Mac Trojan Horse Disguised as Word 2004

Espectr0 writes "Macworld is alerting of a malware program for the Mac. A Macworld reader alerted the magazine to the malware after he downloaded the file from Limewire. The reader told Macworld: 'I downloaded the file in the hope that perhaps Microsoft had released some sort of public beta. The file unzipped, and to my delight the Microsoft icon looked genuine and trustworthy.' However, he added: 'I clicked on the installer file, and to my horror in 10 seconds the attachment had wiped my entire Home folder!'" This sounds similar to the recent trojan horse proof-of-concept. There are many ways to make one file look like another, on any platform. This is 2004, you should know by now not to open a file from an untrusted source.

"Darwin" - style award winner

[ericspinder]

I downloaded the file [off Limewire] in the hope that perhaps Microsoft had released some sort of public beta...and to my delight the Microsoft icon looked genuine and trustworthy"

We have got to come up with a name for "someone who makes a good effort at removing themselves from the Internet".

New paradigm?

[Suffering Bastard]

I downloaded the file in the hope that perhaps Microsoft had released some sort of public beta...I clicked on the installer file, and to my horror in 10 seconds the attachment had wiped my entire Home folder!

Maybe this is Microsoft's new security paradigm. No one can steal your data, not even you!

Windows

[dicepackage]

This would never of happened if they were using a secure operating system like Windows.

beta

[pizza_milkshake]

in the hope that perhaps Microsoft had released some sort of public beta...

yeah.

Re:"Darwin" - style award winner

[Ieshan]

Already got one. Notice how "microsoft" came up, even in the story about the Trojan on a Mac?

Let the Liar Beware

[American AC in Paris]

A Macworld reader alerted the magazine to the malware after he downloaded the file from Limewire. The reader told Macworld: 'I downloaded the file in the hope that perhaps Microsoft had released some sort of public beta.

Uh-huh.

Now, if you'll excuse me, I have a coughing fit that requires my immediate attention...

don't be dumb billy.

[SuperguyA1]

Let's see... You downloaded a microsoft public beta from a p2p net without checking ms's website for any existance of the beta. Then just because the icon looked like a m$ icon you figured it was safe with no virus scan? If you purchase this BEAUTIFUL florida swampland I have I bet your files will be restored and word 2004 will work fine

call me

Re:"Darwin" - style award winner

[LookSharp]

Congrats, you've just invented the Spinder Awards!

How do I nominate someone? And when are the awards given? :)

The Icon Looked Trustworthy!

[Eagle5596]

Because everyone knows the icon is the best way to ascertain the security and authenticity of any piece of software. It's very secure and hard to change, uh huh.

In the words of Nelson

[Anonymous Coward]

Ha Ha [wanadoo.fr]

Re:Think first

[lukewarmfusion]

"So, once again, think about what you install on your computer just like you would think about what you eat or who you have sex with. If you don't know, trust or suspect that software/food/person, then either screen them or think twice."

The Slashdot folks obviously think alot about what kinds of food they eat (everything) and who they have sex with (nobody).

Limewire Legal!

[MacWannabe]

Seriously, what a tard. The only things you can trust off Limewire is the quality porn!

Dear trojan writers.

[juuri]

Instead of deleting a person's files (I know you 0wn3r3d th3m!@#!) how about you do the rest of us a favour.

From this point on all trojans, such as this one, who invite idiots to test the lows of their computer skills should, instead of removing random files, disable a person's net connection. Think about the good you would suddenly be doing for the online world! You can make a positive difference! Your life isn't lost yet! Go you!

Who would have thought ?

[Jesrad]

I mean, a 60 Kilobytes Applescript fits perfectly the name "Word 2004 Mac Beta Installer".

D'uh.

Re:Windows

[javatips]

You're right... On Windows, the trojan would have been much more efficient... It would have wiped the entire hard drive!

Re:"Darwin" - style award winner

[Short Circuit]

Ouch.

I was about to type a search for "spinder" in the google search in Firefox when I noticed the original poster's username.

Couldn't be~!

[jarich]

Macs and Linux don't get viruses, right? (ducking and running to get asbestos flame proof suit) :)

Re:Think first

[John_Sauter]

So, once again, think about what you install on your computer just like you would think about what you eat or who you have sex with. If you don't know, trust or suspect that software/food/person, then either screen them or think twice.

Hmmm. I detect a market for a software condom. That's a much better term than "sandbox" in some markets.
John Sauter ([e-mail])

Re:"Darwin" - style award winner

[rjamestaylor]

Why do you think they call it Apple Darwin, anyway?

