3 ms·
Posts like this annoy me. It only gives details about the symptoms of the virus and gives zero details of the infection vector. What does this virus exploit? Ho
by timtadh 16y ago
Posts like this annoy me. It only gives details about the symptoms of the virus and gives zero details of the infection vector. What does this virus exploit? How does it take control of the computer? Is it a root kit? Does it have a C&C server associated with it allowing it to become a botnet?
It is especially frustrating because although I am not a Mac user I like to keep up to date on threats against the Mac platform since exploits on the Mac are easier to port to other *nixs. Does anyone have actual details on this trojan?
- ggordan 16y agoI couldn't agree more. I'm guessing they assume the reader is familiar with the Windows trojan.[1] I posted because I still thought HN would find it interesting. [1] http://www.darkcomet-rat.com/ http://www.darkcomet-rat.com/
- awakeasleep 16y agoDid the article give you the distinct impression this is only a GUI to ssh meant to amuse kids? Everything mentioned in the article can be accomplished with ssh and the osascript command. The only interesting part of this software would be the rootkit used to hide it from an admin.
- hackermom 16y agoWhat rootkit? This is OS X, not Windows. You can't hide processes here the same way, or even to the same extent, you can under ntoskrnl.
- X-Istence 16y agoSure you can. If you have root access to Mac OS X and can thus load stuff into the kernel you can easily disguise applications that are running by modifying the process tables, or replacing the ps binary by one that does filtering. Look at some of the BSD rootkits for inspiration on how to accomplish a task like that.
- lloeki 16y agoApparently, it's not a virus, it's a trojan. Vector is human: article says "Trojans like this are frequently distributed through pirated software". Same player shoot again.
- phamilton 16y agoMy impression is that it's an application you have to agree to install. Which means the only thing noteworthy here is that it mimics a Windows trojan. There is no security exploit which allows it to be installed with the user unaware. Nothing special here it seems...