Watch out for PokerGame trojan

In the wake of the ARDAgent vulnerability discovered yesterday, we all have something new to look out for: OSX.Trojan.PokerStealer is the official name of a trojan horse masquerading as a poker game. The trojan is distributed in a 65K .zip archive.

According to security company Intego, running the trojan activates SSH, and transmits the username, password hash, and IP address of the computer to a server. It asks for an administrator's password after displaying a message about a corrupt preference file that needs to be repaired.

As always, please remember to use extreme caution when running applications downloaded from the Internet, or received via email.

Thanks to Rosaline from Intego for the heads-up.

View Tags

Source: http://www.intego.com/news/ism0803.asp

Categories

Security

In the wake of the ARDAgent vulnerability discovered yesterday, we all have something new to look out for: OSX.Trojan.PokerStealer is the...

Add a Comment

Sign in »

14 Comments

Filter by:

McHoffa

And wouldn't Little Snitch stop this from connecting to the server, rendering it completely useless?

June 22 2008 at 8:06 AM Report abuse Permalink rate up rate down Reply

apeguero

So is this a sign that Apple's market share in the PC world is gaining immensely where stuff like this pop up? Is it time to find an anti-virus software for the Mac (if one even exist)? Or is this a non-story?

June 21 2008 at 7:46 PM Report abuse Permalink rate up rate down Reply

Fairly

This is good for post-mortems. For software you don't trust.

http://rixstep.com/4/0/tracker/

As for finding the server this trojan sends to: it's probably embedded in the binary. If anybody has the package they can look and post the location of the server. A US ISP would probably shut them down right away.

June 20 2008 at 10:55 PM Report abuse Permalink rate up rate down Reply

Darrell

I've often wondered why people don't just find the server (or authors) and hack it, infecting it with other viruses or mess up the server itself. Is there anyone willing to take their disgust with people who create viruses/trojans and attack their server? After all, I doubt the feds would be to upset over someone taking down a site that is doing malicious things. Its just been a query with me. Or is my idea too much Hollywood?

June 20 2008 at 9:04 PM Report abuse Permalink rate up rate down Reply

1 reply to Darrell's comment

Dano

It's too 'vigil ante'. Old west law. Prairie justice. And maybe too bad too - I think there are a lot more good guys out here than bad guys. BUT, what about the innocents? Little servers that have been hacked and are being used by the bad guys, but are actually the server for some innocent business or even charity? If the good guys take 'em down, do they have the responsibility for settin' 'em back up? I think that's where the line is drawn...

June 21 2008 at 12:04 AM Report abuse Permalink rate up rate down Reply

Fritz Laurel

Nice of them to post the server it uses so we can all black list it.

June 20 2008 at 7:44 PM Report abuse Permalink rate up rate down Reply

RWhitney

I'll send an email to Steve so he can call up god and get this taken care of. : )

June 20 2008 at 5:56 PM Report abuse Permalink rate up rate down Reply

derek

Why don't they just find what server it is submitting the info to, then shut that ass down???

June 20 2008 at 4:19 PM Report abuse Permalink rate up rate down Reply

KeynoteKen

So, you still need to enter your password before it will do anything? Also, does it work in non-Admin accounts?