"Posted 04/08/2004 @ 3:24 PM, by Eric Bangeman







Virus and Trojan horses are old hat, at least if you run Windows as your primary OS. For years, Mac users have enjoyed the relative obscurity of a low market share, which meant that aside from the occasional Mac OS 8/9 boot worm, malware writers generally overlooked the platform to concentrate on tormenting the largest amount of users with the least amount of effort. Alas, a modern OS and the platform's increased visibility could only be overlooked for so long, and French Mac security firm Intego today announced the sighting of an overly-user-friendly Trojan Horse for OS X.

The Trojan horse's code is encapsulated in the ID3 tag of an MP3 (digital music) file. This code is in reality a hidden application that can run on any Macintosh computer running Mac OS X. Mac OS X displays the icon of the MP3 file, with an .mp3 extension, rather than showing the file as an application, leading users to believe that they can double-click the file to listen to it. But double clicking the file launches the hidden code, which can damage or delete files on computers running Mac OS X, then [launches] iTunes to play the music contained in the file, to make users think that it is really an MP3 file.

This particular Trojan horse has the potential to do all the typical nasty stuff such as deleting files, infecting other media files (i.e., QuickTime, MP3, JPEG), and propagating itself via e-mail. According to Intego, initial versions of the Trojan are benign, but now that this exploit is widely-known, it is likely that this exploit will be adopted by virus and Trojan horse authors. Intego has made updated virus definitions available, and McAfee (makes of Virex) will likely follow. "
Full article at
http://arstechnica.com/news/posts/1081455881.html