MacDailyNews - Where Mac news comes first

i've enabled bonjour.......

Yawn. Will this "story" ever end.

It’s less harmful than the Symantec AntiVirus Trojan rootkit/backdoor malware!

I once shot a man in Reno . . .

just to watch him die.

AAAAAGGGHHHHHHH, their coming, duck and cover!.. DUCK AND COVERRRRR!!!!!!!

*sarcasm (incase you didnt notice)

Not to YORK it, but I don't think enabling Bonjour in iChat should be considered "uncommon". On a local office network, it is a totally legit way of discovering inneroffice computers.

Now wait. Using iChat - this thing comes out of nowhere? is it a link in the current chat window? The iChat user thinks it is from the other party? That is certainly someone to be trusted. And when it is clicked it asks for Admin password to install? I can think of about 4 people that I iChat with that think the file is from me and go ahead and enter the admin password.-
This social malware should not be taken lightly - the more MacOSX users think they are invulnerable the more they become vulnerable. "When u least expect it - expect it" kind of thinig.

No - is not a virus - Yes is a concern if it is this simple.

"Welcome to Wal-mart, would you like a cart?"

Hurray! for Ars Technica!!

But it is a problem, because now others will use this exploit.

So just to make sure your not tricked, use this small program to lock your inputmanager folder

http://www.springboardsoftware.com/

-> to me: yes, iChat is a legit way to share office files... but face it, offices that employ iChat in their workflow ARE "uncommon."

-> to kerrazyjoe: it doesn't come out of nowhere--it doesn't come at all! it can't transmit over the internet! you say you chat with people who would trust you. how many of them are on your LAN? how many of them are on the same subnet (like the same dorm on a campus)? even if you caught the virus (which you can't), you couldn't spread it to those people if they're not on your same LAN and subnet.

But say you're on an infected LAN (of which the world contains zero) AND a bunch of other conditions are met (it's NOT simple) then it could arrive and look like it's from a friend. but there's all kinds of warning. Your friend sends you a chat request with a file... but doesn't answer back when you try to chat? that's suspicious. it's not a link, it's a special window offering a file. then you've got to go through steps uncompressing and clicking to install the thing. and if you do, what harm is done? probably none at all. but if anything bad results, it's just a few apps failing to launch--and you can easily fix that.

it's not simple to get this virus. it is, essentially, impossible.

At least ARS got it right. Too bad the majority of the Windows-loving media world didn't.

Amazing what reality prevails when people who KNOW the technical side of things write about them instead of these hack 'journalists' who probably held a previous position of covering dog shows or local rock bands.

Might as well treat this dialog as a support forum - I am nervous not for my sake - for the sake of all those people who I have converted to MacOSX and who will click things without discern.

It seems like first you have to download this thing from somewhere. It does not popup on an iChat. You download it from a click on a Website perhaps. Warning! is a Program YES - Warning! needs admin password. OK now it is here. Now it spreads via Bonjour.

OK this wont happen in my environment or my friends - OK.

But these things that are disguised as one thing and actually are another - wow - those are hard to defend.

Also note another reason it's not a virus, in particular it's supposed reproduction. It doesn't reproduce like a virus. Leap-A merely advertises itself. That's it. That's all. Just because you read a BMW ad in a magazine doesn't mean that BMW will be in your garage the next time you look.

At worst, it's SPIM (instant messaging spam). It doesn't get transmitted to another computer until the user accepts it, hence it's also not self-transmitting, only self-advertising: "please accept me".

Admittedly, the so-called email viruses that you have to click hyperlinks are also just advertisements, hence trojan horse emails (says it's one thing when it's really another). Even the emails with attachments are practically mere advertisements (like AOL discs in the snail-mail) because you still have to open the attachments, otherwise nothing happens.

A long time ago, circa 2000, Microsoft's Outlook email program would automatically open any attachment, including programs that were attached, e.g. viruses. Nowadays, it's practically unheard of for an email program to open an attachment that is a program. Usually it's just images or PDFs. So, effective email viruses don't really exist anymore.

Also admittedly, a lot of the so-called viruses for Microsoft's Windows OSes are mostly trojan horse types. Although, it seems to be the actual self-replicating and self-transimitting viruses that get attention on that side of the computing spectrum. So it's probably more accurate to refer to almost 100,000 malware instead of 100,000 viruses. Besides, the variety suggested by malware is much more impressive.

