toggle

AAPL Stock: 562.29 ( -3.03 )

MacNN News

Windows-based worm masquerading as iTunes

updated 12:00 pm EDT, Wed July 20, 2005

Worm masquerades as iTunes

A recent Windows-based worm is . The downloaded file, named 'iTunes.exe' may trick users into thinking it is a legitimate application, according to security firm Trend Micro; however, the firm ranks the security threat as "low," although it has 'medium' damage and distribution potential. The "WORM_OPANKI.Y" worm spreads via AOL Instant Messenger (AIM) by sending a message to users that prompts a download of a so-called picture file. Once downloaded, the application appears as the iTunes download. Upon execution, the worm opens a connection to an IRC server, waits for remote commands, and executes those commands on the locally affected machine. It also downloads and executes other applications, mainly adware programs, into affected machines, according to the report.

by MacNN Staff

(18)

TAGS :

troubleshooting

Share the Article

Facebook Twitter Delious Slash Dot Digg

toggle

Comments

jimothy
Fresh-Faced Recruit

Joined: Sep 2000

0

07/20, 12:53pm | report spam | close Reply |
Stupidity required

You'd have to be pretty stupid to fall for this:

"Hey look! Somebody sent me a link to a picture! Let's click!" "Hmm. No picture, but cool, it's iTunes! And they've shrunk the file size dramatically! Let's double-click!" "Hmm. This doesn't look like iTunes. Whoa! An ad for Viagra! Let's click!"

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

07/20, 01:27pm | report spam | close Reply |
No

You don't have to be stupid, you just have to be a normal computer user, who doesn't think about things before doing them. For example, all those window viruses that were sent via email, then sent in a zip file in an email, then in a password protected zip file in an email. Even needing to go through all those hoops, people still opened them up and ran the files.

And if there was a Mac worm of this same thing, Mac users would do the same thing.

MacScientist
Junior Member

Joined: Feb 2000

0

07/20, 01:32pm | report spam | close Reply |
Is this news?

Since when did yet another Windows exploit get to be news? on a Mac-centric forum? This new exploit which targets Windows and is spread via AIM has absolutely nothing to do with the Mac, Apple, or its users. What's next, W32.MacOS_X.Trojan@mm?

MacScientist
Junior Member

Joined: Feb 2000

0

07/20, 01:34pm | report spam | close Reply |
Re: No

"And if there was a Mac worm of this same thing, Mac users would do the same thing."

You just don't get it. What you are describing is not possible on the Mac.

koolkid1976
Fresh-Faced Recruit

Joined: May 2003

0

07/20, 02:05pm | report spam | close Reply |
re:No

If your friend send you a link to a picture, which turns out to be an executable, are you gonna install it without even asking them what it is or why they are sending you iTunes?? If it's someone you don't even know, isn't it going to make you that much more suspicious? No, this isn't something a "normal computer user" would do. Get pop-up, click to download, then install.

MacHarbor
Fresh-Faced Recruit

Joined: Jan 2005

0

07/20, 02:20pm | report spam | close Reply |
executables on the mac

I tried turning a copy I made of iTunes into a .JPG file (by changing the .app extention to .jpg) to see if it would execute or if it would launch Preview.app, but instead Finder tacked on the .app extension after the .jpg one.

Most of the glaring flaws in the Windows OS don't even come close to revealing themselves on the MacOS. If mainstream virus writers were to go heavy into the Mac Virus area, we would see far far more creative viruses than the "trick em n get em" style of virus we see today.

The smarter the operating system is, the smarter the virus writers need to be.

BTW, a friend of mine has a dell and said it was running really slow. I installed Spyware Doctor and scanned it. 2651 infections were found on his system, and Spyware Doc crashed before it removed the last 200. The worst my mac ever gets now adays is incorrect file permissions. :D

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

07/20, 03:30pm | report spam | close Reply |
Re: No

You just don't get it. What you are describing is not possible on the Mac.

How is this NOT possible on the Mac? Put a link to a supposed picture file, but have it download iTunesInstaller.app. User runs iTunesInstaller.app (because he thinks he has a new installer for itunes for some reason - h***, if a PC user thinks the picture became an installer, why not a Mac user?), it installs malicious program on computer.

