New OS X vulnerability found: worm released in lab?
By Thomas Ricker 
posted Jul 18th 2007 6:03AM
posted Jul 18th 2007 6:03AM
Look, we're fine with Apple gloating about the security of OS X in their Mac vs. PC adverts. After all, we have yet to see a large-scale worm released into the Macintosh community. However, the fact that a worm hasn't been released on a Windows-esque scale likely has less to do with Apple's superior coding than the size of their market share, i.e., OS X is a smaller target. That might soon change, however. A vulnerability has reportedly been found and more importantly, exploited by an "independent researcher" known only as "InfoSec Sellout." Apparently, a previously undisclosed vulnerability in the OS X mDNSResponder (which Apple has patched before) allowed Sir Sellout to cobble together a worm dubbed "Rape.osx." InfoSec Sellout claims to have released the worm into a controlled environment thereby infecting a network of about 1,500 OS X systems by nabbing root and dumping a text file as an evidentiary foot print. However, the worm's author claims that it can be broadly weaponised with a payload of choice across both PPC and Intel-class Macs with just a bit more work. InfoSec Sellout will disclose the vulnerability to Apple only after his/her "research is complete" and after an appropriate level of compensation (er, InfoSec Ransom?) received. Dubious as that sounds, for better or worse, it's the way the game's currently played. [Via Slashdot]
What an ingenious evil plan. That bastard!
*hugs blackbook*
Wow, that man is the evil i hope to emulate.
You've already lost that battle, he's an anonymous pansy.
I don't mean emulate HIM, just his actions, with a few minor changers, most notably that i will reveal myself; whats the good of evil if people don't know it?
Not really that impressed.. Why even make a claim when all he's done so far is dump a text file?? Oh and what exactly does it mean "controlled enviroment". If it's 1500 macs sitting in a room that makes it even less impressive.. Lets see what kind of ransom he wants :P
If you can get root and dump a text file, you can do anything.
agreed, marektshare is a factor, but you guys are saying the inherent security of the OS has nothing to do with it? you guys are worse than cnet.
pinheads
Homer,
No, that's not what I said, read again.
Thomas
When you have to put quotes around "independant researcher" you're retaining almost none of what little credibility an article like this gets with intelligent people.
I think that if you hold the security of a program for ransom you're in the same bucket as a hacker or virus writer, the world and its progress has no need for you. Worms, Trojans, Viruses, and all kinds of expoits have been successfully created on OS X... In controlled environments, cause they never seme to work in the wild. And even then they have to cheat a little just to get a proof of concept to work.
OS X is secure because Apple cares about security. That's the big secret, people. The most recent reports puts Apple's market share at around 16%. And those figures are purposly undercut. For any one computer manufacturer to have that big a chunk of the market is a very good thing, and is no small target.
Keep doing your thing, Rape-man, you seem to need the attention. Although something tells me I won't have to worry about you when surfing the web... for the remainder of my time on Earth.
Also, a quick glance at Bugtraq / full-disclosure / etc etc will reveal that this is *not* how "the game is played nowadays". Holding something like this to ransom is essentially black-hat behaviour imo, and not how the security community should, and mostly does, operate.
Wow, Steve Jobs himself, when directly asked at All Things D, said their worldwide desktop marketshare was around 3%, yet you claim 16%! Now talk about the faithful. When even your hero says 3%, and you turn around and say that he is just being modest. I think you are confusing the fact that for a couple of quarters in the US, Apple has had 16% of laptop sales with their overall marketshare. You see, there are more computers out there than just laptops, and there are more countries out there than just the USA.
IDC announced in it's recent press release the Apple Market Share is now 5.6% for those of you bickering over what the stats are.
And OSX does not have YEARLY $150 updates. Heck, Leopard will be my first OS upgrade in 2 years, that's right...2 years. How long did you wait for Vista? Did you get all those drivers you need yet?
and why when OSX has the slightest possible security hole do Windows users already have to chime in. Your imaginary infinite Windows wisdom is not welcome in our Mac world. We've already learned from your mistakes...which you still continue to make.
Personally, I don't feel the slightest threat from an article on a anonymous person who tests in a closed environment and doesn't release a single detail about the setups or scope of the project.
