Russian organized crime notices Macs

[tacit]

Organized criminal groups in Eastern Europe are responsible for many, if not most, computer viruses in the Windows world; they use viruses to remote-control computers, steal sensitive financial information from computers, and send spam. This is not new.

I spend a good deal of time tracking down virus distribution networks and compromised Web sites; it's kind of a hobby of mine. Today, for the first time, a virus downloader noticed that I'm on a Mac, and tried to download Mac malware to my system.

I've put a full writeup on my blog here. This malware is crude and not very effective, but it's a bad sign that Macs are now being noticed by the Russians.

[gunug]

Does anyone know how to say/write "Ignore the computer behind the curtain!" in Russian?  

[jwboyd]

tacit

You've done us all a great favor here at TS.

Do the current Mac antivirus tools clean up and/or prevent these malware attacks?

Any recommendations?

Thanks a bunch!

Joe

[prin]

QUOTE(jwboyd @ Mar 26 2008, 03:39 PM) <{POST_SNAPBACK}>

tacit

You've done us all a great favor here at TS.

Do the current Mac antivirus tools clean up and/or prevent these malware attacks?

Any recommendations?

Thanks a bunch!

Joe

Good grief! I'd like to know if my Norton antivirus will protect my trusty Mac. Thx for helping.

[Mayo]

TidBITS has an interesting article about security options in the current issue.

An option to anti-virus software is to use Little Snitch ($25) to monitor requests to transfer data from your Mac. Incoming transfer requests can be monitored in Leopard by going to System Preferences/Security/Firewall and clicking "Set access for specific services and applications." (I don't recall what the default setting is...) It is also a good idea to click the "Advanced" button and enable Firewall Logging and Stealth Mode. My initial testing of Stealth Mode indicates only certain ports are in "stealth mode" while the rest are "closed."

GRC Port Authority Report created on UTC: 2008-03-26 at 22:48:11

Results from scan of ports: 0-1055

    0 Ports Open
 1048 Ports Closed
    8 Ports Stealth
---------------------
 1056 Ports Tested

NO PORTS were found to be OPEN.

Ports found to be STEALTH were: 135, 136, 137, 138, 139, 445,
                                554, 593

Other than what is listed above, all ports are CLOSED.

TruStealth: FAILED - NOT all tested ports were STEALTH,
                   - NO unsolicited packets were received,
                   - NO Ping reply (ICMP Echo) was received.

The advantage of Little Snitch over anti-virus programs is that it will catch and notify the user about outgoing data transfer requests even when anti-virus software hasn't been updated with the data necessary to detect new viruses/malware. The data transfer will not commence until LittleSnitch is given permission to allow the transfer. If the request is from a trusted server that is repeatedly used then you can tell Little Snitch to always allow the connection. Or you can tell it "one time only" or "never."  Little Snitch doesn't seem to cause the kinds of problems associated with anti-virus software.

LittleSnitch won't catch a virus or malware before it infects your computer but it may let you know about a potential problem if the malignant program is designed to transfer your data elsewhere...

[Paddy]

Rob Griffiths wrote about this Trojan at MacWorld and at MacOSXHints in October, and said at the time that it was showing up on porn sites. Has it become more widespread since then, Franklin?

Interestingly - several of the sites you mentioned have now been taken down, though xpantivirus and traffloader are still there (traffloader is just a blank page - didn't do anything when I had a look in FF) I'm assuming that the ones that are gone were iPowerWeb sites and the ones that are still there are hosted elsewhere - others have been poking around in this realm as well and one site mentions that xpantivirus.com is hosted by Intercage (which appears to be a US company with domain registration through GoDaddy, but the actual registrant is hidden) but the domain name servers are estdomains. That's not what I found - the name servers are ns2.trifle.net and win-security.biz. Trifle.net is a Russian site, while win-security.biz has an "Internet Security Troubleshooting" questionnaire and links to xpantivirus.com, and "AntiSpyGuard" and "SpyShredder" - both of which are...you guessed it - more rogue antispyware! And guess who owns those domains and where they're registered?

Anyway, it seems that you're not alone in the hunt, Franklin:

http://seo.mhvt.net/blog/?p=237
http://seo.mhvt.net/ (scroll down to "Latest News" section)

All sorts of interesting stuff on that site...including this rather sneaky (and very slick) scam: http://seo.mhvt.net/blog/?p=298#more-298
(I think Apple ought to be told about this; in case nobody else has already, I sent their trademark dept. an email - not sure if that's the right dept., but it seemed like a good place to start)

And in case anyone needs more info on the OS X trojan:

How to find and remove the OSX.RSPlug.A malware

New Trojan Horse targets Mac users

[Paddy]

QUOTE

Good grief! I'd like to know if my Norton antivirus will protect my trusty Mac.

Prin, if you're still running OS 9.2.2 as your profile indicates, this particular trojan won't affect you.

As for the rest of us, NEVER, EVER, download any software that some popup or unknown source urges you to! Only download software from trusted sources such as Apple, Adobe and other software companies, VersionTracker etc.

This trojan cannot just sneak in when you're not looking - it requires that you first ok the download and then enter your admin password.