BTW, you're all also making the same mistake in understanding this whole thing. You assume that the user clicks the link to get the picture, then goes searching for it, sees the EXE, and runs that. That's not likely. However, imagine if you will, user clicks the link, EXE downloads seripditiously, user looks for file, can't find it, moves on with life. Later, while perusing his downloads directory, sees he has a new itunes installer, thinks he needs to install it (hey, he must've downloaded it, right, so its gots to be OK), and then gets infected. Or maybe you did download a new installer, and then saw this one before the one you just downloaded, and ran this instead.

JohnnyFive
Fresh-Faced Recruit

Joined: Feb 2003

0

07/20, 03:34pm | report spam | close Reply |
Just d/l from Apple

If you're that paranoid just go to apple.com and download the link to get iTunes. If that's not good enough then borrow a friend's iPod CD. There. Problem solved.

koolkid1976
Fresh-Faced Recruit

Joined: May 2003

0

07/20, 03:47pm | report spam | close Reply |
Re: Re: No

You sure put a lot of stock into possible but unlikely scenarios.

MacHarbor
Fresh-Faced Recruit

Joined: Jan 2005

0

07/20, 03:47pm | report spam | close Reply |
Normal Computer Users?

"You don't have to be stupid, you just have to be a normal computer user, who doesn't think about things before doing them."

So you are assuming that a user that stupid and inexperienced about computers bought a Mac rather than a far more cheaper system, more main-stream system like a Dell?

As I said in an earlier post, my friend had 2651 infections on his Dell according to Spyware Doctor, and these were not specifically done by him. He doesn't download files at random, click on banner ads because they are there, or even use Intneret Explorer or Outlook for that matter (Firefox and Thunderbird all the way baby). I layed down the internet law to him about what to do and what not to do, but still his computer got royally raped.

With a mac he would have NONE of these problems because they just don't happen on the mac. Sure, a malicous file COULD be made that COULD mask itself as iTunes that COULD be installed by someone. Thats a lotta COULDS. But in order to really get hit by a virus or spyware on a Mac, you have to be below the bar stupid and careless about computing and internet access. Unlike the Windows world, where all you have to do is accidently click the wrong link on a webpage and you get some weird file floating on your system.

The big problem in the windows world is that now apps are being made that say they remove spyware but are in fact spyware. This doesn't happen on the mac because we don't have spyware, or at least not enough to warrent making a big deal of it. If one comes along, everyone makes a stink about it on VersionTracker, MacUpdate or one of the other big trusted download sites, and it is delt with.

Look at the Dashboard loophole that people found when Tiger came out. EVERYONE was talking about it on Apple's discussion forums, MacNN forums, MacOSXHints, etc... So what did Apple do? In 10.4.1 and 10.4.2 they added alot more protection, like a widget preview, and alot more confirmation buttons).

klinux
Senior User

Joined: Jul 2002

0

07/20, 04:06pm | report spam | close Reply |
BS

"As I said in an earlier post, my friend had 2651 infections on his Dell according to Spyware Doctor, and these were not specifically done by him. He doesn't download files at random, click on banner ads because they are there, or even use Intneret Explorer or Outlook for that matter (Firefox and Thunderbird all the way baby). I layed down the internet law to him about what to do and what not to do, but still his computer got royally raped."

BS. What? You sit with him 24 hours a day or 7 days a week? Maybe it is a possible that your friend IS an idiot and DO download and execute files at random. How else to explain those problems (never rule out ignorance and stupidity if they are the simplest explanation) to the problem.

"With a mac he would have NONE of these problems because they just don't happen on the mac. "

More BS. During the days when the help app could launch any command, any Macnn user can post a link to Macnn saying "click here to view pic of Powerbook G5!" and on click it launches a rm -rf. Sure, it will not be long until that thread will be removed by admin but not before people lose everything they have! It will be easy to create a version that is send via SMTP as well. This goes to show that the virus problem is as much a social issue as an engineering issue.