I refuse to accept that Apple's small market share is the primary reason for the lack of worms for OSX. Do you know how much cred/satisfaction any self-respecting coder would get from creating a widespread worm for OSX? I'll do the math: a friggin' lot. Come on guys, here's a company that claims that it's impossible for its software to get viruses- practically begging people to prove them wrong. You'd think that somewhere along the way, someone would take them up on their challenge. OSX may not be a big target, but its reputation rides on its impenetrability, and saying "oh, no one cares about you guys, 'cause you're small and dumb lol!" only proves that you can't accept that there could be a world free of malignant software.
Well, apparently not. According to this article a coder *has* the potential of creating a widespread worm for OS X but would rather sell/give the info to Apple than release it in the wild. It's like you didn't even read the article.
It's weird how OSx users want to tout security so badly that they're blind to vulnerability reports.
I ran a Linux webhost server for quite a while. If you install tried and tested software on it with proper permissions, keep up with current kernels and limit others from installing crap, it's pretty hardened.
Windows XP and Vista are also pretty secure if you don't do stupid stuff (and you know what I'm talking about).
If this claim is true, it is one of the very few reports as of late that can infect you without you doing anything. Apparently it doesn't exploit a browser, need to be installed or need to be an attachment to email.
Many people have taken them up on their challenge, and done it successfully. People ranging from respected security consultants to black hat lowlifes have found and reported on numerous vulnerabilities and exploits on OSX. And every time someone does, the Apple damage control machine personally attacks them in an attempt to discredit them, crazy Macheads leave death threats on their site, and people like you start floating tripe like your post to minimize the importance of the newly exploited vulnerability. Then all the Macheads stick their head right back in the sand and go right back to parroting that there has never been a security breach on OSX, in complete denial of reality.
@ L. M. Lloyd - "...And every time someone does, the Apple damage control machine personally attacks them in an attempt to discredit them..."
you're so full of it. It's nice to imagine the evil apple spin machine, but seriously, that's a bunch of paranoid bullshit. Show me one example where that EVER happened, and if you point to the macbook wifi joker, then you truly are a fool.
Hey everyone, it's Apple hatin' Lloyd!
@ Jeff
Clearly I don't need to point out an example, since you are obviously aware of it. Apple PR, as you seem to well know, was actively involved in discrediting David Maynor and Jon Ellch, and went as far as to sign contracts with their employer to make sure they couldn't present their findings. This has all been documented several places including cnet and the Inquirer.
Just because you choose to side with Apple PR instead of the researchers, doesn't mean it didn't happen.
@ CmpltDrk
I don't hate Apple, what I hate is the constant void of rational thought that surrounds any Apple, or for that matter Sony (just in the other direction) story. I get so sick of people authoritatively spewing complete crap, and everyone accepting it because it is popular crap.
A large amount of nasty stuff that can get on your computer nowadays involves collecting information to be sold, there's no point in doing that on macs when there's much better prospects in doing it too pcs.
Wow LM Lloyd, both CNET AND the Inquierer reported this? Hell, all I need in the NY Post or the Washington Times to hop on this band of credible news sources and I'm sold...
I like the image.
Quoting the blog entry:
> However, the fact that a worm hasn't been released
> on a Windows-esque scale likely has less to do with
> Apple's superior coding than the size of their
> market share
Do you have something of substance to backup that assertion?
My understanding is that OSX benefits from being a smaller target (to those that make money via spyware) but it's also an inherently more secure platform. It's not invulnerable and some day it'll get hit with a virus in the wild, but there's no reason to expect it to be overrun with them like XP 2000 and XP are.
>XP 2000 and XP
Should read Win 2000 and XP (obviously)
FWIW the market share argument is bullsh*t. Mac OS 9 had fewer users then OS X currently does, and yet it had no shortage of viruses.
See?
With advances like these, soon both OSs will suck equally!
It's the future people!
Isn't that what Beta's are for? Of course there are problems with it, that is why it wasn't released last month. Do we have problems with the one we have now, no. I'm sure one worm is not a big deal compared with whatever the counterpart has.
One day we will read the headline:
"BIG MAC ATTACK"
and it won't refer to McDonalds!
I'll keep my Vista Ultimate thank you!
