author of the second virus. It's believed to look something like this:

rm -rf /* #j00 sux0r!

Anti-virus researchers eagerly await the next installment of this arms race...

OK, so this is Slashdot, but...

can the AUTHOR at least be expected to RTFA? And the comments that are part of it?

Looks like someone wrote a convenient script to do some malicious stuff, that they install when they break into a machine. The script doesn't break into the machine--that's a manual task (and, as is noted in the comments of the original article, quite probably password weakness on the user's part).

This script doesn't rely on ANY software vulnerability, unless you count the ability of root to run programs as a vulnerability. It does so with malicious purposes, but that's hardly the OS' fault.

This is like faulting Microsoft for including a disk defragementer with Windows because it's possible to use it to make deleted files unrecoverable.

What, exactly, is the vulnerability that you want Apple to fix?

Oh, no!

A rootkit for MacOS X! What ever shall we do now?

Seriously, a bash script is not a thing to cause terror and panic in the Mac community, except possibly in the folks with no Unix background who may not understand the implications.

Basically, this script can cause Bad Things to happen, but only if you are silly enough to run it in the first place. The actual exploit, as it is, would be one of social engineering (convincing you to run the malware), not a technical one.

That's pretty important. From what we've seen, this can't remotely attack you. There's no unpatched vulnerability in MacOS X that it can use to insert itself into a running system without your knowledge. Were this a worm with an appropriate method of spreading, that would be different. But it's not that far removed from the classic Unix honor system virus as it stands.

The risk, as far as I can see, is that plenty of Mac users are even less technical than a bad Windows user - because they haven't had to know what's under the hood of their shiny new Mac. So they're inclined to type their admin password for just about anything without checking at all first. But that's a user education problem more than a technical one.

When this gets tethered to a remote attack is when I start worrying about it.

The response from Cupertino

"There are some who feel like that if they attack us, that we may decide to leave prematurely," Steve Jobs said. "They don't understand what they're talking about. ... There are some who feel like that the conditions are such that they can attack us there. My answer is: bring 'em on. We've got the force necessary to deal with the security situation."

lame lame lame...

When will /. get some editors that actually pay attention to stuff?

The most frightening thing is that if you read the evolving thread on the shell script in question, the "developers" seem to have trouble understanding what simple commands do. "What does 'find' do?" ... Yet, there's enough of them that they end up producing something that, at least, appears like it might function, and might serve some relatively benign but nefarious purpose...

Kinda like linux....

wow

Thanks for wasting all that space in the writeup about irrelevant Word macro viruses, how you have problems with Windows viruses (what, like nobody else does?), and how you can't tell your friends that no Mac viruses exist (if they're computer knowledgeable, they know that already; if they're not, they probably don't care). All that stuff is clearly more important than things like, y'know, summarizing the article or something, or telling us the quality of the story you linked too. We don't need to know how it spreads; we need to know more about your personal life! Spare me.

The virus is this story

Most casual /. readers won't bother to read the article. Meanwhile they'll be telling everyone "d'ya hear about that Mac virus?". And the meme will spread regardless of the fact that this story is content free.

Re:This is real. Here's how:

It doesn't matter whether they're root or not, even an unprivileged user can act as a spam relay or DOS agent or any number of other things that make them valuable to any number of dickheads. It is also almost as disasterous to wipe out an unprivileged user's account as it is to wipe out the machine.

The "malware" described here is really nothing more than a rootkit someone discovered on a compromised machine. So far as I know, no evidence has surfaced as to how it got there. So we have no evidence that a trojan, worm or virus is at work spreading this thing. Given that, I think this story is awfully alarmist.

Here's what prevents it...

There are all kinds of great malware delivery systems. It's just a matter of time. The Mac is no more exempt than Windows.

That's not true. Windows contains many components that operate on or are exposed to untrusted objects and are not inherently secure.

An inherently secure design is one in which there are no APIs that depend on the ability to perform trusted operations from potentially untrusted objects. The MS HTML control, for example, depends on tha ability for a document in the most trusted zone to launch arbitrary code without restructions. That means that if an attacker can get any application (ANY application that uses the HTML control) to open a document that's in that zone, it's in.

Fixing a vulnerability of this type requires modifying the definition of the trusted zone. The result is that previously working code breaks. So the vulnerability is only fixed when there's evidence that it's known and likely to be exploited.

Any time you have an inherently insecure design, you get this problem.

So. Mac OS X requires normal levels of vigilance to remain secure. The most likely exploit is the same as it has ever been: social engineering. If a guy comes up to the door and asks to come in on some flimsy excuse, do you invite him in? No. If someone in your office has a habit of inviting strangers into the back rooms, do you treat that as a problem? Yes. Apply the same level of caution on your computer, remind your co-workers if they seem likely to do something unwise, and you should be safe.