Calling the possibility none is just plain arrogant.

birdman
Forum Regular

Joined: Jan 2000

0

07/20, 04:29pm | report spam | close Reply |
re: BS

Also keep in mind, if he's using AdAware, it often considers cookies to be "spyware". I've yet to find a single piece of spyware on my PC system, yet it gives me a big red alert that I have...... GASP! 78 cookies in my Firefox settings!!! The horror!

Andrew
Fresh-Faced Recruit

Joined: May 1999

0

07/20, 07:05pm | report spam | close Reply |
Trojan of Another Flavor

Hmmm...I wonder which Microsoft employee was told to make this one to give iTunes a bad name?

klinux
Senior User

Joined: Jul 2002

0

07/20, 07:47pm | report spam | close Reply |
Yes

Tracking cookies can be flagged by some adware/spyware as bad which just further bolsters my point further - any computer (Win, Linux, OS X) can have tracking cookies.

"Hmmm...I wonder which Microsoft employee was told to make this one to give iTunes a bad name?"

Why Micrsoft? Did someone who used to beat you up as a kid now work at Redmond so now you have a grudge against MS? Why couldn't it be Real or any other media-related company?

itguy05
Forum Regular

Joined: Apr 2005

0

07/21, 08:16am | report spam | close Reply |
Billy and Steve Ballzac

They both are pi$$ed that Apple is generating more znd more buzz than Micro$haft. That's why. Ego, my friend, ego. Something Billy Boi and Steve Ballzac have in droves.

Billy Boi even said he won't let Apple clobber him in the video market. Seems funny that all the latest press is about Apple entering the video market and this thing shows up.....

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

07/21, 02:33pm | report spam | close Reply |
Re: Normal computer users

So you are assuming that a user that stupid and inexperienced about computers bought a Mac rather than a far more cheaper system, more main-stream system like a Dell?

Oh, right, I forgot, anyone who knows nothing about computers would only buy PCs, never a Mac. Macs are for intelligent people who know what they're doing! Man, I feel so stupid fogetting this fact of life.

As I said in an earlier post, my friend had 2651 infections on his Dell according to Spyware Doctor, and these were not specifically done by him. He doesn't download files at random, click on banner ads because they are there, or even use Intneret Explorer or Outlook for that matter (Firefox and Thunderbird all the way baby). I layed down the internet law to him about what to do and what not to do, but still his computer got royally raped.

That's exciting, but that has nothing, absolutely nothing, to do with this worm. This worm requires you to click a link, which downloads the file, then go off and run the exe because you think its an itunes installer. Great. Nothing magical there. No activeX security holes. No magical "Click a link, get infected" fun. This is a set of steps that people claim can't happen on a mac, and I claim that it can, since it involves the user doing specific tasks. h***, I remember a system 8/9 graphics accelerator trojan that people got by downloading a supposed system extesion from various places. And no one here claims OS 9 was riddled with security holes.

With a mac he would have NONE of these problems because they just don't happen on the mac. Sure, a malicous file COULD be made that COULD mask itself as iTunes that COULD be installed by someone. Thats a lotta COULDS. But in order to really get hit by a virus or spyware on a Mac, you have to be below the bar stupid and careless about computing and internet access. Unlike the Windows world, where all you have to do is accidently click the wrong link on a webpage and you get some weird file floating on your system.

And for this worm to work on Windows, the same COULDs have to be met.

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

07/21, 02:33pm | report spam | close Reply |
Re: Normal computer (cnt)

The big problem in the windows world is that now apps are being made that say they remove spyware but are in fact spyware. This doesn't happen on the mac because we don't have spyware, or at least not enough to warrent making a big deal of it.

Right! So Mac users would never install software that turns into spyware because the only software that does that is spyware removers? That's just c***. There's no spyware, great. But that's not because OS X is impervious. Its just there's not enough market to warrant it. Its certainly easy enough to do, since Cocoa has the frameworks (SIMBL) to allow extensions to apps and all.

And I guess you've never installed Stuffit Expander. Or Quicktime (both annoying adware). Or Norton Antivirus (there's software that makes your computer more unstable than it does safer).

If one comes along, everyone makes a stink about it on VersionTracker, MacUpdate or one of the other big trusted download sites, and it is delt with. Just like it is in the windows world.