It's quite telling to have a simple trojan horse type (i.e. merely self advertising as SPIM, hence neither self-replicating nor self-transmitting without user interaction) get so much attention on the Mac side. Not to mention most of the attention is given by people who have not been affected by it (since nobody's been affected except for intentional guinea pigs), and most of those people aren't even using an Apple computer. In contrast, the difference in attention is quite weird.

And keep in mind this isn't the first. The first bit of malware for Mac OS X occurred a few years ago, followed by a couple more bits of malware soon after. Interesting most people don't mention that, since that tells a lot about those people's lack of experience with Mac OS X, lack of research, and excess of overreaction.

Another interesting question: Where does this thing came from in the first place?

I mean: With some really malevolous viri the FBI catched the guy and put him in jail. This Leap-A or whatever the name may be a proof-of-concept but, Who did it? Was this thing created by a hacker or by an anti-virus company so they can raise their MacOS X division sales of anti-virus?

And, if this is a proof-of-concept then somebody is trying to develop a virus for the Mac OS X or what?

MW TRUE

Why would anybody imagine that somebody in the same office would go to the trouble of compressing a graphics file to pass it on to you ? Apart from any other consideration, jpg files are already compressed, so don't compress well.

I'd be very suspicious of anything that came to me in that manner.

This entire story gets more feeble the more you think about it.

"But it is a problem, because now others will use this exploit."

MacDude, I'm not sure it's much of an exploit, but if you want a no software solution, just use Mac OS X's folder actions as per this hint on The Mac Observer:

http://www.macobserver.com/tip/2006/02/19.1.shtml

The hint has a popup warn you when anything is added to the folder in question, with the option to show you exactly what file got added. It's one of the default folder actions in Mac OS X and can be enabled for ANY folder you feel is a risk.

$ophos and $ymantec need malware "... like a preacher needs pain"

Rock on U2!

I knew a guy once that turned off his Mac, inserted a system disc and restarted his machine holding down the "C" key. when he went through a couple of screens and asked if he wanted to reformat his HD, he clicked ok. This type of action is about 99% more malicious than the Leap-A 'thingy' and you don't even need to write any code!

I think I'll start burning copies of my "disk utils" disc and mail out randomly to people I hope may be using the Mac OS. I think If I send out 20 I'll be way more successful than Leap-A .

yes this was painful you to read & for me to write, but it's very good in comparison to what else is being said in the mainstream media...

by turning off my Firewall and leaving my Mac on the Internet for 3 days straight with the default settings and no patches installed (Tiger--the first DVD that shipped).

Try THAT on Windows. Please, try it. In 30 seconds you'll regret it--it won't take 3 days.

Not a good idea for anyone, but my Mac is fine. Should I go for 4? (No--not now that I have spilled the beans!)

Oh, and yes I backed up first. You should do that often even if you never use the Internet--hard disks do fail.

Andy C.

Thanks for the link....GREAT info!

MacOS X is completely secure

Oops. MDN's wonderful html linking system stripped the search criteria. Cut and paste http://www.osvdb.org/searchdb.php?vendor=apple into Safari.

... the point being, if you're smug about MacOS security then you're vulnerable. MacOS (like any OS) is full of flaws awaiting exploitation.

>> Try THAT on Windows. Please, try it. In 30 seconds you'll regret it--it won't take 3 days.

Well, actually, for many people using broadband, they'd be completely safe too. You see, many routers use NAT which essentially hides all your local machines from the Internet unless you explicitly route connections through to ports of interest. I've left an unpatched Windows machine always-on for several weeks behind a NAT router, and never seen a single attack.

B O L L O C K S Reality Check. Because theory is one thing. Real world experience quite another. You live in the theoretical world obviously, I live in the real world. 99% of the articles that have spoken about this have been trying to make the theoretical into the real. Granted that this software was 'real', but it was such a microscopic, irrelevent blip that I put it firmly into the category of the theoretical...

I think you can go back to sleep now.

The sky is falling... the sky is falling...

I'm SO SICK of these people

I've noticed a distinct lack of smug Windows a$$holes in this thread. You know, the "Admit it, Mac-heads, Leap-A is a virus!" types? I guess they've slunk back into the shadows, their fantasy smashed.