5 ms·
Evidence suggests first zombie Mac botnet is active
- donaq 18y agoIt was bound to happen, I suppose. I wonder if it will happen to Linux too, although I think it would be hard for malware writers to target Linux using conventional methods if users stick to using only open source software.
- windsurfer 18y agoMost of the users I know only get their software through their distros package manager. I think it would be quite tough to get malware in there, especially since most distros accept only free software.
- vorador 18y agoWell, not necessarily. I mean, a repo could be hacked. Fortunately, apt uses signed packets.
- mahmud 18y agogoogle "debian openssl fiasco"
- windsurfer 18y agoWell that's not really fair. That was a software bug. It wasn't malware, and it had nothing to do with software installation.
- vizard 18y agoFedora servers were indeed hacked if I remember correctly and malicious packets were uploaded but it was detected before they reached the users. Repo security is certainly very important. But well, ultimately you have to trust someone?
- vorador 18y agoThe canonical example is http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html But I guess that there are two ways to feel really secure : either use openbsd, or just don't use the internet.
- tvon 18y agoThe alleged botnet in the article here did not come through Apple or Adobe servers, it came through thepiratebay.org, demonoid, usenet, etc.. In other words, the safety of the official channels of distribution is largely irrelevant. The only thing preventing this from happening in Linux is a lack of interest by trojan writers (they could already do it with vmware workstation which is surely available on pirate sites and requires root privileges to install) and perhaps a lack of proprietary 3rd party software (which I'm sure a lot of people will say is a good thing, but that's another discussion).
- electromagnetic 18y agoI wouldn't rule it out happening. However, I think the bigger risk (not necessarily more likely to happen, but the gain would be much bigger) would be someone getting a piece of malware built into the actual distro.
- keopi 18y agoOn linux, you also have the trouble of many different distributions and a very small user base. The time it would take to develop it wouldn't be worth the small user base it would attract. Any Linux malware would be targeting a tiny fraction of a fraction of a market.
- Harkins 18y agoIt already happened on Linux. I know I saw one in 2001, but I wouldn't be surprised to hear they go back years earlier. They don't look much like Windows/OS X botnets; instead of this trojan horse stuff they'd just crack insecure services or guess poor passwords and escalate privileges automatically. If you have any Ubuntu servers, tail /var/log/auth.log (similar names on other distros) you'll see trying to ssh in.
- allenbrunson 18y agoif true, this is a definite rite of passage for our beloved platform. maybe mac users will have to install antivirus software soon?
- chaosmachine 18y agoAntivirus software doesn't seem to help PCs much.
- tom_rath 18y agoThat's like saying a seatbelt doesn't help crash victims much. The trick for both is using it.
- old-gregg 18y agoAntivirus software is usually more harmful than most viruses.
- tom_rath 18y agoIf that's the case, "You're doing it wrong".
- windsurfer 18y agohttp://www.thepcspy.com/read/what_really_slows_windows_down/5 http://www.thepcspy.com/read/what_really_slows_windows_down/... Aparently not.
- martey 18y agoThe author of that page did not come to the conclusion "do not use antivirus software because it will make your computer slow" but rather ask consumers to make an educated decision about which software to purchase based on their detection rate. Malware will also slow down your computer, and could result in your personal information being stolen. If the choice were between waiting an extra few seconds for my computer to boot or having all of my files accessible to people I neither know nor trust, I would choose the former.
- ashleyw 18y agoConsidering users were actively trying to install software which they thought was trusted (so would have entered passwords when prompted), I don't find this surprising — is there even much you can do to prevent this kind of thing, apart from taking control away from the user?
- derefr 18y agoCompartmentalization of power: require the application to ask separately for each thing it wants to be able to do (e.g. Install a driver, bind a port, save to a write-protected folder), and then "profile" the set of powers it has requested to determine what kind of app it is when explaining to the user whether he should enter his password. A screensaver shouldn't ask to rewrite the page table, and the OS can know that and help the user avoid it.
- alexitosrv 18y agoThat sounds awfully similar to Windows UAC. "There's a much, much bigger hole than any programmer could possibly exploit: The annoyance factor." Source: http://it.slashdot.org/comments.pl?sid=222252&cid=18003076 http://it.slashdot.org/comments.pl?sid=222252&cid=180030...
- derefr 18y agoNo, no: you don't ask the user separately for each thing the program wants to do; the program asks for several tokens from the keychain, and then the keychain asks for a single password entry, telling the user all the things the program wants to do with it.
- uuilly 18y agoMy mom, dad, sister and brother have all separately asked me what the keychain was. I would get many more calls if it was more complicated.
- 18y ago
- CalmQuiet 18y agoIf you are into "installing the pirated versions of iWork or Photoshop CS4" (whether on Mac or PC) ...you may already be a zombie. Just don't even go there.
- Create 18y agoas someone put it: after a dmg comes an OMG ;)
- FiveFiftyOne 18y agoIt was bound to happen eventually. The most troubling thing is that its distributed in pirated software. Don't pirate, run your tests against checksums and keys when you download legitimate software. Of course, this won't cross the mind of many users. An interesting feature would be to combine a checksum with your downloads, which the Mac installer could then verify off of your download page. Invalid checksum = big warning and flashing lights.
- arvidj 18y agoIf a malicious hacker can intercept and manipulate a download, why can't he manipulate the checksum? Just asking :)
- FiveFiftyOne 18y agoIt would take a lot of work. I imagine that you'd implement a link to your sites checksums in the code, which the installer would reference during installation. As long as that link is protected within code, it should maintain the validity of any checksums that the installer is referencing.
- tvon 18y agoThere is no interception and manipulation of a download going on, at least regarding the botnet the article suggests, it came from knowingly downloading and installing pirated software. The checksum idea is to get the checksum from the official source and to apply it to the pirated download, but then the pirated download is surely modified anyway, so this wouldn't work.
- ftse 18y agoLittleSnitch is an app that will inform you when an outgoing conenction is being made from your Mac. Running this after launching a craked version of PS, for instance, should let you know if you've suddenly been recruited into a botnet.
- JeremyChase 18y agoThe first thing a well written trojan does is to disable things like this.
- ZeroGravitas 18y agoI don't want to sound paranoid but security researchers working for anti-virus vendors have a vested interest in blowing these things out of proportion. I don't know the details of this particular story but I have seen blatant scaremongering and misinformation in the past when it comes to Macs.
- josefresco 18y ago"I have seen blatant scaremongering and misinformation in the past when it comes to Macs" Not just Macs, anti-virus and security professionals are experts in all computer FUD (regardless of platform)
- tvon 18y agoTrue, but Macs I think get some special attention because they already have the Windows world pretty knotted up. Mac users are still largely unconverted.
- rs 18y agoRule of thumb: don't trust pirated software! If you need to get some application, buy it, or use a Free version