You are here: silicon.com > Software > Malware

Malware

Mac porn Trojan is multiplying, warns F-Secure

Are cyber criminals getting serious about Apple?

Tags: malware, apple, trojan, mac

By Liam Tung

Published: 9 November 2007 08:37 GMT

Security company F-Secure has discovered 32 variants of a Mac Trojan unearthed last week but claims about its powers have been wildly overstated, according to experts.

Mikko Hypponen, chief research officer at F-Secure, wrote in his blog: "Looks like the Mac Trojan we posted about last week was not an isolated incident. The gang behind it seems serious about targeting Mac users as well as Windows users. And they keep putting out slightly modified versions of the Trojan for the Mac too."

Last week, Mac security software vendor Intego discovered a Trojan designed for Mac OS X being distributed via porn sites.

The Trojan is being disguised as a codec, a device used to decode digital streams. If it is downloaded, it alters a computer's domain name system (DNS) server, redirecting the machine to porn sites of the malware distributor's choice. The prime purpose appears to be to make money when people click on ads served on the sites.

The "payloads" of the 32 variants of the Trojan are the same as the original discovered by Intego. However, F-Secure technical manager Patrik Runald said the Trojan is also on a reconnaissance mission of sorts.

Runald said: "It reports the name of the computer and the operating system version back to another IP address within the Ukraine to keep track of the installs they have."

There is also a version for Windows platform users, said Runald, and it was this version that led him to the conclusion the group behind the DNS-changing Mac Trojan is the same group behind the malware released earlier this year known as "zlob".

He said: "Zlob is also about click ads and showing ads on your PC and are also typically distributed through fake codecs."

It shows that Macs are "starting to get interesting for the bad guys", he added. "It's not an isolated incident because it's a professional gang behind it, not some teenagers trying to prove a point," Runald said. "They're actually making money out of it and because of this it's unlikely to end soon."

However, he said, the Trojan does not mean Mac platforms are facing a malware epidemic.

Liam Tung writes for ZDNet Australia

  1. Zones
  2. Management
  3. Networks
  4. Software
  5. IT Services
  6. Hardware
  1. Verticals
  2. Public Sector
  3. Financial Services
  4. Retail & Leisure

Clive Longbottom Windows 7: Not perfect - but ready for prime time Microsoft's latest OS fixes most of Vista's ills - but still has challenges ahead

Stephen Kleynhans Mind the details with Windows 7 Just because it might work better than Vista, it doesn't mean you can be sloppy


  • Jobs
Senior Managed Services Engineer

Incident Management - where required proactively handle incident resolution demonstrating the ability to handle multiple concurrent service issues ...

Service Desk SUPPORT Engineer (1st Line Support)

Experience of diagnosing Mac hardware and software issues, or have a good understanding of Mac hardware and software Familiarity with Mac, Lotus ...

Tester - Mac, Linux and Windows - London

Applicants must have solid commercial exposure in establishing Mac, Linux and Windows test environments and undertaking testing activities within ...

Agenda Setters 2009
Welcome to the ninth annual Agenda Setters poll – silicon.com's list of the top 50 most influential individuals in the technology and IT industries, from techies and CIOs to entrepreneurs and business leaders. Find out more in our latest special report.





Quick Sitemap Links: