toggle

AAPL Stock: 509.46 ( 0 )

'Opener': new 'virus'/malware found for Mac OS X

updated 07:00 am EDT, Mon October 25, 2004

Mac OS X \'Opener\' malware


ZDNet reports on a newly discovered that spies on Mac users. Dubbed 'Opener' by Mac user-groups, it disables Mac OS X’s built-in firewall, steals personal information and can destroy data: "the virus, which Sophos calls Renepo, is designed to infect any Mac OS X drives connected to the infected system and it leaves affected computers vulnerable to further hacker attack. Ducklin said Opener disables Mac OS X's built in firewall, creates a back door so the malware author can control the computer remotely, locates any passwords stored on the hard drive and downloads a password cracker called JohnTheRipper."


by MacNN Staff

print
email
(18)

TAGS :

 troubleshooting

Related Articles

Recent Articles

toggle

Comments

  1. JamesKass

    Junior Member

    Joined: Nov 1999

    0
    10/25, 07:18am | report spam | Reply |

    Opener != Virus

    Don't you people read your own forums? Can't replicate to other computers, it can't be a virus.

  1. wings_rfs

    Fresh-Faced Recruit

    Joined: Dec 2002

    0
    10/25, 07:22am | report spam | Reply |

    Virus My A**

    A virus huh? In case ZDnet forgot, a virus is something that spreads without human intervention. This thing is nothing more than a trojan, requiring the user to install it, AND to provide the root password when doing so. That said, ANY installer when given the admin password can do whatever it darn well pleases -- and that's exactly the way it and all other Unix's work. Just what is this vulnerability that they suggest Apple needs to fix?

    Call me when they find something that can penetrate my Mac and s**** it up with me away from the keyboard.

  1. alexf

    Fresh-Faced Recruit

    Joined: Oct 2004

    0
    10/25, 07:24am | report spam | Reply |

    Not a virus

    This is not a virus. The "script based" tag probably makes most people think of the Windows viruses which use scripting to install themselves from emails etc.... this so-called 'virus' cannot install itself - the user's machine has to be compromised first or the user has to be fooled into installing the script themselves. From that point on, this script can cause problems - but that is no different from any trojan program purporting to do one thing and then in reality doing something else. So although users should be careful not to install this software on their machines, there is no need to be alarmed that an outbreak of infections is about to occur, as this script is not infectious.

  1. coolfactor

    Fresh-Faced Recruit

    Joined: Jun 2003

    0
    10/25, 07:45am | report spam | Reply |

    It can spread

    It may not be able to spread to other computers directly, but it can spread to any connected "volume", and if that volume happens to be a network volume shared by multiple computers, doesn't that spell trouble?

  1. MacScientist

    Junior Member

    Joined: Feb 2000

    0
    10/25, 08:59am | report spam | Reply |

    Re: It can spread

    coolfactor, everything stated above still applies. The administrative user must install Opener. The administrative user must run the script. Otherwise, it sits on the computer as a useless file. The Opener scare is much ado about nothing.

  1. cyngus

    Fresh-Faced Recruit

    Joined: Apr 1999

    0
    10/25, 09:09am | report spam | Reply |

    Gets the Blood pumping

    Well, it gets the blood pumping on a Monday morning anyway. Its a small threat. One of the good things here is that this trojan/virus requires a fair amount of user stupidity (to supply an admin password to an unknown program) and the average Mac user tends to be a little more computer savvy than the average Windows user.

  1. Clive

    Mac Enthusiast

    Joined: Jan 2001

    0
    10/25, 09:35am | report spam | Reply |

    Trojans

    They don't necessarily require users to open the file, there's some tricky vulnerabilty in MacOS (which is really a nice feature) where this isn't necessary. At some point the "stupid" hackers will get a bit cleverer.

    The sky isn't falling in, but we shouldn't ignore the warning.

  1. testudo

    Fresh-Faced Recruit

    Joined: Aug 2001

    0
    10/25, 10:09am | report spam | Reply |

    Re: It can spread

    It may not be able to spread to other computers directly, but it can spread to any connected "volume", and if that volume happens to be a network volume shared by multiple computers, doesn't that spell trouble?

    It only spells trouble if
    (a) the software on the network volume is run/installed by another user

    or

    (b) the trojan, when infecting network volumes, notices a volume as a boot volume and infects the appropriate directories with itself (such that, when that computer is rebooted, it launches the virus).

    The second point is one reason why OS X doesn't, by default or without hacks, usually allow you to share just any folder or drive, only those from your user folder. Your system drive should never be set up to share the entire volume.

    This does indicate that everyone should question ANY installer that requires an admin password to install. (Although other trojans can easily get by installing themselves as local programs to the user, and a password isn't required to install those, then you've got a keyboard logger running and don't know it - unless you check your startup items regulalry, and who does that, esp. since Apple sticks them in such a stupid location in system preferences).

  1. Bryson

    Fresh-Faced Recruit

    Joined: Mar 2002

    0
    10/25, 10:23am | report spam | Reply |

    Standard for ZDNet

    It's a ZDNet story. They will take any negative Apple story and spin it into a 'sky is falling' article whenever they can.

    This isn't any different than the rash of virus and trojans stories that appeared on ZDNet months ago and guess what, nothing has happened since.

  1. digid

    Fresh-Faced Recruit

    Joined: May 2004

    0
    10/25, 10:24am | report spam | Reply |

    Where

    I did not see any details on where this came from. What would you have to install to get it?

Show More Comments

Login Here

Not a member of the MacNN forums? Register now for free.

 
close
Photo
toggle

Network Headlines

toggle

Most Popular

10 Most Read

Recent Reviews

Logitech Cube

The world of mice could often be described charitably as stagnant: it's an endless sea of ergonomic shapes that assume you're sitting ...

NewerTech and Targus USB Hubs For Gifts

A useful holiday present to resolve an ongoing frustration is a multi-port hub. Whether as a stocking stuffer, Chanukah present, or an ...

X-Rite ColorMunki Photo

Color calibration is the art of tweaking your monitor so that the colors represented on screen better match real life and your printer ...

toggle

Most Commented

10 Most Discussed

 

Popular News