Menu
Mac worm sparks security concerns

Mac worm sparks security concerns

Antivirus experts have warned Mac users and sysadmins against becoming complacent about security after the discovery of a worm targeting the Mac OS X operating system.

The Mac platform is not immune from security threats, affected as it is by numerous vulnerabilities (many derived from its Unix components) and several thousand macro viruses. However, worms have been all but unknown on the Mac since the late 1980s, security experts said.

The appearance of the Opener, or Renepo, worm may signal that worm writers are getting interested in the platform again, possibly because it is now easy to write malicious code that runs on the Mac as well as other Unix variants, experts said. "Hopefully, (Renepo's) existence will be a timely warning to any Mac users who still assume they are safe because the bad guys aren't interested in the Mac platform," said Paul Ducklin, Asia Pacific Head of Technology for anti-virus firm Sophos.

The worm, called SH/Renepo-A by Sophos, MacOS.Renepo.B by Symantec and Unix/Opener.Worm by McAfee, was discovered on Friday and anti-virus vendors rolled out protection over the weekend. It arrives in the form of a Bash shell script and replicates itself over local networks. However, its ability to spread is limited, as it does not use email or file-sharing programs to distribute copies of itself, researchers said. The worm also requires a high level of access to infect a PC, making it more likely to be executed on a system that has already been compromised in some other way, Sophos said.

Given these limitations, the worm is still particularly destructive, and because it turns off logging, anti-virus and security software, it is difficult to tell whether an affected system has been hit by additional problems, researchers said. The worm collects sensitive data such as passwords, and then reports infected systems to a remote server.

Among other actions, the worm turns on filesharing and ssh, installs a password cracker and a password sniffer, harvests Windows password hashes from samba, and creates a new admin-level account for future use by attackers.

"The computer's state is compromised to the extent that anyone with knowledge of the script could login and access the log files containing serial numbers and passwords," said Symantec in an advisory.

Apple Computer has recently come under attack for downplaying the seriousness of Mac OS X security holes in order to maintain the impression that Mac users are safer than users of other platforms. In May, for example, security experts criticized the company for going out of its way to describe a serious vulnerability as "theoretical". More recently Apple fixed a batch of 15 flaws in OS X, followed by a fix for a bug in iChat that could have allowed attackers to run malicious code on a system.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Upcoming

Slideshows

IN PICTURES: Windows 10 Sydney launch

IN PICTURES: Windows 10 Sydney launch

Tech lovers and party-goers alike headed down to Mrs Macquarie's Chair to be part of the world-first Windows 10 Launch Party. The night featured a presentation by Microsoft Australia managing director, Pip Marlow, DJs, live demonstrations and digital artistry by Lister.

IN PICTURES: Windows 10 Sydney launch
In Pictures: User guide to Windows 10

In Pictures: User guide to Windows 10

If you’re going for an immediate upgrade to Windows 10 from your Windows 7 or Windows 8/8.1 computer, this guide will get you up to speed as quickly as possible.

In Pictures: User guide to Windows 10

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments