Finally... A Big Mac Attack

[zz0011]

From Reuters: "Virus attacking Apple Macintosh PCs found-experts"

Thu Feb 16, 2006 8:29 PM ET

SAN FRANCISCO (Reuters) - A malicious computer worm has been found that targets Apple Computer Inc.'s Mac OS X operating system, believed to be the first such virus aimed specifically at the Mac platform.

The worm is called OSX/Leap-A, according to a posting on the Web site of antivirus software company Sophos, which said the worm is spread via instant messaging programs.

The worm attempts to spread via Apple's iChat instant messaging program, which is compatible with America Online's popular AIM instant messaging program, according to the Sophos Web site.

The worm sends itself to available contacts on the infected users' buddy list in a file called "latestpics.tgz," according to the Sophos Web site.

The vast majority of malicious hacks are aimed at Microsoft Corp.'s Windows operating system and some of its products, largely because Microsoft has more than 90 percent of the market for computer operating systems.

"This first Macintosh OS X threat is an example of the continuing spread of malicious code on to other platforms," said Vincent Weafer, senior director at Symantec Security Response, in a statement.

The worm will not automatically infect Mac computers, but will ask users to accept the file, Weafer said.

Symantec ranked the new worm as a Level 1 threat (with 5 being the most severe).

An Apple spokesperson was not immediately available to comment.

[Glory's Sun]

I figured it would happen eventually.. but it's only a level 1 worm.

[Martian]

I'm wondering if there's enough similarity with BSD in order for there to be a cross-platform attack. I know that Apple borrowed a lot of the back end from BSD, but I don't know exactly how much.

If it is feasible, I'd expect to see a lot more of this. There are a lot of BSD web servers out there, which, when combined with the Mac market, makes it a very juicy target.

guccilvr: I don't know what the payload is or even if there is one, as I haven't checked SARC on this worm yet. However, even a minor threat is a lot more severe on Mac than it is on PC. Mac users have long relied on the 'security through obscurity' doctrine. Many of them don't have even rudimentary protection, since none of the malware targets them. I suspect that if this does start happening much more often, that's going to have to change.

EDIT - A check at SARC reveals two things. First, that the worm infects any available applications without the OOMPA attribute set, and second that a bug in the code means any file that's infected may become corrupted and unusable. While not an intended payload, that has the potential to be very damaging.

It also turns up OSX.Inqtana.A, a new virus found today. This one doesn't spread very well and therefore isn't as much of a threat, but it's intersting that two OSX viruses turn up in two days.