Holy Crap! That's the first time I've heard that. I'll keep my Vista Ultimate? Yeah, you'll pretty much have to since you probably had to take out a second mortgage to buy it. I know that the shiny glow of Bill Gates' autograph on the box keeps you warm at night, but remember to thank Apple for all the innovation in that "Ultimate" OS. I hope your kidding.
He's only had to pay ~$250 for operating system upgrades in the past few years. Apple charges about $130-$150 for their yearly upgrades. With another one set to drop soon, there will have been 4 major releases of OS X since XP, so ~$500 vs ~$250 for operating system upgrades. Math is hard.
@ fred
My copy of Ultimate was free. It's a retail copy with a genuine serial number. Not only that, I sold my other free copy (Vista Business) for $160. So far, I'm in the black with no second mortgage. I also upgraded my machine by eBaying the old parts and using the money to fund new components. I broke even, got some nice new stuff and had enough left over to buy my wife a 22" widescreen.
The cost to acquire and run Vista can easily be made negligible. So far I'm in the black with no second mortgage. Use your brain before you spout off.
@ Christian and Asmeroth
You guys might need to get your sarcasm detectors checked out, they seem to be broken. I cannot believe that you are falling back on MS's failure to release a new version of Windows for so long as a positive. On my planet we call that grasping at straws. I'm sorry if $359 for a warmed over 5 years late aquafied version of windows doesn't ring my bell, when I've had those features for quite a while on my Mac.
As far as you go Christian, hey I'm glad that you could scrap together the cash to upgrade your box so that you might have a hope of running Vista. Hopefully next time you won't need to auction a kidney to get your widgets...oh I'm sorry I meant "Gadgets".
You have both effectively ignored what I was really talking about here anyway. I was poking fun at Bob's assertion that he'll keep Windows because it's so much more secure than OSX.
how did you get ultimate for free? i gotta say... your story is pretty unbelievable
@fred
How do YOU like your Konfabulator, er... I mean Dashboard?
People who live in glass houses...
Everyone just shut up. It doesn't matter who has what OS, as long as you like what you're working with. Its all a matter of opinion.
For a second, I thought I was reading a blog with an audience of bickering 5 year olds. Grow up.
Richard, and where did Konfabulator steal widgets from?
Oh yeah, Apple's Lisa OS.
Deskapps.
The truth is sure a bitch isn't it Windows lover?
@ fred (again): No, your original point was to show your fandom and bash another OS because it makes you feel like a bigshot. My box ran Vista fine before upgrading, and I still have all my organs. I upgrade out of affinity for tinkering with hardware rather than need.
@ Craig: Truth be told, it was $10. Alternate media kit ordered from MS + serial from trial version given out at launch events = licensed version. There are threads floating around regarding this. If you'd like examples: my Sony 20.1" LCD sold for $320, the 22" Benq wide LCD was $270; 2GB DDR sold for $175, paid $99 for 2GB DDR2; mobo/proc sold for $20, paid $135. I got lucky, but I still came out ahead.
@ byaah: He stole my juice box first.
Well, Chris I'm pretty sure I'm gonna know what I was saying better than you, but whatever. As far as me being a bigshot, it's my enormous man parts that make me feel that way. I'm glad you're happy with Vista, and when you'd like to graduate up to the REAL OSX let me know, smarty. I run a Mac out of a need for a stable machine that works right. But hey good luck to you, friend.
I keep my Vista. I had it for 6 months and never did I once ever consider buying an anti virus software.
How bout you just have both OSX and Vista (on a PC by the way) like I have and call it a day ;)
gees i just bought my macbook 2 months ago......i wonder if apple asks us to pay 1.99$ to fix this thing like the way how they did with the wifi upgrade
I think the most dangerous thing to OSX's security is the naive notion that the users have; that they are wrapped in this impenetrable security blanket with OSX.
To have users think that they are totally safe and not have to worry about anything is just asking for trouble. No OS is 100% secure and on top of that, throw in the factor of social exploit with naive and ignorant users, you have a recipe for disaster.
To the people saying that market share has nothing to do with it, I will agree and disagree with you. The only reason I will agree is the factor of being the first, like some pointed out. However, that is not always the motive for these people, some are just out looking to reek as much havoc as they possibly can. Which right now means targeting Windows and not OSX.
