New Trojan Horse targets Mac users
By Jim Dalrymple
Security research company Intego on Monday issued a security alert
about a new Trojan Horse called OSX.RSPlug.A that specifically
targets Mac users. The Trojan is a form of DNSChanger that changes
the Mac’s Domain Name Server (DNS) address.
According to Intego, the Trojan has been found on several
pornographic Web sites. When trying to view a movie, the user is
told that “Quicktime Player is unable to play movie file. Please
click here to download new version of codec.”
When the user clicks the link a disk image (.dmg) is downloaded to
the desktop. When the user installs the software, they are actually
installing the Trojan, not a free video codec. The Trojan is
installed with full root privileges, which means it has access to
all files and commands on the system.
When the malicious DNS server is active, it hijacks some web
requests, leading users to phishing web sites (for sites such as
Ebay, PayPal and some banks) or to web pages displaying ads for
other pornographic web sites, according to Intego.
The Trojan also installs a root crontab which checks every minute
to ensure that its DNS server is still active, the company said.
Since changing a network location could change the DNS server, this
cron job ensures that, in such a case, the malicious DNS server
remains the active server.
Intego says that using Mac OS X 10.4, there is no way to see the
changed DNS server in the operating system’s interface. Under Mac
OS X 10.5, this can be seen in the Advanced Network preferences;
the added DNS servers are dimmed, and cannot be removed
manually.
Intego has updated its virus definitions to remove the malicious
code and prevent it from being installed.