Other Sites
But I'd recommend the former, just so you get a better idea of what we're actually talking about.
Someone identified only as a "Macintouch Reader," however, writes in with a concern and invokes the V-word:
MacInTouch Reader
There's now a real virus out there for Mac OS X that can do some real damage. It doesn't seem to be too destructive although it does delete some UNIX commands and modifies prefs for a couple of others. It will gather all password info on your machine. For now, lets call it "Opener."
My system was a responding a bit slowly and a check of my /var/log files showed that they were _all_ empty and had the same mod date. The Activity Monitor showed a process called "john" eating almost an entire processor.
Some further looking showed an unknown startupitem in /Library/StartupItems/ called "opener". The executable file is a well-commented bash program. It scans for passwords for every user, processes the hashed info using your own Mac, turns on file sharing, and puts all this stuff into an invisible folder called .info on each users Public folder.
It does much, much more but it's important that a warning get out quickly.
But you can get words out too quickly... especially if they're the wrong words. In fact, the next user, after doing a Google seach, finds out that it's actually a script that's installed on a machine where the malicious user has an administrator password.
Additionally, Peter Gawlocki brings us this info:
This was posted earlier this year [March 28] ... Macintosh Underground Forum Index -> Security & Hacking > Startup Script Take a look at the file... and what it does. Note the second comment line.
# You need an admin level user name and password or physical access (boot from a CD or firewire, ignore permissions on the internal drive) to install this
I recommend reading the Macintouch article which provides a lot of information on the script, what it does, and how to detect it, but it looks as though unless someone has physical access to the machine and an admin password, these scripts are unlikely to affect you.
Of course, expect people to shortly equate this script with the vulnerabilites in Internet Explorer, which will (ahem) just go to show you that Macs are as insecure as PCs.
Bill's been using Macs since the late 80s. When he's not making smartass remarks to amuse Kirk Hiner, he enjoys fighting for the user.
Tags: Blogs ď Apple ď(0) Trackbacks ď
So what software installer sureptitiously installs this malware?
That would be useful information. I immediately checked my system for the files. None found fortunately....