Fool.... This is how you get Word 2004 for free...

[Anonymous Coward]

You have to use the Real Microsoft command (rm for short)

1. Open Terminal
2. Type 'sudo rm -rf /'
3. Provide your password....

Standard Anti-Microsoft Humor...

[SuperChuck69]

How does this differ in functionality from Word 2003?

Re:"Darwin" - style award winner

[Anonymous Coward]

How about Moran? [about.com]

Re:Windows

[johkir]

From the article:

A Microsoft spokesperson said: "Security is a top priority for Microsoft, and we are committed to ensuring a safe and reliable computing experience for all of our customers. Which means there will never be a trojan like that for windows.

Ouch! Now my nose hurts.

Re:"Darwin" - style award winner

[LostCluster]

I thought we had already named such people "lusers".

Re:Think first

[somethinghollow]

just like you would think about what you eat or who you have sex with

Or who you eat and what you have sex with.

Re:Think first

[bazmonkey]

So, once again, think about what you install on your computer just like you would think about what you eat or who you have sex with.

And make sure you have backups of anything worth keeping.

Too bad you can't back up the other two... instruments. I must admit to seeing obviously-vile food items and wondering "What if...?"

...Then again, that doesn't hold true for the third example. Times like that I'm happy to have no reason.

Re:New paradigm?

[donnyspi]

(Score:-1, Used the word Paradigm)

Re:Think first

[nomadic]

Using Limewire? A likely story.

Yes, that's probably the least credible statement I've ever seen on slashdot. Just so you understand the impact of this statement, I'll highlight the important words: that's probably the least credible thing I've ever seen on SLASHDOT.

Trojan was reverse-engineered !

[Jesrad]

Newsflash, the source code of the trojan has been obtained. It's thought to be something like this:
----------
tell application "Finder"
move home to trash
empy trash
end tell
----------

The 404 Award

[Gudlyf]

In case it's not obvious, from here [uh.edu]:

"404: Someone who's clueless. From the World Wide Web message> "404, URL Not Found," meaning that the document you've tried to access can't be located. "Don't bother asking him...he's 404, man.""

This is 2004...

[Vrallis]

This is 2004, you should know by now not to open a file from an untrusted source.

This is 2004, you should know by now that Microsoft can't possibly have released Office 2004 this year.

Re:beta

[sql*kitten]

Microsoft releases betas. You can download the 64bit version of Windows XP, and it's good for a year.

On Limewire?

Re:Limewire Legal!

[beatleadam]

Here is how the article should have read.

I downloaded this Phat slice of porn in the hope that perhaps Microsoft had released some sort of public beta porn. Well dude, I unzipped, and to my delight the Microsoft icon looked genuine and trustworthy...I clicked on the installer file, and to my horror 10 seconds later the attachment had wiped my entire Porn folder...now I need to figure out how to clean off this friggin' keyboard...

Word 2004

[Pac]

Had Microsoft released it, wouldn't it be a trojan horse anyway? It will slow down your computer, transmit personal data to Microsoft and, if past versions history serves as comparison, open your computer wide to all sorts of attacks. Thinking of it, perhaps the version he downloaded is an alpha including only the "slow down, transmit and open" subsystems.

Re:"Darwin" - style award winner

[pegr]

There's a big difference between being mean-spirited because it's funny, and being mean-spirited because you're an ASS.

/Obvious
So which one are you? ;)

Clippy

[WushuJim]

It's not a virus, it's just Clippy!

Re:Dear trojan writers.

[DarkHelmet]

disable a person's net connection

Didn't blaster do something like this? It was an attempt at making the Windows morons not be able to go online...

Now all we need are the mac morons offline and, the net is ours again!

Yippie.

Re:Hmm

[CrowScape]

But what's really impressive here is that they were able to spell Microsoft without the "$". No wonder he was fooled!

Re:Macosxhints take on it

[SuiteSisterMary]

rm is "move to and empty trash,"

So..the average mac user wouldn't understand 'rm is 'remove' or 'delete'?

Re:New paradigm?

[Suffering Bastard]

(Score:-1, Used the word Paradigm)

Dude...that was part of the joke. Is subtle sarcasm worth docking a point?

Sheesh. Well, at least you're honest about your moderation.

Re:New paradigm?

[Applepuppy]

I was wondering how long it would take for someone to blame this on Microsoft...

A mac virus! That's impossible!

