Security Bytes: First Mac OS X worm discovered

SearchSecurity.com ^ | 17 Feb 2006 | SearchSecurity.com Staff

[Anti-Bubba182]

First worm for Mac OS X discovered Security experts say Leap-A isn't a particularly threatening worm. But it's significant in one way: It's the first piece of malware to target Apple Computer Inc.'s Mac OS X operating system, which many users consider a more secure alternative to Microsoft Windows.

"Some owners of Mac computers have held the belief that Mac OS X is incapable of harboring computer viruses, but Leap-A will leave them shell-shocked, as it shows that the malware threat on Mac OS X is real," Graham Cluley, senior technology consultant for UK-based AV firm Sophos, said in a statement. "Mac users shouldn't think it's okay to lie back and not worry about viruses."

Leap-A, also known as Oompa-A, spreads through the iChat instant messaging system, Sophos said. It forwards itself as a file called latestpics.tgz to contacts on the infected users' buddy list.

"When the latestpics.tgz file is opened on a computer it disguises itself with a .jpg graphic icon in an attempt to fool people into thinking it is harmless," Sophos said in its online analysis. "The worm uses the text 'oompa' as an infection marker in the resource forks of infected programs to prevent it from re-infecting the same files."

While the appearance of a Mac OS X worm is unfortunate, Cupertino, Calif.-based AV firm Symantec Corp. gave reasons why this particular worm is fairly easy to neutralize.

"This first Macintosh OS X threat is an example of the continuing spread of malicious code onto other platform," Vincent Weafer, senior director of Symantec Security Response, said in a statement. "However, this worm will not automatically infect, but will ask users to accept the file, giving potential victims a heads up and the opportunity to avoid infection.........."

[Anti-Bubba182]

There had to be one sooner or later.

[GarySpFc]

Gottcha

[avg_freeper]

This is a "virus" in the same way as the following message is a virus:

Step 1: send 10 copies of this message to other computer users.
Step 2: smash your computer into tiny bits with a sledge hammer.

You have to uncompress the virus. Then you have to intentionally install the virus to your computer.

And even if you were stupid enough to do all that OS X wouldn't allow any changes to your system files as they're all protected by root.

The company that's hyping this all up just (coincidentally mind you) entered the mac instant message virus scanning market. A market that didn't exist until now.

[TexasGreg]

Sarcasem>This is definitely the end of Apple computer. Apple fan boys thought that OSX was secure and now we know it is full of holes. It will be a matter of weeks before OSX is overrun with viruses and all Apple users will have to switch to windows to get work done. With the second security problem this week (bluetooth hole) it is obvious that this is the tip of the iceberg and that the tidal wave of viruses, malware, and trojan horses are on their way.

Finally the computer world can unify behind Windows -- a secure, fast, and reliable operating system. This will be the end of overpriced computers that are only sold to rich people that have virtually no software to run.

Time to short Apple stock!</Sarcasem

[TexasGreg]

This is the dumbest "virus" I've ever heard of. If it requires the user to accept the incoming bluetooth transfer, and since bluetooth requires the devices to be within several feet of each other to make a connection, how practical is this? Not very. Even if it didn't require user intervention, it wouldn't spread very far, if at all. Everybody in the mainstream tech press has been frothing at the mouth now that they think they can finally say "MAC OS X HAS A VIRUS!! MAC USERS ARE JUST AS VULNERABLE AS WINDOWS USERS! FEAR!! PANIC!! DREAD!!!!!"