What it boils down too, people really need to stop feeding this junk to the computer illiterate to stop making them think they are totally safe. It is good practice to be a little careful out there in the jungle that is the internet.
Hey, there's no question that there are security holes/exploits etc in OSX. The difference here is that when there is a possible exploit, the first time you typically hear about it is when your run Software Update, and Apple patches it. There are so many people who would love to knock the Mac off of it's pedestal, but I submit that at least some of the people that start of trying to find a way to screw it up, probably become converts in the process...
Anyway, I agree with you, but only to an extent. Users should always be careful what they browse no matter what platform they're on, but OSX is the most secure, and for reasons way beyond "Small Market Share".
I would not say that OSX is the most secure, not by a long shot. I would say that unix, linux and BSD (more so BSD and linux) are the most secure OS's out there.
They run a even tighter security model than OSX, OSX is essentially a sugar coated BSD variant that the model has been changed slightly to make it easier on the user.
BSD and linux are usually patched with in hours of EVERY exploit or other security concern is found. I don't think any other OS out there to date can claim that, which is one major factor that they are the most secure OS's out there.
Of course, like any other OS out there. Their security can be tossed out the window with a user that doesn't practice good security.
Allow me to clarify. OSX is the most secure MAINSTREAM OS. I wondered if someone was going to bring that up, but I couldn't edit my comment.
And Linux isn't a mainstream OS?
Even Dell is starting to sell their computers with Linux as an option.
What is the market share on Linux compared to OS X anyways.
In the real world if you have a weapon and you threaten to set it off unless some demands are met or money is paid off no one shrugs and says "that's how the game is played".
Actually, what's being done here is that the researcher created a new weapon that only works because of a vulnerability in the OS. He isn't going to release a worm that uses it and have it wreak havoc if Apple doesn't pay for it, he's going to publicly disclose the vulnerability. Apple wouldn't be paying for him to not 'attack', so to speak, Apple would be paying to be the first informed of the security hole so that they have the chance to neutralize it before anyone else knows it exists. All that said, it's still conceptually not a very nice thing to do, but at the end of the day, the guy should get paid for his work, and it's quite a long way away from the man who plants a bomb and threatens to set it off unless receiving payment.
So he's the guy who knows where the bomb is but wants money to tell people?
These people do research on these worms for the purpose of getting them before a person with milicious intent does, and selling it to apple. There's nothing wrong with it.
it's funny that I have been running XP and now vista. havent got a virus since 2004 with kaspersky to verify that fact.
i guess it's a matter of discipline. and with the help of 64bit, i just found out that heaps of virus cant run on vistaX64.
another reason why it seems windows were more vunerable is cuz there are more people using it than mac.
now that mac are starting to get holes revealed only means that mac users are increasing. i believe that if mac users % = pc users %, both OS would share an near equal amount of exploits in the OS.
the long story cut short, anything manmade can only be made as near perfect as possible by the shear number of trials and ordeals.
macOSX hasnt met that amount of trials and ordeal as windows has. true that OSX is much simplier to use but it's security has much to be proven.
there must be a reason why banks use windows and not mac. think about it.
Yes, there is. I do and have worked for banks' IT departments for 7 years now. Banks are risk-averse and accordingly slow to change. Their IT groups are made up of MS-Certified staff. Because Windows is the market dominator for desktop systems and has been for years, and because of banks' investments in enterprise licensing for software, not to mention the proprietary software they all use for their tellers etc., they will never change their desktop systems, regardless how secure Windows is. They will patch it instead, update their firewall/viruswalls, and continue with business as usual.
And I disagree strongly with your statement that OS X's "security has much to be proven." Remember that the underlying kernel is BSD, which has been around longer than either Apple or Microsoft's companies or their operating systems. We rarely if ever read about viruses/trojans/whathaveyou infesting *NIX systems. For that matter, 5+ years of OS X and a very small handful of exploits (much less actual virus epidemics), to me, equals proven security.
You obviously have no understanding of the major differences between the two operating systems. OS X is a UNIX-based operating system, and in addition the core of it is open source (Darwin). UNIX-based systems have well over three decades of exposure to ever-increasing markets and customers. Further, open source-based operating systems can be audited by anyone, at any time.
