RSSMac Porn Surfers Subject to QT Flaw
By Ed Oswald | Published November 1, 2007, 2:25 PM
Attackers are going after Macintosh computer users who are visiting pornographic web sites, claiming to offer a plug-in that installs a video codec necessary to play the movie files within QuickTime.
On certain profiles, the links to the Trojan download appear as stills to a supposed porn clip. When a Mac user clicks on the link, they are taken to a page with the message "Quicktime Player is unable to play movie file. Please click here to download new version of codec." From there, the install would proceed like a normal program install.
Instead, the plug-in is actually a Trojan horse that hijacks the Mac's DNS settings, resetting them to a malicious one that will actually redirect popular websites such as eBay, Paypal, and some banks.
The supposed codec never installs, thus when the user returns to the page, they will still receive the same above message. Uninstalling the application won't take away the changed settings, according to Intego Security, which disclosed the flaw.
"Under Mac OS X 10.4, there is no way to see the changed DNS server in the operating system's GUI. Under Mac OS X 10.5, this can be seen in the Advanced Network preferences; the added DNS servers are dimmed, and cannot be removed manually," the company said.
In addition to the DNS hijack, a root crontab is installed to ensure the malicious DNS server is always being used, even when the user changes locations, which can sometimes change the DNS server used.
Intego said in an advisory it had reason to believe there were several different versions of the Trojan, and country-specfic ones as well. The company said its anti-virus software for the Mac would protect against the exploit.
There was no immediate word whether Apple planned to take any action on the vulnerability through an update for QuickTime.
Bwahaha! Like anyone would use QuickTime? The first thing I install on my Mac is called VLC.
Morons deserve it.
Score: 0
|This isn't a QuickTime flaw. It is a link on the web page which gives a false error message regarding the codec. The user has to click on the link, download the disk image file (which may or may not mount automatically depending on the user's browser setting). Then the user has to open the disk image and double-click on the installer. Then the user will be asked for their administrator password. Only after all this is done and the user enters their password, then the trojan is installed. At any time, the user can click cancel and the trojan doesn't work.
Score: 0
|So.. now there is Mac Porn (or should that be iPorn)? And how is that different from PC Porn (ie MSPorn)? I just can't keep up anymore.... call me old school, but I still like my DOS Porn!
Score: 0
|This is a STUPID argument for/against Macintosh.
Give a Linux program root privileges and it will also be able to change DNS settings (just edit the /etc/hosts file, for example).
What has made Windows MORE vulnerable (in the past) is that a program did not need administrative privileges to do malicious deeds.
Score: 0
|"What has made Windows MORE vulnerable (in the past) is that a program did not need administrative privileges to do malicious deeds."
Actually...it did. Problem is most users are always logged in with admin privileges...
Score: 0
|Nailed it.
Score: 0
|Good point --- and of course it was a pain to run without admin privileges.
Score: 0
|Anti-virus software... on a Mac? Say it ain't so!
Score: 0
|Well, at least it wasn't Mac's first time!
Could it be that Mac is not as secure as some of the idiots thought. I am sorry, but I really find this type of stuff very amusing in that their claims of being perfect are nothing but a myth.
Every operating system is subject to attack. No one is safe and anyone can be an idiot at any time.
It never has been a war against MS and Mac or Linux, but only the difference of us and them, those that do and those that don't. Security is a state of mind and can change at any point with just a click.
Score: 0
|Suckers! No pun intended. Previous poster is right, gonna visit porn sites, better use protection! HEHEHE
Score: 0
|News flash! If you download a program and install it as an administrator, it can do whatever it wants to your machine!
No OS, from Solaris to Windows can stop a stupid user.
Score: 0
|I will stand by Apple's claim that their software is perfect and not prone to any attacks all other software is prone to.
thank you, pc/Windows/MS fan out...hehe
Score: 0
|If so than why are there anti-virus and firewall programs for it? ;-)
Score: 0
|Because companies can make people be afraid!
Score: 0
|Yeah, thats the ticket... [rolleyes]
Score: 0
|I say porn surfers deserve whatever internet STD's they get. You need to use protection or risk getting TEH AYDS
Score: 0
|just stay away...
Score: 0
|Apple's idea of security is to take control away from users. We see it with all their products. So why are people always surprised when they learn about things like this?
