Matasano Chargen » Blog Archive » The Silly New Mac OS X Trojan or HoHum.A

The Silly New Mac OS X Trojan or HoHum.A

Dave G. | November 1st, 2007 | Filed Under: Apple

As I am sure most of our readers are aware, there is a new Mac OS X trojan floating around. The authors seem to target users of pornographic websites, and requires full user interaction to install (e.g. allowing the program to run and typing in your administrator password). While it is definitely a sign that the botnet side of Internet crime is beginning to target Mac users, I don’t agree with Gadi Evron who states:

For whoever didn’t hear, there is a Macintosh trojan in-the-wild being dropped, infecting mac users. Yes, it is being done by a regular online gang—itw—it is not yet another proof of concept. The same gang infects Windows machines as well, just that now they also target macs.

http://sunbeltblog.blogspot.com/2007/10/screenshot-of-new-mac-trojan.html http://sunbeltblog.blogspot.com/2007/10/mackanapes-can-now-can-feel-pain-of.html

This means one thing: Apple’s day has finally come and Apple users are going to get hit hard. All those unpatched vulnerabilities from years past are going to bite them in the behind.

I can sum it up in one sentence: OS X is the new Windows 98. Investing in security ONLY as a last resort losses money, but everyone has to learn it for themselves.

It definitely does not mean that one thing. Here are some quick points:

What unpatched vulnerabilities is he referring to?
This didn’t exploit any vulnerabilities. This same exact trojan exists for Windows. It could also be written for just about any OS.
To this day, I am not entirely convinced that it makes sense to invest in security before it costs you.
OSX is NOT the new Windows 98. It is a pretty unfair comparison. We may be critical of some of Apple’s security efforts, but at least we try to be objective.

One thing I would say is that Mac OS X users may not be as battle hardened as Windows users are when it comes to malware. If there is an increase in this style of Dupe-The-User attack, I wonder what the success rates would be.

If you read this blog, you are not the average Mac user.

Viewing 16 Comments

tim 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

What is it with Windows 98 anyways? Somebody compared the iPhone to it a few weeks ago. Why not 2000? Or Redhat 9? Two OSs that were more full of holes when released than 98.

reply edit reblog flag

Alex 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Well, he's a little better than SC Magazine's Dan Kaplan who originally wrote the following today:

"I just IM’d my buddy Ryan, who has a Mac, to determine whether he runs AV on his machine. His response: “I don’t think so.”

Mac users are so arrogant and clueless about security, they don’t even know if they have AV installed in the first place. I love it.”

So I suppose that makes us clueless about security, huh?

reply edit reblog flag

http://www.riskanalys.is

jjarmoc 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Thanks for bringing some sanity to the discussion of this trojan. From the way this is playing out elsewhere, you'd think we had a full blown self-replicating virus which required no user intervention.

The most secure systems in the world can't defend against user ignorance...

reply edit reblog flag

dragonfrog 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

One thing I find interesting is that the blogs are just writing about the behaviour of the preinstall and postinstall scripts. They don't mention anywhere that I've seen, what the plugin itself actually does put a plugin bundle in /Library/Internet Plugins/. But no one describes what this plugin does.

In general, this thing is the most well-behaved malware installer I've seen - nice clean well-indented perl scripts with explanatory variable names and all. So I can't imagine they'd have obfuscated the function of their plugin either.

reply edit reblog flag

Just out of curiosity... 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Whats your opinion about this ?

http://www.blackfriarsinc.com/blog/2007/11/mac-...

reply edit reblog flag

Thomas Ptacek 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

It's complete nonsense.

There is very little about the "Unix architecture" that makes Unix safer than Win32.

The distinction people are actually talking about is not "Unix vs. Win32". It's "single user environment" versus "server environment".

From a security perspective:

OS X has more in common with Windows XP SP 2 than it does with Solaris 10.

Windows Server 2007 has more in common with Solaris 10 than it does with Windows XP SP 2.

reply edit reblog flag

http://www.matasano.com/log

sigsegv 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Once again, Gadi Evron has shown himself to be quite the "expert" (read: Fat guy with a CISSP cert who gets beer cans thrown at him at DEFCON). While I am by no means a fan of Mac OS X, Gadi's claims are simply insane. While malware that requires user interaction can produce a decent yield (think Storm Worm), I don't see this one getting a +10,000 userbase anytime soon. It really all comes down to what type of people watch pr0n, and what percentage of those will be surfing on a Mac running OS X, as opposed to their parents' Windows XP Home Edition box. Don't quote me on that though, I don't run a pr0n site and can't conduct an analysis of useragents used by visitors, nor do I have the type of statistical data avalible to me that AV vendors and the HoneyNet research alliance do ("Hey, looks like the .br and .ro kiddies are ./sshbrute'ing again...).

Perhaps I'm missing something here, but Gadi's comment seems to be the work of a half-brained moron, rather than a BugTraq $uper$tar. Oh well... what can you do...

Oh, and for the record, I'm not saying that there will not be a yield for this trojan; I'm just saying we're not talking OpenSSH remote root 0day here. Or xnu remote root 0day. Whatever.

reply edit reblog flag

Lori 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

"What unpatched vulnerabilities is he referring to?"

The users who find it ok to run questionable files on their machines. We forgot to create a patch for them. Would this be like a nicotine patch?

reply edit reblog flag

JP 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

You said something unbelievably stupid:

"To this day, I am not entirely convinced that it makes sense to invest in security before it costs you."

So you are saying you should wait until after blaster hits before investing in security?

sheesh

reply edit reblog flag

Thomas Ptacek 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

By your logic, JP, we should all invest in Linux antivirus.

reply edit reblog flag

http://www.matasano.com/log

JP 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

AV is pretty useless. I would say invest in making your browsers and mail clients secure, invest in hardening your OS, invest in training your end users, invest in blah, blah, yadda, yadda, etc, etc,....

Waiting until its "worth it" to invest in security means you have to be compromised many times over before you will get a good ROI. Of course a single compromise can lead to a string of misdeeds that can cost a company hundreds of millions. This was TJX's plan, and look where it got us.

-JP

reply edit reblog flag

Thomas Ptacek 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Security and cost are two sides of the same coin. You have finite resources. There are more countermeasures available to you than you can afford.

What should you invest in? OS X antivirus? No? Then what point are you making?

reply edit reblog flag

http://www.matasano.com/log

JP 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

well, I dont think the OP was talking AV, but since you asked..

why not "invest" in teh free clamXav?

reply edit reblog flag

zazou 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Gadi Evron being a fame whore again? BREAKING NEWS!

reply edit reblog flag

Thomas Ptacek 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

It's not free. It takes effort to deploy and maintain it.

reply edit reblog flag

http://www.matasano.com/log

Hal B 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

This story was recently picked up by the Onion.

http://www.theonion.com/content/amvo/new_trojan...

reply edit reblog flag

The Silly New Mac OS X Trojan or HoHum.A

Add New Comment

Viewing 16 Comments

Add New Comment

Trackbacks

People We Read

Things We Write

RSS Feed

Archives