Look at the Dashboard loophole that people found when Tiger came out. EVERYONE was talking about it on Apple's discussion forums, MacNN forums, MacOSXHints, etc... So what did Apple do? In 10.4.1 and 10.4.2 they added alot more protection, like a widget preview, and alot more confirmation buttons).

Yet if the same thing happened in Longhorn, you'd be criticizing them for having insecure apps and not dealing with security. But with Apple, its praise because they 'fixed' their huge security hole. And don't forget their other security hole from 10.3, which allowed terminal commands, or trojans/viruses on disk images to be downloaded and run by just going to a web page. Yeah, no serious stuff there! And there's still the security hole where, if a malicious program is running unobserved, can tell when you've activated admin privileges through sudo (or possibly just authenticating some installer or action) and use that moment to gain root access to your computer. Sure, I know, no Mac user would ever get any piece of malicious software running on their computer, and if they did, they'd know about it immediately because they spend all their time looking at Activity Monitor and verifying every entry constantly. But just imagine some user who failed to check that out one day. Oops.

Man, how I hate Mac-a**-kissing "We're better then windows" fanboys.

Andrew
Fresh-Faced Recruit

Joined: May 1999

0

07/22, 12:08pm | report spam | close Reply |
Asleep

"Why Micrsoft? Did someone who used to beat you up as a kid now work at Redmond so now you have a grudge against MS? Why couldn't it be Real or any other media-related company?"

Sounds like you've been asleep for the past 20 years or are too young to remember. MS lost in court with regard to stealing QT code. They stole disk comression code and put it in DOS and got caught and lost in court. Their latest conflict of interest seems to be buying ad/spyware companies and buying companies that protect against it. What a thing to do...they plant spyware on your computer then sell you the software to get it off. Anyway, their very origins point to not treating others the way they want to be treated.

Not only that, but it targets AOL's chat system...does Real compete in that space? No. Does Microsoft? Yes. I bet they think it's great, two competitors get a bad name with one virus.

(Not that I was beat up physically, but surely you realize they've corrupted the job market.)

Show More Comments

Login Here

toggle

Network Headlines

05/25	Sotheby to auction Jobs Atari memo,...
05/25	Apple hiring new chip engineers for...
05/25	Third-gen iPad coming to Philippines...
05/25	Apple to integrate Baidu search into...
05/24	Apple submits surprise optical stylus...

Show All

05/25	Sotheby to auction Jobs Atari memo,...
05/25	Apple to integrate Baidu search into...
05/25	Google picks up webOS Enyo team, Open...
05/24	Apple submits surprise optical stylus...
05/24	Yahoo releases Axis 'visual search'...

Show All

05/25	Sotheby to auction Jobs Atari memo,...
05/23	Google launches redesigned Search app...
05/22	Leaked next-gen iPod touch part hints...
05/22	Hulu Plus updates with iPad Retina...
05/22	TiVo Stream to push TV to iPhones,...

Show All

03/02	Save $330 on refurb. 15.4-inch, 2.4GHz...
03/01	Pre-owned 8GB iPod touch 2G, drops...
02/29	$150 off Nikon Coolpix S80 Compact...
02/28	Plantronics BackBeat 903 Bluetooth...
02/27	Refurb. Seagate 1.5TB GoFlex Portable...

Show All

toggle

Windows-based worm masquerading as iTunes

updated 12:00 pm EDT, Wed July 20, 2005

Worm masquerades as iTunes

Stupidity required

No

Is this news?

Re: No

re:No

executables on the mac

Re: No

Just d/l from Apple

Re: Re: No

Normal Computer Users?

BS

re: BS

Trojan of Another Flavor

Yes

Billy and Steve Ballzac

Re: Normal computer users

Re: Normal computer (cnt)

Asleep

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace

Windows-based worm masquerading as iTunes

updated 12:00 pm EDT, Wed July 20, 2005

Worm masquerades as iTunes

Related Articles

Recent Articles

Stupidity required

No

Is this news?

Re: No

re:No

executables on the mac

Re: No

Just d/l from Apple

Re: Re: No

Normal Computer Users?

BS

re: BS

Trojan of Another Flavor

Yes

Billy and Steve Ballzac

Re: Normal computer users

Re: Normal computer (cnt)

Asleep

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace