New Trojan Horse targets Mac users (MAC USERS READ THIS) - GoFuckYourself.com

sumphatpimp · 11-01-2007, 08:36 AM

http://news.yahoo.com/s/macworld/tro...MxTY_6PrkDW7oF

Security research company Intego on Monday issued a security alert about a new Trojan Horse called OSX.RSPlug.A that specifically targets Mac users. The Trojan is a form of DNSChanger that changes the Mac?s Domain Name Server (DNS) address.

According to Intego, the Trojan has been found on several pornographic Web sites. When trying to view a movie, the user is told that ?Quicktime Player is unable to play movie file. Please click here to download new version of codec.?

When the user clicks the link a disk image (.dmg) is downloaded to the desktop. When the user installs the software, they are actually installing the Trojan, not a free video codec. The Trojan is installed with full root privileges, which means it has access to all files and commands on the system.

When the malicious DNS server is active, it hijacks some web requests, leading users to phishing web sites (for sites such as Ebay, PayPal and some banks) or to web pages displaying ads for other pornographic web sites, according to Intego.

The Trojan also installs a root crontab which checks every minute to ensure that its DNS server is still active, the company said. Since changing a network location could change the DNS server, this cron job ensures that, in such a case, the malicious DNS server remains the active server.

Intego says that using Mac OS X 10.4, there is no way to see the changed DNS server in the operating system?s interface. Under Mac OS X 10.5, this can be seen in the Advanced Network preferences; the added DNS servers are dimmed, and cannot be removed manually.

Intego has updated its virus definitions to remove the malicious code and prevent it from being installed.

sumphatpimp · 11-01-2007, 08:39 AM

this thing sounds nasty, be careful what you install.
when they control your DNS they freaking own you.
and in time your bank account and paypal to name a few.

RawAlex · 11-01-2007, 08:45 AM

Not possible. Mac's don't get viruses or attacks, because they are perfect and a gift from the God of Jobs.

<<-- Sarcasm mode: 100 -->>

CheneyRumsfeld · 11-01-2007, 09:02 AM

this hacker must be desperate to target Mac's

headless ghost · 11-01-2007, 09:22 AM

next is Linux!
say it isn't so!

RawAlex · 11-01-2007, 10:37 AM

oh noes!!

11-01-2007, 08:36 AM	#1
sumphatpimp Confirmed User Join Date: Aug 2002 Posts: 5,235	New Trojan Horse targets Mac users (MAC USERS READ THIS) http://news.yahoo.com/s/macworld/tro...MxTY_6PrkDW7oF Security research company Intego on Monday issued a security alert about a new Trojan Horse called OSX.RSPlug.A that specifically targets Mac users. The Trojan is a form of DNSChanger that changes the Mac?s Domain Name Server (DNS) address. According to Intego, the Trojan has been found on several pornographic Web sites. When trying to view a movie, the user is told that ?Quicktime Player is unable to play movie file. Please click here to download new version of codec.? When the user clicks the link a disk image (.dmg) is downloaded to the desktop. When the user installs the software, they are actually installing the Trojan, not a free video codec. The Trojan is installed with full root privileges, which means it has access to all files and commands on the system. When the malicious DNS server is active, it hijacks some web requests, leading users to phishing web sites (for sites such as Ebay, PayPal and some banks) or to web pages displaying ads for other pornographic web sites, according to Intego. The Trojan also installs a root crontab which checks every minute to ensure that its DNS server is still active, the company said. Since changing a network location could change the DNS server, this cron job ensures that, in such a case, the malicious DNS server remains the active server. Intego says that using Mac OS X 10.4, there is no way to see the changed DNS server in the operating system?s interface. Under Mac OS X 10.5, this can be seen in the Advanced Network preferences; the added DNS servers are dimmed, and cannot be removed manually. Intego has updated its virus definitions to remove the malicious code and prevent it from being installed.

11-01-2007, 08:39 AM	#2
sumphatpimp Confirmed User Join Date: Aug 2002 Posts: 5,235	this thing sounds nasty, be careful what you install. when they control your DNS they freaking own you. and in time your bank account and paypal to name a few.

11-01-2007, 08:45 AM	#3
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Not possible. Mac's don't get viruses or attacks, because they are perfect and a gift from the God of Jobs. <<-- Sarcasm mode: 100 -->>

11-01-2007, 09:02 AM	#4
CheneyRumsfeld Confirmed User Join Date: Sep 2004 Posts: 1,341	this hacker must be desperate to target Mac's

11-01-2007, 09:22 AM	#5
headless ghost Confirmed User Join Date: May 2005 Posts: 893	next is Linux! say it isn't so!

11-01-2007, 10:37 AM	#6
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	oh noes!!