ScoobyDoo555

"Renepo worm targets OS X platform" - a rather nasty virus. Don't think it's out in circulation yet, but beware.....

Full story HERE

Dan

angrynorth

I read about this yesterday on ars, it's not a virus as it is not self replicating until the point where a user runs root and enables the code.

More of a proof of concept as many people don't run root and those that do would be unlikely to install the code.

More like OSX's first example of Malware. Then again, just like the other security "exploits" found in the past there are no "wild" examples....yet.

As a Mac user I think I will be wary of it, but not to the point where I am going to lose any sleep over it.

angrynorth

Oh, just top add, I would also question the slant that computer shopper/pcpro will put on this.
There are no OSX viri (yet) so he can't have seen any this year, or last year etc. Nothing like the ill-informed being quoted as experts.

ScoobyDoo555

LOL

Sorry, "Virus" came out, instead of something along the lines of "worm"

I didn't think there were any OSX nasties, but I always err on the side of caution.

Also, I gotta feel a little bit amused at the die-hard PC users - they've been waiting a long time for something potential, like this.

Dan

angrynorth

That's the point I would like to clarify for some, this has the potential to become an OSX virus.

Some will choose to selectively read it as a solid/wild real virus and then next year they will be asked about OSX and they will say "We only see a handful of Mac viruses a year" like the berk who is quoted in the story.

stevem2k

isn't there an OSX rootkit out yet ?

JackClark

I think that's what's being discussed. Not in the labs today so can't check easily.

RoadrunnerV2

Errr ..... what’s the point of writing a virus for OSX when it would only has an audience of 80 If OSX was widely spread as Windows then you would see new virus coming out everyday.

angrynorth

No you wouldn't. OSX is more secure, from the ground up than most windows configurations. Not to mention the fact that as soon as there is a story like this there is uproar in the Mac community and it is not tolerated.

A good example of this is :http://daringfireball.net/2004/06/broken_windows

CTR

Markus

Ahh the good ol' Opener thing.

have been reading about this.

Essentially if you put this thing on your machine, bad things can happen. However, the key point here is that someone has to install this, there isn't, as yet, a deployment device for this item, sure, easy enough to make one with packagemaker or an applescript.

You'd still need the local administrators password though, ok, so that might be your password if it's a home machine, but in an education or corporate environment, you're not going to give that out to just anyone.

The only way it could suceed as a 'virus/worm' is if the deployment application was 'spoofing' some util or app, which is essentially what usually happens in the PC world anyway.

Personally, I'm not so worried about this thing.


As for the "point of writing and OS X virus", well, hackers like to do things like that, plus, this actual expliot is somewhat *nix based, so in theory, some of it could work on other *nix varients so it's a *nix virus/worm as well, sort of (been one of those days, so I could be wrong)

Apart from the "autostart worm" I don't think I've seen a 'proper' virus/worm for the macintosh in over 10 years, and the majority of my clients (from schools with ≤ 10 macs, all the way up to school boars with ≥ 30000 macs) haven't seen any either. I, and they, wish they could say the same for their PC setups.
I've heard that some places now have engineers whose sole job is to go round clearing up virus infestations! so the tech team can actually do what they are supposed to do!