That said, stupidity will bypass the most secure system. But especially with Apple users since they have the illusion of invincibility.
Score: 0
|Mac porn surfers? There's no such thing:
http://img475.imageshack...winvsmacusers6cwem4.gif
Score: 0
|So a user has to download a program from a porn site and install it as administrator to get this?
How is Apple going to issue a fix for this? Huh?
Score: 0
|"So a user has to download a program from a porn site and install it as administrator to get this?
How is Apple going to issue a fix for this? Huh?"
Where does it say anything about being an administrator to install?!
It clearly says "From there, the install would proceed like a normal program install".
Aside from that, it's actually quite simple to fix. Require root rights (or root group at least) to change network settings... problem solved. It'll take Apple months to figure that one out though... lol
Score: 0
|betanews did not do its homework.
http://www.offensivecomputing.net/?q=node/549
"If the user then proceeds with installation, the Trojan horse installs; installation requires an administrator’s password, which grants the Trojan horse full root privileges."
You can not change network settings without being administrator on Mac OSX. So how again is this news?
Score: 0
|It's in the actual report itself. The user has to enter the admin password to install the "codec".
Score: 0
|How is every exploit for Windows news?
This is more newsworthy than most of those, as it shows (yet again) that neither Mac OS nor its smug users are invulnerable.
Score: 0
|I am invulnerable. Was invulnerable on Windows. Who installs software from pr0n sites anyway?
Score: 0
|"Under Mac OS X 10.4, there is no way to see the changed DNS server in the operating system's GUI."
Wow -- never looked. That's lame. Windows may suck, but it can do this at least. What, is DNS too "techie" for Mac users?
Score: 0
|LOL... take a look at most mac forums and see what some of the topics are. It really opens your eyes as to why non-technical people get Macs in the first place...
On a serious note, it is rather difficult for a layman to get his/her network settings in any Mac OS pre 10.5. Apple has intentionally made it difficult to get to most of the more advanced (and even basic in some cases) network features. Based on their "plug it in and it just works" premise, a user should never need to look at these things.
I'm rather surprised we haven't seen this on the windows side (or have we and I missed it?).
Score: 0
|There's been quite a lot of complaining about how Vista makes it harder (an additional click or two) to get to various 'advanced' settings areas.
...usually followed by, "I'm so glad I have my MacBook" gibberish, but it's actually a good thing.
Having been in IT all my life, the systems settings being so easy to get to always seems to cause problems for the technically challenged, as they are annoyingly proficient at messing around with them and breaking everything they can.
Score: 0
|Agreed, but in this day and age of consumer high-speed internet and such, being able to even "view", not neccesarily change, something as essential as DNS seems to be more important now a days. I can't for the life of me figure out how Apple thinks that security by obscurity is going to work out going forward...
Just my 2 cents...
Score: 0
|For my home connection, I've not once had to change any DNS settings on any of my PCs.
Anecdotal, I know, but....it's still possible.
Score: 0
|I do often... I use OpenDNS because I have had tons of latency problems with my ISP's DNS servers.
But still, giving the user the ability to even easily view network settings is a step in the right direction, IMHO.
Score: 0
|DNS is too techie for the majority of users in general!
Score: 0
|The more attention a company gets (Apple) the more it's exposed to security vulnerablities. Perhaps in a way it's "Cool" to hack Apple products, more now, then before.
Score: 0
|Even Mac users couldn't be that stupid... ;-)
Score: 0
|I'd actually argue that they are.
Stupid isn't the right word though, maybe ignorant. I know several mac owners who assume they are immune from anything bad.
Wake up call to mac owners.
Score: 0
|you do realize that MAC is an acronym for - Moron At Controls
Score: 0
|LMAO... And what's the acronym for iMac? :-)
Score: 0
|inept Moron At Controls
except the "nept" is silent of course for style as we all know Macs are all about style and looking good ............. sort of like blondes :-)
Score: 0
|posters, start your flaming!
Score: 0
|Some Mac users are stupid. Some PC users are stupid. Stupidity knows no platform boundaries.
Score: 0
|I remember an ad from years ago about a person, who was selling their 486, and getting a Mac because they were too stupid to use the 486. ;-)
Score: 0
|