the mini Blog

Everyone went all crazy when the story was leaked that the first ever ‘virus’ was made for OS X. However this has been deemed inaccurate and untrue, it a ‘trojan’. For one you need to download the infected file (which claims to be screenshots of the new version of OS X, 10.5 ‘Leopard’) and double click the “latestpics.tgz” to uncompress it. Then you need to open the file that it created. The file has a screenshot embedded into it so it looks like a picture and when you clicked to open the file it would ask you to type in the admin password. This is the part which would stop people from ‘infecting’ the trojan in their machines. Since when would pictures ask you to type in your root password. Unless you are using root, this will come up, and quite frankly if you are root andyou open up such a thing that is your fault. So what does the ‘trojan’ do? Not much. Apart from trying “to propagate itself via iChat, and unintentionally prevent infected applications from running“. So this whole thing is nothing. It is just some people trying to claim fame.

It seems that this is more of a “proof of concept” implementation that could be utilized to actually do something in the future, depending on how successful it is, or it was simply done to garner attention/press.
You cannot simply “catch” the virus. Even if someone does send you the “latestpics.tgz” file, you cannot be infected unless you unarchive the file, and then open it.

A few important points:
• This should probably be classified as a Trojan, not a virus, because it doesn’t self-propagate externally (though it could arguably be called a very non-virulent virus)
• It does not exploit any security holes; rather it uses “social engineering” to get the user to launch it on their system
• It requires the admin password if you’re not running as an admin user
• It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching
• It’s not particularly sophisticated

So it isn’t more than a PR stunt. Nothing to see here now, move along…

read more