full-disclosure - Re: OS X malware family has a new member: OSX.Lamzev.A

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <32480899.2206741226745515442.JavaMail.juha-matti.laurio@netti.fi>
Date: Sat, 15 Nov 2008 12:38:34 +0200 (EET)
From: Juha-Matti Laurio <juha-matti.laurio@...ti.fi>
To: phisher_hunter@...oo.com, rholgstad <rholgstad@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: OS X malware family has a new member:
 OSX.Lamzev.A

This is and was the situation when writing the entry.
More information and information about the possibly previously unknown vulnerability related to the Trojan is not available.

Now Symantec analysis says that
-Trojan creates the file /tmp/com.apple.DockSettings
-inserts its contents into ~/Library/LaunchAgents, and
-deletes /tmp/com.apple.DockSettings.

Source:
http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-111315-1230-99&tabid=2

Juha-Matti

Mario D [phisher_hunter@...oo.com] kirjoitti: 
> They may be under pressure from Apple to not release details.  Remember the MacBook wireless drama?
> 
> --- On Fri, 11/14/08, rholgstad <rholgstad@...il.com> wrote:
> From: rholgstad <rholgstad@...il.com>
> Subject: Re: [Full-disclosure] OS X malware family has a new member: OSX.Lamzev.A
> To: "Juha-Matti Laurio" <juha-matti.laurio@...ti.fi>
> Cc: full-disclosure@...ts.grok.org.uk
> Date: Friday, November 14, 2008, 12:27 PM
> 
> Sweet more non-tech writeup from securiteam. I am beginning to wonder if 
> securiteam is really a technical company or just a bunch of clueless 
> journalists like Nate McFeters.
> 
> Juha-Matti Laurio wrote:
> > New Trojan horse for Mac OS X found, the Trojan is known as OSX.Lamzev.A
> by Symantec.
> >
> > A short history of Mac malware:
> > Mac.Hovdy.a (June '08),
> > OSX.Exploit.Launchd (June '06), and
> > Leap.A (February '06).
> >
> > More at
> > http://blogs.securiteam.com/?p=1160
> >
> > Juha-Matti

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/