The Mac Observer

Skip navigational links

You're viewing an article in TMO's historic archive vault. Here, we've preserved the comments and how the site looked along with the article. Use this link to view the article on our current site:
Intego Issues OS X Trojan Horse Alert For Mac OS X

TMO Reports - Intego Issues OS X Trojan Horse Alert For Mac OS X

by , 6:15 PM EDT, April 8th, 2004

Macintosh security specialists Intego issued a security warning Thursday for the first Trojan horse to affect Mac OS X. The company said the Trojan horse could exploit a weakness in the operating system by attaching itself to tags of primarily MP3 files. Early reports are no such campaign to spread viruses through the Trojan Horse have been reported.

Called the MP3Concept (MP3Virus.Gen), the Trojan horse can appear as other types of files, according to company spokesperson Brian Davis, who spoke to The Mac Observer on Thursday.

"Our virus team found an apparent weakness with the way OS X handles some MP3 files whereby a file can be labeled an MP3 file, but not actually be one," Davis said.

"What has been discovered in this weakness is that files that are encapsulated in the ID3 tags of an MP3 file will open when you double-click the file. So there's a potential there for somebody to include some sort of malicious code embedded in this part of the MP3 file that can run and obviously exploit operations on a Mac in a lot of different ways."

How it works

Davis warned the Trojan horse has the potential to delete all of a user's personal files, send an e-mail message containing a copy of itself to others and infect other MP3, JPEG, GIF or QuickTime files. "This same technique could be used to infect .jpg or .gif files as well," Davis said.

Intego has released updated virus definitions for VirusBarrier to combat the Trojan horse. The company recommended that users make sure that their virus definitions are up to date by using VirusBarrier's NetUpdate preference pane.

A spokesman for Symantec Corp., who makes Norton AntiVirus for Macintosh, told The Mac Observer Thursday the company is aware of the Trojan horse issue, but had no additional detail on when or what it plans to do to combat the Trojan horse.

Davis said the way in which someone could cause trouble could be by including of script or application in the file that would be used to infect other files. "Or it could be used to erase files," he said. "Our virus team in France reports a potential Trojan horse can access files in the OS X libraries core services."

No reported uses, so far

Davis said that as far as Intego knows, no one has received MP3 files using the Trojan Horse technique. "So far what we've discovered is basically this weakness is benign, but we see an opportunity for exploitation here, so that's why we have released this Trojan horse protection update," Davis commented.

While news of this Trojan horse is disturbing, Davis added that finding the "hole" is better done now, rather than later.

"This is actually a good thing because it looks like we've caught this one early," Davis said, adding programmers at Intego were made aware of the Trojan horse on Monday in e-mails from customers. "The good thing is that this has been caught early before it can wreck major problems."

The bad guys are looking

But Davis said what it also shows is that there are people in the world that are trying to find ways to exploit OS X. "As the user base increases, I don't think anybody thought this would happen sooner or later," Davis said.

Davis said Intego virus experts are now actively searching for additional problems related to the Trojan horse issue, such as what other possible 'doors' could be available in Mac OS X. Davis did not know the level of communications going on between Intego developers and programmers at Apple Computer with regard to the Trojan horse issue.

Representatives from Apple Computer were not immediately available for comment. TMO will be offering an analysis of this development in a separate commentary.

Recent Headlines - Updated November 26th

Wed,9:36 PM
Apple Reportedly Building Chinese Sapphire Plant with Foxconn
8:40 PM
ACM 282: The Steampunk, Sapphire, and Apple Watch Episode
7:46 PM
Melissa Holt on MacJury’s Holiday Gift Guide 2
4:42 PM
Steampunk USB Flash Drives with Motorized Gears - Really!
4:05 PM
Black Friday 2014: The Best Mac Deals
3:10 PM
iOS 8: Control Which Apps Can Access Your Private Data
2:50 PM
The Name Your Own Price Must-Have Mac Bundle
1:36 PM
TMO Daily Observations: 2014-11-26
10:46 AM
5 iPhone Apps to Cut Your Thanksgivings Stress
8:50 AM
iOS 8 and OS X Yosemite: Naming Group Conversations in Messages
Tue,9:01 PM
BuzzFeed Uses Apple Watches to Incentivise Staff
8:14 PM
The SKEYE Nano Drone Quadcopter: $34.99
  • __________
  • Buy Stuff, Support TMO!
  • Podcast: Mac Geek Gab
  • Podcast: Apple Weekly Report
  • TMO on Twitter!