Feeds

Researchers dissect world's first Mac botnet

When zombie Macs attack

Internet Security Threat Report 2014

Fresh research has shed new light on the world's first Mac OS X botnet, which causes infected machines to mount denial of service attacks.

Symantec researchers Mario Ballano Barcena and Alfredo Pesoli said the infections are the same ones described in this blog post from January.

In it, the blogger - a self-described designer and developer from Australia - said he awoke one morning to discover 100 per cent of his Mac laptop's resources were being consumed by a bunch of unfamiliar resources. After digging further, he found a foreign PHP script with root privileges was flooding an undisclosed website with data packets.

The botnet employs a peer-to-peer engine, encryption and a structure that allows it to dynamically adapt.

"The code indicates that, wherever possible, the author tried to use the most flexible and extendible approach when creating it - and therefore we would not be surprised to see a new, modified variant in the near future," the researchers write, according to ZDNet's Zero Day blog.

The botnet comes courtesy of two trojans dubbed OSX.Trojan.iServices.A and OSX.Trojan.iServices.B by Mac anti-virus provider Intego, which first documented them in January. The malware is surreptitiously included in copies of Apple's iWork 09 productivity suite and Adobe's Photoshop CS4 that are distributed on warez sites. Intego said three months ago more than 20,000 people had downloaded the rogue installers.

The Symantec research comes amid reports of a series of unpatched, actively-exploited holes in OS X and word that a researcher has figured out how to run shellcode on Apple's iPhone.

They are the latest reminder that Apple's growing market share - estimated to have reached about seven per cent in the fourth quarter of last year - hasn't been lost on malware authors. OS X users who have felt cavalier about installing unfamiliar titles on their machines have always done so at their peril, but that's especially true going forward.

According to the CBC, the Symantec researches add: "With malware authors showing an increasing interest in the Mac platform, we believe that more advanced [user interface] spoofing tricks may be seen in the future." ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.