|
#1
April 8th, 2004, 04:43 PM
| ||||
| ||||
| Os X Trojan INTEGO SECURITY ALERT Intego Announces Protection against the First Mac OS X Trojan Horse: MP3Concept Paris, France: 4:15pm, April 8, 2004 – Intego, the Macintosh security specialist, has just released updated virus definitions for Intego VirusBarrier to protect Mac users against the first Trojan horse that affects Mac OS X. This Trojan horse, MP3Concept (MP3Virus.Gen), exploits a weakness in Mac OS X where applications can appear to be other types of files. The Trojan horse's code is encapsulated in the ID3 tag of an MP3 (digital music) file. This code is in reality a hidden application that can run on any Macintosh computer running Mac OS X. Mac OS X displays the icon of the MP3 file, with an .mp3 extension, rather than showing the file as an application, leading users to believe that they can double-click the file to listen to it. But double clicking the file launches the hidden code, which can damage or delete files on computers running Mac OS X, then iTunes to play the music contained in the file, to make users think that it is really an MP3 file . While the first versions of this Trojan horse that Intego has isolated are benign, this technique opens the door to more serious risks. This Trojan horse has the potential to do any of the following: - Delete all of a user's personal files - Send an e-mail message containing a copy of itself to other users - Infect other MP3, JPEG, GIF or QuickTime files Due to the use of this technique, users can no longer safely double-click MP3 files in Mac OS X. This same technique could be used with JPEG and GIF files, though no such cases of infected graphic files have yet been seen. Intego VirusBarrier eradicates this Trojan horse, and Intego remains diligent to ensure that VirusBarrier will also eradicate any future viruses that may try to exploit this same technique. All Intego VirusBarrier users should make sure that their virus definitions are up to date by using the NetUpdate preference pane in the Mac OS X System Preferences. http://www.intego.com/news/pr40.html
__________________  |
|
#2
April 8th, 2004, 05:00 PM
| ||||
| ||||
| It was only a matter of time, sad to say.
__________________ OS X 10.4 G5 Dual 2GHZ / 160GB / 1GB RAM / Superdrive Apple 20" Cinema Display SmartDrive 120GB Firewire HD Maxtor 250GB SATA Visit my wife's eBay store !! http://stores.ebay.com/Catchy-Creations-by-brendaonline Now pining for a MacBook Pro... |
|
#3
April 8th, 2004, 05:04 PM
| ||||
| ||||
| I wonder if RIAA paid to develop that trojan. It would suit RIAA's needs .. making people scared of downloading [unpaid] music.
__________________ MacBook Pro + Mac mini | Newton 2000 | @Work : Dell D620 & 2x20" + a lot of Macs | Workstation, VC & Fusion Twenty years from now you will be more disappointed by the things that you didn't do than by the ones you did do. ~ Samuel Clemens | Rants | Photos |
|
#4
April 8th, 2004, 05:06 PM
| ||||
| ||||
| This is a real stupid troyan ! But if it works... It's like the .pif files of PCs.
__________________ My current machine is an iMac Core 2 Duo 2.16 GHz 24" with MacOS X 10.5. My Apples are here. My oldest Apple was born in 1977. GS/P/>SS d-(++) s+: a+ C+(C) U* P L+ E--- W++ N- o+ K? w O-- M++ V PS+ PE+ Y- PGP t+ 5 X+ R tv-- b+++ DI++ D+ G e+++ h---- r+++ y? Time is not changing, I'm just traveling through time. |
|
#5
April 8th, 2004, 05:07 PM
| ||||
| ||||
| Wow, google finds nothing with MP3Virus.Gen.
__________________ MacBook Pro + Mac mini | Newton 2000 | @Work : Dell D620 & 2x20" + a lot of Macs | Workstation, VC & Fusion Twenty years from now you will be more disappointed by the things that you didn't do than by the ones you did do. ~ Samuel Clemens | Rants | Photos |
|
#6
April 8th, 2004, 05:21 PM
| ||||
| ||||
| more: "First its an application that you must run by yourself. Second its a CFM application so it needs its resource fork, creater fork and file type to run. You'd have to download this thing encoded in a format such as a Stuffit archive and the double click it to run. Basically you'd need to be pretty stupid." http://groups.google.com/groups?hl=e...of.s%20e#link6 has some interesting stuff about the virus too. http://apple.slashdot.org/comments.p...ad&cid=8808749 - one guy downloaded the file (link of google..) and tried to open it. panther (10.3) does not allow to open it anyway. more on 
__________________ MacBook Pro + Mac mini | Newton 2000 | @Work : Dell D620 & 2x20" + a lot of Macs | Workstation, VC & Fusion Twenty years from now you will be more disappointed by the things that you didn't do than by the ones you did do. ~ Samuel Clemens | Rants | Photos Last edited by Giaguara; April 8th, 2004 at 05:41 PM. |
|
#7
April 8th, 2004, 06:29 PM
| ||||
| ||||
| Other files can also be infected... this comes from www.macbidouille.com, the French reference site on mac.
__________________ My current machine is an iMac Core 2 Duo 2.16 GHz 24" with MacOS X 10.5. My Apples are here. My oldest Apple was born in 1977. GS/P/>SS d-(++) s+: a+ C+(C) U* P L+ E--- W++ N- o+ K? w O-- M++ V PS+ PE+ Y- PGP t+ 5 X+ R tv-- b+++ DI++ D+ G e+++ h---- r+++ y? Time is not changing, I'm just traveling through time. |
|
#8
April 8th, 2004, 09:09 PM
| ||||
| ||||
| "...It was discovered today by antivirus software company Intego, which manufactures VirusBarrier, a security suite for the Mac.... Luckily, this trojan hasn't been released into the wild... Intego offers its VirusBarrier Mac-security software for $59.95..." Hmm... Now if this trojan hasn't actually been released, how did Intego "discover" it? What a scam. Last edited by andychrist; April 8th, 2004 at 11:14 PM. |