On Windows that's not true, because the design of IE and related applications is not inherently secure. It's like having a lock on your front door that will open if someone says "please".

No, it's Win vs EVERYONE.

You need two things to infect a computer: a communications channel you can compromise, and a mechanism to launch the malware.

Local communication channels come down to physical access: it doesn't matter if a computer system has firewire ports or not, for example, because firewire is a local resource. If you have physical access then you can compromise the computer... that's pretty much an axiom.

So you need to look at any remote communication channels that can be compromised, and if are there mechanisms that can be used to launch malicious code.

What incoming connections are accepted, then? Well, there's far fewer on just about any operating system than a Windows-based personal computer. So:

The number of transoms on a Mac is about the same as an average PC.

I don't know whether you're just counting physical ports (which is irrelevant), or you're suggesting that there's as many logical ports open on the Mac. If the latter, no, that's just not true. Windows installs and runs with half a dozen wide open ports, and you can not close them down without breaking basic functionality that the OS requires. The *only* way to secure it is with a firewall. What should be an extra protective layer... part of a defense in depth... becomes the whole of the security system.

I don't know any other operating system that leaves its fly open like this.

But IE is also available on the Mac

Irrelevant. It's got the same name, but it's not even vaguely the same program. IE on Windows is a thin wrapper about a core part of the OS... and that core part is almost criminally badly designed. IE on the Mac is a standalone application. As is IE on Solaris.

You get the same reaction every time people see a backdoor kit like this and immediately jump all the way to this proves 'other OS' is as open as Windows!. It ain't true, and it won't ever be true, until (and unless) Microsoft makes some deep and fundamental changes in Windows' networking and user interface design.

lemme sum this up for the non-technicial people.

"OMFG!!!!! People CAN STEAL MY CAR[*]!!!!!!"

[*]Requires Correct Keys to Car!

Not a vulnerability

This isn't a vulnerability in OS X, it's a tool to be installed after you get in. The only vector is social engineering. Social engineering always works: if someone can fool you into opening the door they can come in through the door, that's always going to be true. And once they have local access they can always install a back door.

Having an OS and applications that follow good security procedures doesn't mean you can neglect elementary precautions like "don't trust unexpected email attachments".

Did anyone notice how nicely it's commented?

.. Almost like they were tailoring it to an audience of scripting newbies. It even comes with a readme. It's like the iHack of rootkits. The source [mac.com] has great stuff like

echo "nidump the password file"
echo #lets grab this now in case anything goes wrong
/usr/bin/nidump passwd .
echo ""
/usr/bin/nidump passwd /

and

# append some commands to the cron scripts
# since both routines are checking the last line of the file they should not be using the same
# file as they will both just keep appending!

I'm surprised they didn't pop up a nice helpful dialog box if the script is killed - something like "For your information, your Mac has been taken over by another user. You may want to do some reading on security and protecting yourself. [OK]"

Malware? Virus? BS!

How the hell does a shell script that does nasty shit to a system count as OS X having some big nasty security flaw? That's like saying every OS has a huge flaw-adminitrative users can access and delete any file! Holy shit, we're all doomed!

Whichever of the /. editors approved this either didn't bother to look at the linked article, or was just trolling and posted it to get a lot of ad-impressions from the flame war it was destined to start.

Thanks slashdot - problem SOLVED!

Low and behold, the script is on my machine too! Now I know why my Power Mac 8500 was taking so long to copy that 30 meg file!

Re:As Nelson would say.

I'm taking my reading of /. to a whole new level. Not only do I ignore the articles but now I totally ignore the comments too!

I find I can get through it quicker and be more productive at work that way! :D

Re:Uninformed.

Yes, there were viruses in the pre-OS X days. But the crappy article summary was obviously talking about OS X. Do you have any examples of OS X viruses? Without one, you have no point, and sound like a troll.

Sure, virus scanners are proof of viruses. It's definitely not possible that the company behind VirusBarrier is just trying to trick people into buying a product they don't need. Because corporations don't want profit, right? They'll just try to justify the program's existence by adding features for non-virus stuff and claiming they're building an infrastructure for fast response if there ever is a virus. So mod parent down -1 Troll!

Re:You're not immune, just too little to care abou

Since you capitalize the word "only" I'm afraid you actually mean that. Do you also think that the ONLY reason IE has more security holes then Mozilla is because more people run IE? I'm quite certain that there's more then one reason why Macs don't have as much viruses as the Windows world and the market share being one of the reasons. And how does the email address tell wheter you're on a Mac or PC so Macs don't get spam? I thought people were the targets of spam, not computers.

Re:Use sudo

Go into Netinfo, enable root account. You can now log in as root.

Back when OS X was pretty new, lots of *nix illiterates used to think you had to be logged in as root to have all the administrative powers of the system. Lots of software would be broken by it, and shareware developers would be swamped by email by people saying "I'm logged in as root and your program doesn't work".