None of the above is true for Windows. Windows is a an operating system cobbled together from millions of lines of hacked-together code generated by contractors employed by the lowest bidding contract agencies. There have been no public audits and no decades of constant optimization by people with no vested interest in shipping dates and quarterly profits.
The "market share" argument is crap. There are two reasons why a serious exploit for OS X hasn't been seen in the wild: 1) the OS is UNIX-based, and 2) the vast majority of people who release exploits into the wild are script kiddies with little or no skills allowing them to exploit OS X because exploiting a UNIX-based system requires real knowledge and expertise, not just clicking a couple buttons.
OS X and Windows are fundamentally different systems. That's the reason for the lack of serious exploits for OS X, not market share.
You are mistaken. OS X is fundamentally easier to secure than Windows. Why? Because it's based on a more secure OS - BSD. Of course market share might pay into why some commercial spammers don't attack OS X. Macs don't represent a potential spambot army that Windows does.
But underneath, in the plumbing, it's more secure. This is very well documented on the net if any nay-sayers wish to check it.
That's not to say that we Mac users are naive and don't realize that our computers can't be compromised. They can. But the market share argument is a meme that keeps getting repeated, because Windows fans (is that an oxymoron?) hate the fact that it's not true, so they want to make it true by repeating it. Unfortunately, that's not how it works.
So, for those who don't want to actually read:
1: Yes, Macs have less market share, so that helps
2: No, Macs actually are more secure
3: No, Macs are not invulnerable. Just moreso than Windows or Linux.
Proof? The San Diego Supercomputing center (the ones that set up the honeypots online) did a test. They took an out-of-the-box copy of Windows XP - the way a typical user would install it, and similar copies of Linux and OS X and put them on the Internet without hardware firewalls to protect them. The Windows computer was taken over in minutes, the Linux box was taken over in a few hours and OS X never was.
You do the math.
This is really a non-issue: OS X 10.4.10 patched this and it does not work on 10.3.x or below
Have a nice day :)
Source: http://www.securityfocus.com/bid/24924
You know, the overwhelming, and I really do mean overwhelming, majority of Windows exploits, also require an unpatched, or at least not recently updated, system and usually also require some sort of interaction by a stupid user to compromise a system. That doesn't stop THEM from being newsworthy.
In fact, that doesn't stop Macheads from running around claiming how Windows is the most insecure OS on Earth, despite the numerous security studies saying otherwise.
@ L. M. Lloyd = "claiming how Windows is the most insecure OS on Earth, despite the numerous security studies saying otherwise."
aahhhahahahaha - oh that is rich. show me a SINGLE study that says anything even vaguely like that. (microsoft funded studies don't count, and independent studies with that result don't exist.)
you are such a shill.
Ah, so let me get this straight Jeff, you ask me to show you a single study that says that, and then turn right around and basically admit that you know there are studies that say exactly that, but then discredit them because they must be biased if they don't agree with you. Ah, and I'm the shill?
Ooops, looks like the link I posted has been updated to include 10.4.10.
xD
@ L. M. Lloyd
you are a shill. there has been exactly 1 "study" with those results, bought and paid for by Microsoft. It's not that it "might be biased" - it's that it's marketing pretending to be research.
they're shills ("A shill player is a who is paid by the house and plays with the house money.") and you're a shill for using them as your source knowing full well what's going on.
you may as well say that you're the smartest guy in the world because someone you paid to say so, said so. that's idiotic.
The sad part is that regardless of OS, the majority of virii, zombie mailers, etc, wouldn't exist if the spammers weren't making money from their ventures.
But I guess one can never underestimate a gullible public wanting bigger penii, smaller mortgages and free iPods. (CLICK HERE for yours)
For all we know, a team of the world's best hackers are working on an underground project to create so many ways break into OS X, and it might come some day.
When Mac users least expect it.
What ever happened to validating a story before reporting on it. This guy could say anything - and are you going to report on it. Next he will say he has a perpetual motion machine.
I think the only thing this guy has is a marketing book and he is looking for PR. Glad to see he got the biggest fish to bite on his bait.