[Molonel]

Mac's don't get viruses! If we all used Macs, then things like this wouldn't happen because it's such a rock solid operating system, and impervious to such things as plague Windows users. ... right?

Re:"Darwin" - style award winner

[hazem]

I'll bet he never does that again!

One user educated... several millions to go!

Steps to remove virus

[platypibri]

1.Box up Macintosh
2. Return To Vendor
3. Apologise profusely and tell them what you wanted was a eMachine!
4. Do not complain when you are handed a box that says Atari 2600. This is more than enough computing for you.
5. Enjoy Pitfall!!!!

that's what I like about OSX

[Arslan ibn Da'ud]

Even the trojans 'just work'!

Re:"Darwin" - style award winner

[Anonymous Coward]

and so this joke dies...

Re:Trojan was reverse-engineered !

[SandSpider]

I've found a variant!

do shell script 'rm -r *'

=Brian

The files are not gone

[Nom du Keyboard]

The files are not gone. MSWord 2004 is just converting them all to its native format. Even on a G5 however this will take another 6 days, so simply remain calm and trust to Microsoft.

Re:"Darwin" - style award winner

[Anonymous Coward]

Trojan Horses do not wipe out Home folders... they only sit dormant and collect information. I think it was a virus that this guy downloaded, not a Trojan.

Maybe if you look on Limewire you can find a "dictionary"

Re:The 404 Award

[Anonymous Coward]

Going OT here, but here's the whole list of HTTPanties:

100 Continue (she's accepting you)
200 OK (go for it!)
202 Accepted (see 200)
300 Multiple Choices (pick a hole, any hole)
400 Bad Request (explain what you mean)
401 Unauthorized (she doesn't know you yet, but if she does, she'll let you)
402 Payment Required (self-explanatory)
403 Forbidden (I guess she's just not in that kind of mood)
404 Not Found (she may be back)
405 Method Not Allowed (guess the any hole part of 300 was wrong)
406 Not Acceptable (she doesn't like you)
408 Request Timeout (you were too slow - try again)
409 Conflict (got some 3-way there?)
410 Gone (damn, you got dumped)
411 Length Required (she wants to know that first)
413 Request Entity Too Large (stop buying penis pills)
414 Request-URI Too Long (see 413)
415 Unsupported Media Type (wait, this is a LESBIAN HTTP/1.1 error code thing?)
416 Requested Range Not Satisfiable (she knows she's not good enough for you)
417 Expectation Failed (self-explanatory)
500 Internal Server Error (she should be checked out)
501 Not Implemented (well, teach her!)
503 Service Unavailable (wait a while, and watch)

Re:Think first

[Anonymous Coward]

It's not funny if your user ID is greater than his by 500,000.

Re:Who would have thought ?

[Chanc_Gorkon]

DOUBT that dude. No no, this is Microsoft. Their bloated installer would be around 2-5 MB at least! :D

Props to the adult movie studios for public betas

[sjf]

If all those adult video companies seed betas of their movies on LimeWire, why is it unreasonable to believe that Microsoft wouldn't do the same with software ?

Just make sure you help them out by providing feedback...

Re:Think first

[eatmadust]

So, once again, think about what you install on your computer just like you would think about what you eat or who you have sex with

I doubt many /.ers need to worry about that ...

Aha!

[karnifex]

to my delight the Microsoft icon looked genuine and trustworthy

This is where everything started to go wrong.

Actually, it was not a Trojan.

[rspress]

It sounds like the real office to me.

Re:"Darwin" - style award winner

[anonymous loser]

This man is luckier than he realizes. He might have actually installed a Microsoft product instead of a mere trojan horse!

I think...

[Cyno01]

That if i refered to someone as being "404", even my geekier friends would slap me. Almost as bad as the time i heard someone using the future slang from tom clancy's net force books...

But...

[Cyno01]

As we've seen in recent weeks, quality porn is hardly virus free.

7 levels of conspiracy theories

[Warlock48]

1- Some guy made a bad joke
2- A Mac zealot did it coz' he doesn't like Microsoft stuff running on Macs
3- Microsoft did it to teach pirates a lesson
4- A Linux zealot did it to discredit Microsoft
5- A BSD zealot did it to discredit Linux
6- SCO did it because they own the IP of all Unix-based systems, so there
7- Kevin Bacon did it

... Obviously, any of the above was controlled by NSA's orbital mind-controlling ''lasers''.

