A Mac OS X worm being tested

I just saw this article, A Worm for Your Apple which describes a worm being developed for Intel-based Macs and that will make it on the PowerPC chip-based Macs after it is tested.

A small controversy is brewing over claims that an independent researcher going by the moniker Information Security Sellout (or InfoSec Sellout) has developed the framework of a worm that targets a currently undisclosed vulnerability affecting the Intel versions of OS X. The worm is expected to extend to PPC versions as soon as the author is able to test against that architecture. With the author dubbing it 'Rape.osx', the evolution of the worm is likely to be keenly watched by Apple watchers, security researchers, and malware developers. ...

Click to expand...

I'm a bit skeptical about the claim. It just seems too vague. It attacks an undisclosed vulnerability, that sounds a bit more like a rumor than a threat. I PRAY that it isn't true. The fact that it isn't coming from Mac-Rumors makes it a little more believable though.

Very interesting, no less. Sounds like a bit of extortion to me.

Yeah the article says that the cracker is waiting to get some money from an undisclosed source before he lets Apple know about it. Jeez! Ain't some people grand or what!

I wish beskerming.com would have waited until the claim was more elaborated. I mean, I could say that there's an "undisclosed" virus, that will exploit an "undisclosed vulnerability" in Mac OSX, that will be able to find "certain" aspects of the user's personal information, and will present a "possible" threat to both Intel and PPC Macs. It's so vague that the claim can't be proven or disproven.

The thing i find interesting, is that if it works on OS X, then it should work on any flavor of Unix.

The other thing is what company would have 1500 OS X systems, other than a school?

Presumably this pillar of human society will compile a Universal Binary, then...? Perhaps we should have a whip-round and get him a hobby.

rman said:

The thing i find interesting, is that if it works on OS X, then it should work on any flavor of Unix.

The other thing is what company would have 1500 OS X systems, other than a school?

Click to expand...

Yes that's another thing I found odd, that the programmer was testing it on 1500 Macs. Looks like the author wanted to give some details to show he/she knows who this terrific individual is but not enough to let on who the cracker is.

To be destructive a virus/worm needs to gain access to the computer preferably without the user's knowledge, then cause some sort of effect, become active on startup so rebooting doesn't eliminate it and then be able to spread and multiply to other machines, again preferably without the user's knowledge. And it must also be difficult for the OS manufacturer to patch against, or take a long period of time for them to plug the hole.

If someone can create an OS X worm, it needs to fulfill as much of this criteria as possible. Of course, it is a lot easier to spread propaganda about what you may or may not have produced than actually have created a worm.

I'm not in the slightest bit worried.

Sounds as lame as the Airport exploit earlier this year. The only way to get the worm is to deliberately install the worm.

One thing I find interesting is that this exploit is supposed to be able to get root access, but, the question here is whether it can do this only after asking for permission (and relying on the user blindly saying OK) or if it can get root access without asking for validation.

I feel that Apple, in addition to patching this specific problem, needs to go through the OS X code to make sure that a privilege escalation (whether it is standard user-to-administrator or non-root-to-root) can never occur without asking the user for permission. This way, stuff like this worm would be shut down for those users who are savvy enough to look at what they are being asked to approve; unfortunately, those who enter their password without understanding what is being requested will always be vulnerable to something. Only better education will help the latter group.

Alexis said:

To be destructive a virus/worm needs to gain access to the computer preferably without the user's knowledge, then cause some sort of effect, become active on startup so rebooting doesn't eliminate it and then be able to spread and multiply to other machines, again preferably without the user's knowledge. And it must also be difficult for the OS manufacturer to patch against, or take a long period of time for them to plug the hole.

If someone can create an OS X worm, it needs to fulfill as much of this criteria as possible. Of course, it is a lot easier to spread propaganda about what you may or may not have produced than actually have created a worm.

I'm not in the slightest bit worried.

Click to expand...

I agree, even if one of those prerequisites happens, I doubt all of them can in one go. I'll play my BS card.

Yeah right before dinner, I was going to post that stupendous turn of events and then my ISP went kaput for the rest of the night.

Looks like he/she couldn't take the pressure of being unpopular. What a bloody moron...

Hah. Looks like playing my BS card was right. Some script kiddie looking for attention. Wake me when something important happens.

knightlie said:

Hah. Looks like playing my BS card was right. Some script kiddie looking for attention. Wake me when something important happens.

Click to expand...

Ok, the end of the world is tomorrow at noon!!!

Did that wake you? hahahaha.

If that is a real worm that gonna suck because the reason why i switched from windows is ,as u all guessed , thats right SECURITY.

even if someone makes a worm, that's one to one billion, thereby making mac's still much more secure. it's only due time until someone succeeds in making a mac virus.

rman said:

The thing i find interesting, is that if it works on OS X, then it should work on any flavor of Unix.

The other thing is what company would have 1500 OS X systems, other than a school?

Click to expand...

I don't know about that. I thought the vulnerability was supposedly found within mDNSresponder which is part of Bonjour. Does Apple have a Bonjour service for other UNIX variants?

Either way, I think these claims are total bunk. So, any anonymous person claims to have discovered an exploit and designed a worm in a "lab" environment. He or she won't detail the nature of the exploit, nor will they disclose their identity (and if it's just to prove that the hole exists and not to write or release malicious code, what do they have to worry about?). Then, when called on the carpet, they rip their page down and go silent. Does anyone else find this fishy?

Yes. I don't believe it for a second.