Mac worm sparks security concerns

Antivirus experts have warned Mac users and sysadmins against becoming complacent about security after the discovery of a worm targeting the Mac OS X operating system.

The Mac platform is not immune from security threats, affected as it is by numerous vulnerabilities (many derived from its Unix components) and several thousand macro viruses. However, worms have been all but unknown on the Mac since the late 1980s, security experts said.

The appearance of the Opener, or Renepo, worm may signal that worm writers are getting interested in the platform again, possibly because it is now easy to write malicious code that runs on the Mac as well as other Unix variants, experts said. "Hopefully, (Renepo's) existence will be a timely warning to any Mac users who still assume they are safe because the bad guys aren't interested in the Mac platform," said Paul Ducklin, Asia Pacific Head of Technology for anti-virus firm Sophos.

The worm, called SH/Renepo-A by Sophos, MacOS.Renepo.B by Symantec and Unix/Opener.Worm by McAfee, was discovered on Friday and anti-virus vendors rolled out protection over the weekend. It arrives in the form of a Bash shell script and replicates itself over local networks. However, its ability to spread is limited, as it does not use email or file-sharing programs to distribute copies of itself, researchers said. The worm also requires a high level of access to infect a PC, making it more likely to be executed on a system that has already been compromised in some other way, Sophos said.

Given these limitations, the worm is still particularly destructive, and because it turns off logging, anti-virus and security software, it is difficult to tell whether an affected system has been hit by additional problems, researchers said. The worm collects sensitive data such as passwords, and then reports infected systems to a remote server.

Among other actions, the worm turns on filesharing and ssh, installs a password cracker and a password sniffer, harvests Windows password hashes from samba, and creates a new admin-level account for future use by attackers.

"The computer's state is compromised to the extent that anyone with knowledge of the script could login and access the log files containing serial numbers and passwords," said Symantec in an advisory.

Apple Computer has recently come under attack for downplaying the seriousness of Mac OS X security holes in order to maintain the impression that Mac users are safer than users of other platforms. In May, for example, security experts criticized the company for going out of its way to describe a serious vulnerability as "theoretical". More recently Apple fixed a batch of 15 flaws in OS X, followed by a fix for a bug in iChat that could have allowed attackers to run malicious code on a system.

2015 State of The IT Channel Survey : IT'S TIME!!! Fill in this year's State of the IT Channel Survey and be in the running to win great prizes. CLICK HERE

Join the ARN newsletter!

Error: Please check your email address.

More about AppleApple ComputerMcAfee AustraliaSnifferSophosSymantec

ARN Directory | Distributors relevant to this article

ARN Directory | Vendors relevant to this article

Show Comments
 

Latest News

04:58PM
AppSense takes the wraps off its new analytics platform
04:35PM
SugarCRM beefs up its global executive team with three new hires
Mar 27
'Do Not Call' spam phone call legislation passed
Mar 27
HubOne lands its first channel partnership in Australia
More News
30 Mar
Australian experts to address cybersecurity challenges and solutions at Canberra...
21 Apr
APJ Progress Spark Conference
22 Apr
2015 Innotribe Startup Challenge
27 Apr
Disruptocon
View all events