Free Republic
Browse · Search
General/Chat
Topics · Post Article

Others are recognizing this as more FUD from Symantec...

Macarena: once again no more than a demo virus for Mac OS X

Heise Security UK

Symantec has been predicting for quite a while now that virus authors would increasingly dedicate their attention to the Mac platform and that Macs were becoming a tempting target for hackers. However, a newly discovered Mac OSX virus is hardly the firewall breach that the antivirus software makers have been prophesising.

The malware, dubbed "Macarena" in tribute either to the summer music hit of 1996 or to the game Quake Arena, has a certain proof-of-concept character to it, Symantec reports. What exactly that means is not cogently explained in Symantec's virus description. The virus nevertheless infects other data in the folder in which it is started, regardless of extension. It appears not to possess an internal processing routine of its own. It may require the aid of the user to spread it by sending it out by mail or passing it via removable storage media.

The distribution of the 528 Byte bug is low; while Symantec does not provide an estimate, somewhere between zero and 49 infections are believed to have been reported. It is also unclear where it came from. Symantec suffered from a slight lapse when it recommended in the first version of the virus description that users clean the system by deactivating the system restoration (Windows ME/XP). This passage was removed in an updated version.

Back in the middle of the year, McAfee diagnosed a strong rise in vulnerabilities in Mac OS X. While it is true that none of the bugs for Mac OS X had managed to achieve wide dissemination, this has typically reflected programming errors by the virus authors and the still-minor market share of the OS. Exploit code for the Mac is easy to find on the internet, the security vendor claims, which makes it likely that Mac OS X will soon be faced with the same plagues as Windows: botnets, spyware, spam and DDoS attacks. For their part, Mac partisans note that they are still waiting for the first hard proof.

Please see also:

OSX.Macarena, virus report from Symantec.

Symantec provides no evidence how this can spread. They do not describe how it runs; does it require the user to execute it or does it run by itself - which is highly unlikely. If it comes attached to an OS X executable then it is merely another Trojan Horse.

"According to Symantec, OSX.Macarena, isn't designed to infect PowerPC Mach-O binaries, nor Universal binaries"

Apparently ALL non-Intel PowerPC Macs and Universal apps (those that run on both Intel and PowerPC Mac) are imune from OSX.Maracena - leaving only those few non-universal Intel apps vulnerable.

Finally, Symantec's rating of "Very Low" and Number of infections as "0-49" and web site as "0-1" would indicate to me that NO ONE has been infected and someone sent in some proof-of-concept code, that if installed in a directory on a Mac, could append itself to the files in that directory. There is no evidence at all that this was discovered in the "wild".

It is interesting that Symantec's advisory on how to avoid this malware is boilerplate for PCs...

Ergo, this is FUD.

1 posted on 11/03/2006 6:07:43 PM PST by Swordmaker
[ Post Reply | Private Reply | View Replies ]


To: 1234; 6SJ7; Action-America; af_vet_rr; afnamvet; Alexander Rubin; anonymous_user; ...
'Macarena' Virus Targets Macs...

I think it's another proof of concept not in the wild.

If you want on or off the Mac Ping List, Freepmail me.

2 posted on 11/03/2006 6:09:48 PM PST by Swordmaker (Remember, the proper pronunciation of IE is "AAAAIIIIIEEEEEEE!)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: Swordmaker
...if installed in a directory on a Mac, could append itself to the files in that directory.

...by affirmative act of the user and not automatically or surreptitiously, right?

What a load of bull seed!

4 posted on 11/03/2006 6:24:57 PM PST by Petronski (CNN is an insidiously treasonous, enemy propaganda organ.)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: Swordmaker
Wooooooo! I am posting this from my brand new Mac Book Pro 17 inch! It is as of this posting, virus free.
7 posted on 11/03/2006 8:02:33 PM PST by coon2000
[ Post Reply | Private Reply | To 1 | View Replies ]

To: Swordmaker

Pardon me, but I would like to target your mac for a virus. Please give me your admin password and let me sit with your computer for about a half hour.

(Fools. They'll never know what hit them!)


8 posted on 11/03/2006 8:15:03 PM PST by SlowBoat407 (A living insult to islam since 1959)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: Swordmaker

I have a questions about firewalls/virus protection: I recently bought a new MacBook and am wondering if I need protection beyond what is installed on the machine?? I'm also running a 2000 iBook with Linksys; what additions do I need here? (I'm a computer pre-schooler, so simple terms are needed!)


10 posted on 11/04/2006 5:21:06 AM PST by sarasota
[ Post Reply | Private Reply | To 1 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson