« China's Great Firewall Is Doomed | Main | Open Season on Macs? »
November 1, 2007
Porn-Loving Mac Users in Trojan's Crosshairs
OSX.RSPlug.A Trojan Horse Changes Local DNS Settings to Redirect to Malicious DNS Servers:
"A malicious Trojan Horse has been found on several pornography web sites, claiming to install a video codec necessary to view free pornographic videos on Macs. A great deal of spam has been posted to many Mac forums, in an attempt to lead users to these sites. When the users arrive on one of the web sites, they see still photos from reputed porn videos, and if they click on the stills, thinking they can view the videos, they arrive on a web page that says the following:
Quicktime Player is unable to play movie file. Please click here to download new version of codec."After the page loads, a disk image (.dmg) file automatically downloads to the user's Mac. If the user has checked Open "Safe" Files After Downloading in Safari's General preferences (or similar settings in other browsers), the disk image will mount, and the installer package it contains will launch Installer. If not, and the user wishes to install this codec, they double-click the disk image to mount it, then double-click the package file, named install.pkg.
"If the user then proceeds with installation, the Trojan horse installs; installation requires an administrator's password, which grants the Trojan horse full root privileges. No video codec is installed, and if the user returns to the web site, they will simply come to the same page and receive a new download."
An entertaining final note from Intego:
"The best way to protect against this exploit is to run Intego VirusBarrier X4 with its virus definitions dated October 31,2007. Intego VirusBarrier X4 eradicates the malicious code and prevents the Trojan horse from being installed. Intego recommends that users never download and install software from untrusted sources or questionable web sites."
I think we can edit that for clarity:
"The best way to protect against this exploit is to ... never download and install software from untrusted sources or questionable web sites."
There. Much better.
Posted by mhall at 7:51 PM | Add Comment
Leave a comment