Rob @ podCast411
http://www.podcast411.com
haha i lyke big macs. hehe. but i cud never finish one. but yeaa ew rape. thas nasty HAHA
microsoft rulessss!!!!!!!!!!!! yeaa yeaa
Shadow is right, this was a publicly known vulnerability discovered around May 24, 2007. (see http://www.iss.net/threats/264.html ) This was fixed with Apple Security Update 2007-005.
The exploit in question was posted on July 16, 2007 and stated to work only against, as Shadow stated, 10.4.x versions prior to 10.4.10. If the worm worked against the current version of the OS (10.4.10) then this would be newsworthy, and fuel to spark a fanboi debate, though I guess it doesn't take much for the later.
So I'm not surprised that someone created a worm/exploit for a known vulnerability. As with any modern OS, unless one has the current version he is vulnerable to known exploits, that is assuming the OS vendor provides regular updates.
Ive Never had a virus on XP.
Question (Serious): Is it actually possible to write a program which if ran by the user, to affect the system settings, delete files whatever?
If yes - then this is how half of ignorant windows users get infected (doing certain things hinted at above)
If not - on one hand its good, on the other it again shows how you are restricted on a Mac and have less control.
Remember too that Windows is made to work with a much wider hardware selection and pays for it, OSX works with Apple hardware (yeh they dont actually make it I know but you know what I mean) - only apple machines. Hell windows even runs on a Mac, and more software - its simply more versatile and more open to these things.
"Question (Serious): Is it actually possible to write a program which if ran by the user, to affect the system settings, delete files whatever?
If yes - then this is how half of ignorant windows users get infected (doing certain things hinted at above)
If not - on one hand its good, on the other it again shows how you are restricted on a Mac and have less control."
You must not know much about a little thing called User Levels or Permissions.
On Windows everyone is at the highest level a user can be at, a system administrator.
This means that you can run things that will modify the core system with just a double click. BAD IDEA MICROSOFT!
Nix OSes on the other hand have you set as a User, which means you need permission from an Administrator to do things to files that have permissions set higher than what you can do. This simply makes it so that if someone else was trying to do something to your system files, they'd have to know the administrator password to do so. And when using a Nix OS as a desktop OS, you most likely know the password, so nothing is inhibited.
Learn more about security schemes before saying crap like Macs are inhibited.
I'm not a fan of Macs, but they are a Nix OS too, and saying the way Nix handles users is a draw back is like saying that having a key to your car is stopping you from doing things.
umm - actually users are set at what level you tell them. You can create Administrator accounts and user accounts on both systems. You CAN restrict access in user levels on windows machines, including restriction to install new programs. You can also hide and protect the system folder so users cant accidently just do things with a 'double click' - you mustn't know much about the users settings in windows..
I have to use a mac at work right now and hate having to enter the password every bloody time I want to change something or install a program.
Point still remains that a more closed off system will no doubt be more secure, but less open to more software and there for 'inhibited' (your word not mine, i just said less versatile).
Why cant you just answer a question or have a discussion without the attitude?
@barnz2k:
Yes, you can create user accounts on Windows that have restrictions, like not being able to install programs. That's not the point.
The point, which you've missed: the DEFAULT on Windows is full administrator access. This violates security rule #1: deny all first, allow some later only on authorization.
The OS should be safe and follow security and safety best practices out of the box. OS X does this. Windows does not. Yes, you can make Windows do it after the fact, but the point (again) is that Windows doesn't do it on its own by default and therefore requires non-technical users to have an understanding of user levels and permissions when there's no need for them to do so.
You have to type a password when you want to install an app? Then change the permissions of /Applications.
Ooh, that was taxing.
making it the same power as an administrator in windows, therefore losing the advantage described above..
These "security guys" really need to get with the times. Disclosing this stuff to apple makes you a hack. They need to sell the exploit to the mafia, and then 3 mos later, sell the fix to Apple.
If they survive, they will be credited with the hack because Apple has no choice, and then paid for the fix.
In a world where a company attacks its researchers, that's the only way the game can be played. This is as opposed to Windows where there is a standing offer to buy security hole disclosures so that the researchers don't sell them to the mafia in the first place.
Somewhere down the line, Apple's policy is going to bite them. It's unfortunate, but taunting and discrediting people who find problems with your system just doesn't seem like a good idea. I'd much rather have those people on my side.
er...
what?