You don't need mysterious codecs, you don't need any "antivirus" software, you don't need anything a popup offers you. Period.

[tacit]

QUOTE

Do the current Mac antivirus tools clean up and/or prevent these malware attacks?

Well...kind of. The problem is that the Mac malware is encrypted when it downloads, to change its signature and prevent antivirus software from detecting it. The people responsible are constantly making small changes to it to evade detection. Local antivirus programs really aren't proving terribly effective in today's world of encrypted, ever-changing viruses.

QUOTE

An option to anti-virus software is to use Little Snitch ($25) to monitor requests to transfer data from your Mac.

Won't protect in this case; this malware changes your name server settings. If you deny access to the new name servers after you're infected, none of your Internet software, from mail programs to Web browsers, will work.

QUOTE

Rob Griffiths wrote about this Trojan at MacWorld and at MacOSXHints in October, and said at the time that it was showing up on porn sites. Has it become more widespread since then, Franklin?

Yes, much. It is still downloaded from fake porn sites (the servers do not have any porn on them, but they pretend to); but I've also seen this Trojan downloader on all kinds of non-porn sites as well. One person I have been talking to was searching for do-it-yourself ultralight kits, and found a site that claimed to have online videos showing how to build an ultralight helicopter. As you can imagine, there was no such video. When he went to try to look at the video, he saw a message telling him to download and install software so that he could play it; and, of course, the "special software" was a Trojan, not a video player at all.

They put the Trojan on sites that pretend to have all kinds of videos--porn videos, YouTube videos, you name it. All these sites are fake; there are no videos. Just an empty video player window and a message telling you to install the software.

QUOTE

Interestingly - several of the sites you mentioned have now been taken down, though xpantivirus and traffloader are still there (traffloader is just a blank page - didn't do anything when I had a look in FF)

Actually it is still there.

The traffloader.info site and the fake virus dropping sites are configured so that if you go to the top level of the site, you either see nothing, or you see a fake error message telling you that the Web site is gone. But the actual redirectors and virus droppers are there. Like with traffloader, for instance, if you just go to traffloader.info you see nothing, but if you go to traffloader.info/go.php it redirects you to a virus site.

[Paddy]

Sneaky.

And here I thought some ISP had done the responsible thing. Oh well. I wondered about those error pages - they weren't quite the run-of-the-mill variety, but some ISPs DO have fun with them, so you never know.

[chriskleeman]

Paddy, as you know my site is hosted by IPowerWeb.

Doesn't make me feel very secure to know that these folks are targeting them. And it makes me feel even less secure to know that IPowerWeb either isn't able to respond to or doesn't particularly care about the threat.

Maybe it's time to migrate to another server.

Thanks Tacit for the info. I read your article and blog, and it's unbelievably well-detailed.

We at TS cannot thank you enough for your hard work on this!

Chris K

[Paddy]

Well, Chris, you know where we can move you to! (And get another month free for TS into the bargain with the referral program... ) I've also found GoDaddy to be pretty reliable if you want/need more storage space, and you can't beat the price at just over $3/mo if you pay for 2 years in advance. LunarPages also seemed good - I got the North Andover school district to move their hosting there.

[chriskleeman]

I pay around $95 a year for 1 or 2 GB, and 50 GB for bandwidth. Is ASO comparable? I'd be happy to help out TS if I can!

When I was looking to change servers, iPowerWeb was getting high marks for most of their services. While I don't necessarily need quite that much website space, I will need some space for mp3's, etc.

I'll look into it right now.

Chris K

[krissel]

ASO is not that cheap compared to what you are paying. But they are very responsive to any problems.

Here's the hosting page:

http://www.asmallorange.com/services/hosting/

[Mayo]

QUOTE

Won't protect in this case; this malware changes your name server settings. If you deny access to the new name servers after you're infected, none of your Internet software, from mail programs to Web browsers, will work.

LittleSnitch won't protect a Mac from getting infected; good ol' common sense is the only reliable protection in this case since apparently even anti-virus software cannot keep up with things. But LittleSnitch will alert a you when the name servers are changed because it will ask for permission to allow your apps to send data to the new servers. It will even display the names of the new servers.  That's the first warning that something is amiss.. and if you should deny the connection(s) and all your Internet apps begin going haywire then you will know for certain that you have been infected. But at least the fraudulent connections were never allowed to happen.

[Paddy]

Kris, one thing I've found is that a lot of ISPs that advertise gargantuan bandwidth allotments and huge amounts of storage space actually don't provide it when push comes to shove. They'll come up with all sorts of vague excuses like "overusing the server resources" etc. and do something like suspend or terminate your account. The web is littered with horror stories. Plus they put hundreds of users on each server, in the hope that none of them will have significant traffic.

From what I can see at ASO, this doesn't seem to be an issue - their hosting plans are actually much more realistic, and I've yet to hear of anyone being unceremoniously shown the door because they "overused resources" (that they'd bought and paid for!) Occasionally we do have spikes in server load and subsequent slow-downs, but they are usually temporary and ASO seems to work to address them.