Soup of the Day

OS X malware discovered

OSX.A.Leap information

There is a piece of malware that is currently propagating itself using the Apple iChat client. This software will present itself as an attached file sent from a contact in iChat. There is also a chance that some malicious person could send you the file as an e-mail attachment or you could download the file from a filesharing network.

The file will appear as “latestpics.gz”. The file will then present itself as on your desktop as :

Only if you uncompress this file will the malware begin its work. To find out what it does and which files it effects, go here.

Although there has been a lot of debate about the classification of this malicious file, this is not a virus because it requires the user to act before it can begin its script. However, it does highlight the fact that on any operating system, security is always at risk. Here are my tips for Mac OS X users to reduce the risk of attack.

1. Never use the Administrators accound as your day-to-day account. When you set your Mac up for the first time, the first (and sometimes only) account to be created in an administration account. This account will let the user to (almost) anything, and if a worm/virus/trojan horse can hijack this account, then the potential damage is limitless.

   For everyday use, create a new user in System Preferences > Accounts ensuring you don’t tick the “Allow user to administer computer” box. This will create a standard user that will not be allowed super privilages that in the wrong hands could do serious damage.

2. Use virus protection software. Yes, we Mac users have far less threats to worry about, but they potentially do exist. Moreover, Mac virus software will easily see incoming PC viruses and ensure that you don’t send them on. But one day a virus could be written for the Mac and wouldn’t you want to be ready for it when that day comes.
3. Ensure all unessential services are switched off. In the ‘Sharing’ section of System Preferences make sure that all unessential services are off, especially FTP access, Personal Web Sharing, Remote Access, Remote Login and Apple Remote Desktop. These services all expose open ports of access to the outside world that could potentially be exploited.
4. Finally. Never accept an attachment unless you know exactly what it is. Even a file sent across an Instant Messaging network from a trusted friend, might not be what it appears to be. Make sure you confirm with them that the file is safe, before they send the file.
5. Use your common sense!

If you follow those simple rules, your Mac environment should remain as safe as we Mac users have become accustomed to.