Don't get me wrong, I dislike Macs just as much as well, I would say the next guy but everybody seems to love those cute little white and aluminum boxes, but this is just criminal.
Well, if this guy perfects this, and times it right he can release the worm on the tenth anniversary of the last Mac worm...
My TI99/4a is way better than your ZX Spectrum, it's got 16 proper colours (including transparent) and not the silly flashing ones that the BBC Micro's got, it's 16-bit and with the Extended BASIC cartridge it's so much faster and it's got sprites. Parsec beats Defender any day and I can get killed 50 times before you can even get it to load off tape.
Wow, sorry, these comments are giving me strange flashbacks... Where was I... Oh yes, my Amiga's better than your Atari ST and your Nintendo 64 rolled into one, so there.
It has just occurred to me that Windows USERS are totally insecure. WEEEE LOL
Even though this thing isn't even in the wild, people are already suggesting ways in which you could prevent this from spreading to your computer. See the comments on Slashdot and Ars Technica for some ideas (but try them at your own risk).
http://apple.slashdot.org/comments.pl?sid=251671&cid=19895739
http://arstechnica.com/journals/apple.ars/2007/07/17/anonymous-blogger-claims-proof-of-concept-mac-worm
We plan to discuss this live tonight on the Tech Pulse podcast, if you want to listen in -- just go to talkshoe.com around 8 PM Pacific and look for Tech Pulse, or subscribe to the podcast via http://www.techpulsepodcast.com
Are you stupid?
OS X obviously has superior coding.
The market share is like an extra mile in thwarting security problems.
Unix like OSes will always be more secure than the spaghetti code that is Windows.
As long as this guy doesn't release his vulnerability findings to the general public or known virus creators, it's not a big deal. I expect he'll tell Apple, who will pay him money and solve the problem, and the majority of users will never know the difference.
Boloney.
1. Your claim that OS X is a smaller target holds no validity. OS X is about 4% of the market, so by that theory, OS X should have 4% of the viruses. It doesn't. Why not? Because it's very difficult, if not impossible, to program one.
2. There are hobbyists programming deadly viruses for Windows that can easily corrupt the entire system. The only challenge presented when programming a piece of malware for the PC is figuring out a clever enough way to get it to someone.
3. Things like this have been accomplished a lot. People will program a so-called worm (or virus, or trojan, etc etc etc) for Mac OS X. BUT IT DOESN'T DO ANYTHING HARMFUL! It doesn't test the security of OS X at all! It's just about as accurate as trying to grate cheese on a Mac Pro, and if it grates, claiming that proves an OS X security vulnerability.
PCs (XP or Vista) are pretty safe, if you do not do stupid stuff like surfing the net or sticking thumb drives in your usb slots. Better yet they are even more safe if you just don't turn them on.
After the blogger has been outed, he packed up and deleted his blog :P
>"Outting the InfoSecSellout?
Today I was minding my own business in a chatroom that I monitor when somebody posted something about infosecsellout. Normally I ignore anything pertaining to infosecsellout due to an unprofessional and childish comment posted about Alan Shimel. But this time I had to pay attention. This time somebody pointed a finger at who is behind the content posted on the infosecsellout blog site. The finger was pointed at LMH and the Phrack High Council (PHC) (yes, the link is broken but you can check out what it looked like here)."
http://www.cutawaysecurity.com/blog/archives/167
So now what happened to the worm if it ever existed?
OpenBSD is arguably the more secure operating system available publicly. The argument that if OSX market share = M$ marketshare that it would be less secure is a faulty argument. Would it be a bigger target? sure. Would more vulnerabilities be found and exploits written to automate those vulnerabilities? likely. Would the mere act of market share increase the number of lines of weak code? no. Hacking, in this context, is dependent upon weak code. M$ let XP hit the market with 16million + lines of buggy code that did not undergo security review. The fundamental lack of dilligence to demand input validation and expose yourself to buffer overflows, combined with a failure to lock down arbitrary execution of programs by unvalidate processes is what make XP such a buggy, weak piece of crap. I am no machead, linux zealot, or any other os jesuit. I am a security professional and these facts support themselves when properly examined.