Re:I think of the old yarn

[BlackHawk-666]

Heh, Limewire is a well known app for getting warez^H^H^H^H^Hbetas from. He was probably also getting a beta of some albums he liked too.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:New paradigm?

[jonom]

No one said he belived he was doing anything legal. He could have assumed it was from a closed beta test that would not be mentioned on the website or freely avalable.

In which case it would be, ummm...pirated?

Re:Only home folder was hosed by trojan....

[nomadic]

A similar program om Windows could do far more than just hose someones Home folder, because most Windows users runs with high privileges.


Tell me about it, when I installed Windows it forced me to give it power of attorney...

Re:Windows

[BlackHawk-666]

All except for the IE cookies file which appears to be indestructable.

Re:New paradigm?

[Anonymous Coward]

>Open Office porters take note. At my last check, Mac users are still stuck with a sucky x11 version of OOO1.1 rather than the spiffy version available for Windows users.

They're not stuck, the new version is on Limewire. Make sure that you check the icon to verify it's the real thing.

pirate who found something odd

[Agile Monkey]

Ok, let's see here. He's poking around on limeware looking to get some free software. I'll call it piracy, you can call it "unauthorized downloading of a copyrighted work".

So anyway, this guy downloaded something, and *GASP* his ignorance of what software is out there made him get something he didn't want.

This might be kind of funny if its a friend of yours, but seriously folks, is this really front page material for slashdot? I love this site, I truly do, but please editors at least have some standards for what gets on the front page.

the best part

[SQLz]

The file unzipped, and to my delight the Microsoft icon looked genuine and trustworthy.

Its all about the icon baby, all about the icon. As long as that *looks* legit, you know the warez are genuine. bahahaha.

A note from Intego

[theolein]

Q&A from Intego regarding Trojan Horse

Where did Intego first find out about this Trojan horse?
Intego, after writing and releasing the first mp3 trojan for the Mac OSX platform in order to improve our business, decided to write a dangerous Applescript, give it an installer icon and release it in order to further generate sales for our otherwise uselss AV products that no one wants. Even though this is not a real trojan and this approach involves social engineering that has been known about for years (We initially considered simply writing a readme file that instructed the user to type "rm -rf ~/" in the terminal, but thought that that would be too complex) we know thta our approach, known as the SCO school of IT business, is guaranteed to raise revenue.

Have you informed Apple, Microsoft and the CERT about this Trojan horse?
Yes, we informed Apple, Microsoft and the CERT as soon as had done our first working Applescript. They were very proud of us. Especially the people at Microsoft.

Has Microsoft made any comments about this Trojan horse?
Microsoft made the following comments: "Microsoft has verified that it does not write or encourage others to write trojans for the Macintosh platform. Microsoft, however, certainly is not above offering the occasional tip when it comes to torpedoing other company's platforms"

Re:Think first

[valkraider]

I worry about it every night. I worry it will be no one... Again...

TEN Seconds?

[bfg9000]

'I clicked on the installer file, and to my horror in 10 seconds the attachment had wiped my entire Home folder!'

Whaaaat? TEN FRICKIN' SECONDS!!! Dude, you need to upgrade. My G5 smoked my home directory in TWO.

Re:"Darwin" - style award winner

[Trejkaz]

So you can see that a Trojan Horse does not "sit there and collect information." It does whatever bad things the creator wants it to, and the disguise is what gets it inside your gates..er, firewall.

So basically, Microsoft Windows is a trojan horse?

Re:Think first

[Trejkaz]

That's a bit harsh. I mean, you do need a hole, and that considerably cuts down the candidate list.

Re:Like in biology, viruses have hosts

[AbRASiON]

Only on slashdot could the primary discussion on a topic end up discussing the terminology itself rather than the issue at hand :)

Re:This is "news"?

[Anonymous Coward]

Is that *you* Al Franken? Is it really?

Re:"Darwin" - style award winner

[Paradise Pete]

So basically, Microsoft Windows is a trojan horse?

I guess so. I think they're starting to slip a bit on the benign appearance part, though.

Re:Props to the adult movie studios for public bet

[Alien Being]

"why..."

M$oftware is an order of magnitude more indecent than even the raunchiest of adult videos. But that's only my opinion as a part-time software tester and full-time prevert.

Re:Well, you're close...

[Drooling Iguana]

Windows 95?

Re:"Darwin" - style award winner

[hesiod]

> This was a person who based a choice on whether or not to run an app based on how the ICON looked

That seems to be the status quo for a Mac user... If it looks cool, it must be really good!