Feeds

Researchers dissect world's first Mac botnet

When zombie Macs attack

Website security in corporate America

Fresh research has shed new light on the world's first Mac OS X botnet, which causes infected machines to mount denial of service attacks.

Symantec researchers Mario Ballano Barcena and Alfredo Pesoli said the infections are the same ones described in this blog post from January.

In it, the blogger - a self-described designer and developer from Australia - said he awoke one morning to discover 100 per cent of his Mac laptop's resources were being consumed by a bunch of unfamiliar resources. After digging further, he found a foreign PHP script with root privileges was flooding an undisclosed website with data packets.

The botnet employs a peer-to-peer engine, encryption and a structure that allows it to dynamically adapt.

"The code indicates that, wherever possible, the author tried to use the most flexible and extendible approach when creating it - and therefore we would not be surprised to see a new, modified variant in the near future," the researchers write, according to ZDNet's Zero Day blog.

The botnet comes courtesy of two trojans dubbed OSX.Trojan.iServices.A and OSX.Trojan.iServices.B by Mac anti-virus provider Intego, which first documented them in January. The malware is surreptitiously included in copies of Apple's iWork 09 productivity suite and Adobe's Photoshop CS4 that are distributed on warez sites. Intego said three months ago more than 20,000 people had downloaded the rogue installers.

The Symantec research comes amid reports of a series of unpatched, actively-exploited holes in OS X and word that a researcher has figured out how to run shellcode on Apple's iPhone.

They are the latest reminder that Apple's growing market share - estimated to have reached about seven per cent in the fourth quarter of last year - hasn't been lost on malware authors. OS X users who have felt cavalier about installing unfamiliar titles on their machines have always done so at their peril, but that's especially true going forward.

According to the CBC, the Symantec researches add: "With malware authors showing an increasing interest in the Mac platform, we believe that more advanced [user interface] spoofing tricks may be seen in the future." ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.