full-disclosure - Re: mac trojan in-the-wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <097B1E4792366344925A4B6B99C00A8218488990DB@zaphod.home.jalojash.org>
Date: Thu, 1 Nov 2007 17:52:10 -0700
From: Jim Harrison <Jim@...tools.org>
To: "Thor (Hammer of God)" <thor@...merofgod.com>, Gadi Evron
	<ge@...uxbox.org>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>, 
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: mac trojan in-the-wild

Heh-heh; he said "Steve Gibson"; heh-heh-heh

Seriously; Tim is right.
While Apple-oriented threats may not get either the validation or the publicity (on hardly equals the other) that Windows attacks do, it's hardly accurate (much less fair) to make those comparisons.
For all those comparative points, my Kaypro-4 running ZCPR is more secure than any Apple OS.

Jim

-----Original Message-----
From: Thor (Hammer of God) [mailto:thor@...merofgod.com]
Sent: Thursday, November 01, 2007 5:15 PM
To: Gadi Evron; bugtraq@...urityfocus.com; full-disclosure@...ts.grok.org.uk
Subject: RE: mac trojan in-the-wild

> For whoever didn't hear, there is a Macintosh trojan in-the-wild being
> dropped, infecting mac users.
> Yes, it is being done by a regular online gang--itw--it is not yet
> another
> proof of concept. The same gang infects Windows machines as well, just
> that now they also target macs.
>
> http://sunbeltblog.blogspot.com/2007/10/screenshot-of-new-mac-
> trojan.html
> http://sunbeltblog.blogspot.com/2007/10/mackanapes-can-now-can-feel-
> pain-of.html
>
> This means one thing: Apple's day has finally come and Apple users are
> going to get hit hard. All those unpatched vulnerabilities from years
> past
> are going to bite them in the behind.

Let's not over-hype this-- while "Apple's day" has been coming, saying
that users
will be "hit hard" on something the user has to manually download,
manually execute,
and explicitly grant administrative privileges to is *way* over the top.

> I can sum it up in one sentence: OS X is the new Windows 98. Investing
> in
> security ONLY as a last resort losses money, but everyone has to learn
> it
> for themselves.

Not "the new Windows 98" by a long shot - saying that is just
irresponsible.  While Apple is not used to dealing with security in the
same way that other companies are, comparing OSX to Windows 98 is not
only a huge technical inaccuracy, but you also insult MAC users out
there.  OSX had "UAC-like unprivileged user controls" way before Vista
did - let's not try to start some holy-war on this like people have
tried to do with Windows vs Linux in the past.

If you want to report this, then report it-- but say what it is, a
totally lame user-must-be-drunk "exploit" that requires that all manner
of things go wrong before it works -- otherwise people will think that
you've dressed up as Steve Gibson for Halloween.

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/