Skip to Content

Security alert: New Trojan Horse apps said to attack the Mac

by Steven Sande Oct 27th 2010 at 1:30PM

Some security mavens have long theorized that as the Mac becomes more popular, we'd start to see malware that would start targeting the platform. Sure enough, this morning's crop of email blasts from PR firms included a few notices of trojans that are affecting Mac users.

First, from SecureMac, comes word of trojan.osx.boonana.a, which comes disguised as a link on social networking sites asking "Is this you in this video?" Clicking the link downloads and runs a Java applet that then installs further applications to modify system files and open the system to password-free access. The other malicious apps report back to command and control servers, as well as hijack user accounts to spread the trojan through email spam.

The SecureMac press release notes that the "Java component of the trojan horse is cross-platform," but it's not clear from their statement that the other components are capable of running under Mac OS X.

Next, Intego reported that a similar Java trojan known as Koobface.A is also being spread through social networking systems such as Facebook and Twitter.

Intego reports that these trojans will give you fair warning, as the standard Mac OS X Java security alert (see below) will be displayed. If you're not expecting a Java applet to be running on your machine, click the Deny button and the applet will not run. If you want more information about what's happening, click the Show Details button, and you'll see that content with an untrusted root certificate wants to run on your computer. Clicking Deny will protect your machine from a possible malware infection. Allowing the Java applet to run will launch an installer that will be displayed on your machine. If you haven't launched an installer deliberately, then quit it immediately.

While it's unknown just how widespread or dangerous these trojans are to Mac OS X machines, we recommend that our readers pay attention to what's happening on their Macs and to use common sense when using social networking sites.

Keep in mind that it's not only malicious apps that you need to be wary of, but also malicious users sitting near you in the coffee shop. See our rundown on ways to protect yourself from Firesheep and cookie harvesting.



View Tags

Related Stories

Categories

Security Mac OS X

Some security mavens have long theorized that as the Mac becomes more popular, we'd start to see malware that would start targeting the...
 

Add a Comment

Sign in »
*0 / 3000 Character Maximum Comment Moderation Enabled. Your comment will appear after it is cleared by an editor.

23 Comments

Filter by:
the JoshMeister

Sorry, I didn't notice this TUAW article until today. Too bad I didn't catch this earlier or I could have been more helpful.

First, the major thing that needs to be corrected is in the headline: "Trojan Horse apps" plural is incorrect. SecureMac and Intego were writing about the same Trojan, but they called it different names. This is extremely common in the antivirus/anti-malware industry. Most companies have their own naming conventions. Only a handful will use someone else's name.

Second, one commenter posted instructions for disabling Java in Chrome. I wrote instructions on how to disable Java in Safari, Firefox, Chrome, Opera, and Camino here:

http://security.thejoshmeister.com/2010/10/koobface-malware-for-mac-and-how-to.html

To answer Warren's question, the Java applet is cross-platform, and it tries to download a number of files from a number of servers. Each file is targeted specifically at either Mac OS X, Windows, or Linux. You can see lists of some of the files in Intego's follow-up article and on Symantec's site:

http://blog.intego.com/2010/10/29/more-information-about-the-koobface-trojan-horse-for-mac/
http://www.symantec.com/business/security_response/writeup.jsp?docid=2010-102616-4246-99&tabid=2

October 30 2010 at 1:30 PM Report abuse rate up rate down Reply
warreno

If these crapplets are cross-platform, how are they explicitly aimed at OSX? Or did I read too much into the title of this article?

October 27 2010 at 4:43 PM Report abuse rate up rate down Reply
ijohnjones

Mac or PC users... it doesn't matter. I work IT and I see that people click on these links without thinking every day. I need a giant poster that says, "STOP. THINK. Then CLICK."

*sigh*

October 27 2010 at 4:17 PM Report abuse rate up rate down Reply
Ken

Hmmm... and Apple recently deprecated Java for OSX? Seems to be a touch of the foresight from One Infinite Loop!

October 27 2010 at 3:17 PM Report abuse rate up rate down Reply
1 reply to Ken's comment
Steve

Or maybe the reason we haven't had many reports this month of Steve replying to emails is because he's been too busy writing Java malware :-)

October 27 2010 at 4:19 PM Report abuse rate up rate down Reply
Kelly Guimont

For those who haven't done this already, if you want to disable Java in Chrome:

Click the wrench, then Under The Hood, then the Content Settings button. When that comes up, click on Plug-ins and then Disable Individual Plug-ins. You can choose to turn off Java (or any other basic plug-ins) there.

October 27 2010 at 2:51 PM Report abuse rate up rate down Reply
kirk

Wow. I just had this try to get me on Facebook this morning. I clicked on the link and was presented to a "facebook login" page, but I noticed it was NOT on the facebook domain. Only I when looked at the root of that domain was I warned about the applet. In both cases I knew to NOT give permission nor my password to something nefarious like that (but then, I pay attention to more than the page content).

October 27 2010 at 2:39 PM Report abuse rate up rate down Reply
pacokorn77

If you still fall for the "Is this you in this video?", you deserve to have your computer infected.

October 27 2010 at 2:08 PM Report abuse rate up rate down Reply
f055

As the above commenters said, it's not much of a Trojan if it asks for permissions explicitly. Plus, why not just disable Java in Safari or whatever browser you use? It doesn't do anything on the web nowadays anyway...

October 27 2010 at 2:04 PM Report abuse rate up rate down Reply
jmg_NX21

Facebook - are these apps? One people's pages?

October 27 2010 at 2:02 PM Report abuse rate up rate down Reply
rikemomo@gmail.com

hi guys-

Symantec has a writeup here:
http://www.symantec.com/business/security_response/writeup.jsp?docid=2010-102616-4246-99

October 27 2010 at 2:01 PM Report abuse rate up rate down Reply
1 reply to rikemomo@gmail.com's comment
chris

No mention of Mac OS X?

October 27 2010 at 7:48 PM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.