MAC Malware with bidirectional unicode

[gunug]

I think if I saw things popping up with reversed characters I'd probably think something was up:

QUOTE

Right-to-left override (RLO) is a special character used in bi-directional text encoding system to mark the start of text that are to be displayed from right to left. It is commonly used by Windows malware such as Bredolab and the high-profile Mahdi trojan from last year to hide the real extension of executable files.

http://www.f-secure.com/weblog/archives/00002576.html

[Xairbusdriver]

I'm assuming you're talking about this <F-Secure> blurb last week? As it points out, the purpose is to hide the true extension so they will open something that will then install some malware. Apple's Gatekeeper could even let this problem file through, without warning, if it had an Apple approved, developer signature. I think this is another reason to keep the entire file name/extension visible in Finder (Prefs->Advanced->Show all filename extensions). That way, you won't even have to depend on Gatekeeper to warn you, you can actually see the double extension text, even if it's not backwards! "What you don't see can hurt you!"