Mac worm sparks security concerns

Antivirus experts have warned Mac users and sysadmins against becoming complacent about security after the discovery of a worm targeting the Mac OS X operating system.

The Mac platform is not immune from security threats, affected as it is by numerous vulnerabilities (many derived from its Unix components) and several thousand macro viruses. However, worms have been all but unknown on the Mac since the late 1980s, security experts said.

The appearance of the Opener, or Renepo, worm may signal that worm writers are getting interested in the platform again, possibly because it is now easy to write malicious code that runs on the Mac as well as other Unix variants, experts said. "Hopefully, (Renepo's) existence will be a timely warning to any Mac users who still assume they are safe because the bad guys aren't interested in the Mac platform," said Paul Ducklin, Asia Pacific Head of Technology for anti-virus firm Sophos.

The worm, called SH/Renepo-A by Sophos, MacOS.Renepo.B by Symantec and Unix/Opener.Worm by McAfee, was discovered on Friday and anti-virus vendors rolled out protection over the weekend. It arrives in the form of a Bash shell script and replicates itself over local networks. However, its ability to spread is limited, as it does not use email or file-sharing programs to distribute copies of itself, researchers said. The worm also requires a high level of access to infect a PC, making it more likely to be executed on a system that has already been compromised in some other way, Sophos said.

Given these limitations, the worm is still particularly destructive, and because it turns off logging, anti-virus and security software, it is difficult to tell whether an affected system has been hit by additional problems, researchers said. The worm collects sensitive data such as passwords, and then reports infected systems to a remote server.

Among other actions, the worm turns on filesharing and ssh, installs a password cracker and a password sniffer, harvests Windows password hashes from samba, and creates a new admin-level account for future use by attackers.

"The computer's state is compromised to the extent that anyone with knowledge of the script could login and access the log files containing serial numbers and passwords," said Symantec in an advisory.

Apple Computer has recently come under attack for downplaying the seriousness of Mac OS X security holes in order to maintain the impression that Mac users are safer than users of other platforms. In May, for example, security experts criticized the company for going out of its way to describe a serious vulnerability as "theoretical". More recently Apple fixed a batch of 15 flaws in OS X, followed by a fix for a bug in iChat that could have allowed attackers to run malicious code on a system.

2014 ARN Women in ICT Awards - Nominations close October 27!: Nominations have opened for WIICTA 2014 and will stay open until October 27. But don't be late, be among the first in and NOMINATE NOW!!!

More about AppleApple ComputerMcAfee AustraliaSnifferSophosSymantec

ARN Directory | Distributors relevant to this article

ARN Directory | Vendors relevant to this article

Comments

Comments are now closed

 
Computerworld
CIO
Techworld
CMO

Latest News

02:05PM
20th Century Fox deploys HP Moonshot servers
01:27PM
Adobe begins encrypting user data collected from Digital Editions app
12:17PM
St George turns on fingerprint login for Apple iOS Internet banking
12:01PM
DDoS attacks skyrocket: Akamai State of Internet Report
More News
29 Oct
NewLease & Microsoft Technical Sessions
30 Oct
Ovum 2020 Telecoms Summit
30 Oct
NewLease & Microsoft Technical Sessions
05 Nov
vForum 2014
View all events