OS X flaw may leave Macs open to virus attacks

TalkBack 30 of 76:

Next »

« Previous

• Thread View
• Flat View

Sales attempt by anti-virus company

This is a really lame attempt by an anti-virus company to sell
their software.

From http://www.boingboing.net

The Mac OS X mp3 trojan is being blown completely out of
proportion. Quick review of facts so far:

1. It was pointed out in a Usenet thread that it is possible to
embed arbitrary data in an mp3 2. It was subsequently
suggested that the arbitrary data could be executable 3. An
enterprising developer proceeded to then create a file which to
any mp3 player will appear as an mp3 file, but the Mac OS X
Finder sees it as an application 4. An anti-virus vendor
published advertising for their product saying that it has a cure
for this form of Trojan.

Some other relevant points:

1. This has little to do with Mac OS X vs. Mac OS 9. The exact
same file will do the exact same thing on Mac OS 9 -- be
playable by mp3 players, and act as an application 2. This has
little to do with Mac OS X using extensions to identify file types.
The icon shown by the Finder could be embedded in the file
itself, in which case the file would look like an mp3 file
regardless of its name. 3. This trick requires using the resource
fork, and therefore the file has to be transmitted encoded. Any
mp3 file that is transferred as a plain binary file (as opposed to a
Mac binary file, with the resource fork), is harmless. 4. The fact
that the file can be played in am mp3 player is irrelevant; if the
trojan were malicious, the user would be doomed after double-
clicking on it regardless of whether the file is a valid audio file.

To summarize, a Mac application can have any icon or name
whatsoever, including a name and an icon that make it look like
a <ocument. Exactly what happens when you receive such an
application (in email or by downloading it in your browser)
depends on your settings, but I am not aware of any case in
which it will be automatically launched.

Therefore, to activate this Trojan you have to either receive a
Mac-encoded attachment and double-click on it in the Finder, or
you have to download a Mac-encoded a file (which is then
usually decoded to your desktop) and double-click it in the
Finder.

The only reason that this is news is that a vendor of anti-virus
software took it as an opportunity to generate some advertising,
as far as I can tell.

Posted by: tic swayback   Posted on: 04/09/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Busting the myths about QuickBooks Enterprise Solutions and IBM Smart Business IBM So you already know there aren't actually any alligators in the New York ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now