When I first read about this I was thinking "Oh, great - people are going to claim that there is now a virus for OS X", when it is quite obviously a trojan. You guys rock.

Go to www.macsurfer.com and see all the misleading headlines. It's a joke. iChat has easy to configure user preferences so you can block incoming file transfers and actually only be contacted by people you know. This can prevent the spread of this TROJAN (which in itself actually requires the user to do something to enable the threat into the computer in the first place!).

Is it a threat, probably. Is it a horrendous threat? Not really considering the average mac user has an IQ over 80 and understands that security begins with the user, not the software.

So the user double clicks the "jpg image" and the OS then prompts them to grant the application permission to alter the OS?

Quote

Biff wrote:
So the user double clicks the "jpg image" and the OS then prompts them to grant the application permission to alter the OS?

No, it only changes apps, not the OS. So if you're logged in as an admin, it doesn't ask for permission.

I'd say we need to show Sophos we're not willing to put up with this kind of mis-catoragization crap.

This is their press contact page and Graham is listed first:
http://www.sophos.com/pressoffice/contacts/index.html

Be nice, but be obviously angered by their lack of the use of a dictionary. Don't want to go there? Email Graham here: gcluley@sophos.com

Ugh. Am I gonna have to add Sophos to my "cry wolf"/dubious credibility list? Proof-of-concept Trojan horses have been around for quite some time on OS X. And double-click social engineering is one of the oldest and easiest tricks in the book. But hey, whatever causes the most hysteria and spurs new sales of Sophos' product. (Which, amusingly, I couldn't/wouldn't buy anyway even if I wanted to, since they only seem to sell the software in "small business" client packs. Note to Sophos: If you're gonna do an Intego, at least offer single-client software so you can take full advantage of people.)

Many people seem to think this is a non-issue simply because it requires user intervention to execute. Well, I hate to break this to you, but there are Mac users out there that are clueless and will enter the password.

I have heard for years that “an educated user is your best defense.” Well you know what? It doesn’t work. People still open attachments from strangers no matter what you tell them and there will be some idiot that won’t think twice about typing their password when this thing prompts them.

Yes, this is a primitive trojan that I am sure will have minimal impact… but it does seem to indicate that our Macs are starting to attract attention and I don’t think this will be the last attempt… do no be complacent.

Quote

Guest wrote:

I have heard for years that “an educated user is your best defense.” Well you know what? It doesn’t work. People still open attachments from strangers no matter what you tell them and there will be some idiot that won’t think twice about typing their password when this thing prompts them.

I'm not so sure that this should be classified as a trojan horse. There have been a number of Windows Viruses that reqiured user intervention to launch, but have then replicated themselves to other computers. Two particularly well publicised examples come to mind. VBS.LoveLetter was a visual basic script that came out in May 2000 and W97M.Melissa.A was a word macro that came out in April 1999. Both Viruses spread via e-mail and in both cases you had to open the attachment in order to launch the Virus. Both of these famous social engineering viruses masquaraded as desireable documents. The only difference I see between these worms and Oompa is that Oompa requires a two step process of the user of decompressing the file then opening it. Granted that extra step makes it much less likely that a user will be fooled, but I don't think that changes the classification. I think there is definately a precident for this kind of thing being called a worm.

"I have heard for years that “an educated user is your best defense.” Well you know what? It doesn’t work. People still open attachments from strangers no matter what you tell them and there will be some idiot that won’t think twice about typing their password when this thing prompts them.

Then by definition they are NOT educated."

So then when you kid touches the hot stove after you told him to, you did not educate him?

There’s just no good malware for MacOS X.

All virus apps, including the best one for mac (ClamXAV) have been updated to deal with this overhyped trojan. It's all good.

70,000

to

1


Windows loses.

I am ChildOL from Spymac...

I am very disappointed that Apple allowed this, given the easy fix...but this is what they can do to completely fix this problem...

Show the user (regardles of the icon) that the file is an executable, a glow would be very good... Require admin password if an application/process/script is trying to modify ANY FILE OR FOLDER on the system that is not allready known to be modifiable by it. (maybe a database where every user that is created is added and ANY known processes/programs/scripts... Any NEW processes/programs/scripts(ANYTHING executable) should be able to modify the given files/folders AFTER you give it the authority to do so via admin password and then it is added to the database and it can THEN modify THOSE files etc.)

Should be simple for Apple to do and should have been done LONG ago.

we have had some wierd Mail behavior recently. I
had 15,737 unread messages appear in my INBOX yesterday..... mostly
stuff that I had read and/or trashed over the past several months.
Apparently had nothing to do with our ISP since we don't store messages
on their servers. I suppose there could be a connection to the malware
(it was Thursday as the message indicated) that you refer to but the
link says it is basically Tiger enabled and we have not gone to Tiger
yet... still on Panther.
Tom aka elkmtnman

All the more reason why I never log in under an admin account unless I am intentionally and knowingly doing system maintenance work. 99% of what I do doesn't require admin access. I assume if I were to get infected by this virus, at a minimum it would not be able to infect any applications without the system asking for an admin password (dead giveaway that something fishy is going on). But could it still use iChat to propagate itself? Could it even get installed in the first place? Doesn't the OS now ask everytime an application is run for the first time?

"70,000

to

1"

More like 70,000 to 0. Launching Leap-A requires just barely less effort than a person purposely murdering their own install of OS X.

I think the only surprise here is the fact that somebody actually bothered to make such a sad piece of malware.

They'd be better off trying to sell me a CRT monitor coozie than Anti-Vir software for this old mac. ;-P