May 17, 2013 - 04:00 PM EDT — AAPL: 433.26 (-1.318, -0.3%) | NASDAQ: 3462.61 (+23.82, +0.69%)

Apple silently updates OS X to protect against SMS trojan

Thursday, December 13, 2012 · 4:36 pm · 18 Comments

“Apple has silently updated malware definitions in OS X to block a trojan discovered on the Internet earlier this week,” MacNN reports.

“Known as Trojan.SMSSend.3666, the code comes disguised as an installer for various apps,” MacNN reports. “Opening the installer prompts people to ‘activate’ their software by SMS, entering a key into the installer after receiving an initial text.”

MacNN reports, “The reality is that the trojan is signing users up for a subscription service that charges them via their cellphone bill.”

More info and links in the full article here.

[Thanks to MacDailyNews Reader "Lynn Weiler" for the heads up.]

Categories: News, Software Update

Tags: OS X, security, SMSSend Trojan, SMSSend.3666, software update, trojan, Trojan.SMSSend.3666

Thank You for supporting MacDailyNews!

 Apple 13.3" MacBook Air dual-core Intel Core i7 2.0GHz, 8GB RAM, 512GB Flash Storage, Intel HD Graphics 4000, Mac OS X Lion (Z0ND-20GHZ8GB512) only $2,159.99
 Secret Sale Exclusive for MacMall Valued Customers Only
 Apple 15.4" MacBook Pro (with Retina display) quad-core Intel Core i7 2.3GHz/16GB RAM/256GB FS/IntelHD Graphics4000/OS X Lion (Z0MK-15-2.3-16-256RT) only $2,333.99
 Apple Blowouts: Up to $649 OFF on Last Gen Macs. Prices start at $1,999.99 w/ Free Upgrade to OS X Mountain Lion & Free FedEx Overnight ends 02/08 6:15PM PST.
 Apple 13.3" MacBook Pro dual-core Intel Core i7 2.9GHz, 8GB RAM, 750GB 5400-rpm hard drive, Intel HD Graphics 4000, Ships with Mountain Lion (MD102LL/A) only $1,419.97

Comment Feed

18 Comments

David

Thursday, December 13, 2012 - 4:44 pm · Reply

I only install from the App Store with few exceptions.. You should too.
Chuck

Thursday, December 13, 2012 - 4:52 pm · Reply

But Mac’s don’t get viruses. Oh er…hang on a minute.
- AtlantaX
  
  Thursday, December 13, 2012 - 5:00 pm · Reply
  
  This isn’t a virus is it? You download an installer, run it, it asks you for your cell phone, and you give it. All legit operations. There relly isn’t anything wrong with any of the processes or code other than human error in trusting this installer.
- twilightmoon
  
  Thursday, December 13, 2012 - 5:02 pm · Reply
  
  This is a Trojan horse which is massively different. Trojan horses require user action to do their damage.
  
  Example a knife that you can cut yourself is a Trojan horse. Certainly a potential problem but avoidable with some care. A knife that suddenly and unexpectedly leaps out of the block and flies through the air and stabs you is a virus. A much more serious problem that requires orders of magnitude more effort to deal with and avoid.
  
  Not the same.
  - Arnold Ziffel
    
    Thursday, December 13, 2012 - 9:27 pm · Reply
    
    Like your analogy.
  - Dogadoga
    
    Friday, December 14, 2012 - 9:48 am · Reply
    
    I like your analogy too.
    Similar to that movie title: “Flying Virus, Hidden Trojans”
- Derek Currie
  
  Thursday, December 13, 2012 - 5:09 pm · Reply
  
  The general term is not ‘viruses’. It is malware. Strictly speaking, there are NO actual viruses for OS X. Instead, as of today, there are (depending on your version of OS X) about 24 different malware of OS X malware with a total of about 94 strains. Almost all of them are Trojan horses, requiring social engineering to convince the user to manually install them. The one exception is OSX.Flashback.S which used a whopping huge drive-by web infection security hole in Java to infect ~600,000 Macs this past summer, the worst Mac infection in history.
  
  (BTW: There is a new Java update for Mac, v1.7 Update 10, aka 7u10. If you don’t use Java, don’t install it. If you install Java, turn it OFF unless you’re specifically at a website you trust. Then turn it OFF again. Java is the single most dangerous software you can install on a Mac. AKA java sucks major balls).
  
  I write about Mac security here:
  
  http://Mac-Security.blogspot.com
  - Sucker
    
    Thursday, December 13, 2012 - 11:02 pm · Reply
    
    That was a thoughtful post. What are you doing here? Haven’t you got the memo that only Obama badgers may post here?
    - Piccio
      
      Friday, December 14, 2012 - 8:12 am · Reply
      
      Your response to such a good post seems a little strange, no? Kinda out of left field.
    - Derek Currie
      
      Saturday, December 15, 2012 - 12:47 pm · Reply
      
      Um huh? I’ve been around MDN for at least a decade. I’ve been writing about Mac security since 2007. I enjoy reading and sharing Apple news as well as helping people out with information while also relishing the opportunity to trample ignorant anti-Apple trolls into the dirt.
      
      Meanwhile: MDN is NOT a political website, despite rubbish and PoliTard posts to the contrary. My personal political POV is that of what I call a positive anarchist. I believe in maximum choice while taking maximum responsibility for those choices. My POV does not fit on the usual 1-dimensional political scale.
- payshunz
  
  Thursday, December 13, 2012 - 5:17 pm · Reply
  
  Just die already, troll. So tired of this BS.
- Grigori
  
  Thursday, December 13, 2012 - 6:02 pm · Reply
  
  Good to see (up)Chuck getting schooled.
Derek Currie

Thursday, December 13, 2012 - 4:57 pm · Reply

Apple’s XProtect anti-malware software ‘silently updates’ on a regular basis. Apple is calling this malware ‘OSX.SMSSend.i’. It is recycled Windows malware.

XProtect (aka ‘File Quarantine’) is built into OS X 10.6 Snow Leopard on up. You can check out the plist file for XProtect, which lists all the malware it detects, here:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist

As of yesterday, line 1408 lists OSX.SMSSend.i
Fred

Thursday, December 13, 2012 - 5:19 pm · Reply

A nice service provided by Apple.
- silverhawk1
  
  Thursday, December 13, 2012 - 6:35 pm · Reply
  
  M$ would have charged for that and you would have had to reboot.
  - Really
    
    Thursday, December 13, 2012 - 8:12 pm · Reply
    
    MS offers “Microsoft Security Essentials” for free.
    
    I tested it pretty heavily for a small company a year ago and was impressed with its detection capabilities.
    - rockfixer
      
      Friday, December 14, 2012 - 5:04 am · Reply
      
      Yeah, it detects all right, but I believe it is in fact not so much an application, but rather a standard text that is displayed whenever you run it:
      
      “WARNING! the malware “Windows” seems to be installed on your computer. Quit now or all your data may be in danger!”
    - gcaptain5
      
      Friday, December 14, 2012 - 10:13 am · Reply
      
      Microsoft bought a good anti-malware program, and they managed to not completely screw it up in the couple of years its been under Microsoft’s stewardship. Given how incredibly low Microsoft has set the bar for security on their platforms, it’s really impressive – truly Microsoft at its least incompetent.
      
      OS X and iOS security, however, is still in a whole other league.