Stan's List

Intego Security Memo:

Exploit: OSX.Trojan.PokerStealer

The Trojan horse, when run, activates ssh on the Mac on which it is running, then sends the user name and password hash, along with the IP address of the Mac, to a server. It asks for an administrator’s password after displaying a dialog saying, “A corrupt preference file has been detected and must be repaired.” Entering the administrator’s password enables the program to accomplish its tasks. After gaining ssh access to a Mac, malicious users can attempt to take control of them, delete files, damage the operating system, or much more.

Security Focus reports of multiple Mac Trojan horses in the wild. The attack is against Apple Remote Desktop and rooted through AppleScript: osascript -e ‘tell app “ARDAgent” to do shell script “whoami”‘; for anyone, unless the normal user switched to fast user switching.

As with all Trojan Horses, the possibility of success is totally in the hands of the user. In order to succeed, an email must induce you to click on a URL (web link) which takes you to a malicious webpage, or you web surf and find the malicious webpage. There you are further induced to download the Trojan Horse and then open the file once downloaded. As in phishing, the success rate is small, but it does not take but a few to make it worthwhile.

Nathan points to discussion on the subject on MacInTouch’s Security Reader Report.
http://www.macintouch.com/readerreports/security/index.html#d21jun2008

First, he wants to emphasis, due to the amount of user participation necessary, there is still no need for anti-virus software.

The Trojan Horse has the ability to do damage by escalating its security privilege to Root because a vulnerability in ARDAgent allows access to SetUID.

This workaround removes SetUID:

A viable fix right now is to remove SetUID from the ARDAgent executable. Run this from an administrator account:

This will cause a warning with Repair Permissions but will prevent the problem until Apple releases a fix.

Editorial: If everyone was as sharp as Nathan (compliment) then phishing would never work. Unfortunately, this is not true. I have anti-virus software as I sent and receive a ton of email, visit a number of web pages in search of information for this list. I do not want to inadvertently forward a virus or a trojan horse.