Intego Finds Proof-of-concept OSX/Tored.A

According to a security firm Intego, it has found a recently created proof-of-concept exploit code called OSX/Tored.A. The code was originally unearthed on April 22, 2009.

It (the exploit code) is presently regarded as 'very low' in risk and is written in RealBasic, a BASIC programming language that runs on Windows, Linux and Mac OS X. It means that for the execution of OSX/Tored.A, BASIC programming language is a must.

Explaining the process in which the code propagates itself, Intego said the malware tries to create its duplicate copies on the System/Library/StartupItems folder as well as the general System folder and gives them new names such as 'systemupdate' or 'applesystem.' Security researchers also state that these new names are given so that the malware may evade detection.

Moreover, the exploit code potentially infects many computers in a chain when an e-mail embedded with the code comes into one of them. As the code copies every address it finds in the contact list of the particular computer and subsequently e-mails itself to all those addresses, it results in the chain of system infections. In this way, the malware can also create a botnet.

An example of e-mail that the malware sends has the caption, which primarily says that the message is for Mac users and if the recipient is not one, then he may please forward it to one who is.

Furthermore, the exploit code even intercepts keystrokes, and tries to make its copies on other disks by spreading through detachable drives such as USB sticks or CDs. In this case too, the malware moves from one infected computer to another and so on till a chain of infected systems that use the same USB stick or CD is formed.

Meanwhile, Intego researchers stated the malware's utilization of RealBasic along with its runtime represents the unique approach to proliferate and cause an enormous impact.

Moreover, the increasing number of exploit codes being detected in recent periods indicates how security violators are infringing the privacy and safety of users again and again as they have done with Mac users this time, the researchers noted.

Related article: Indictment On Two Ohio Men For Selling Porn DVDs

» SPAMfighter News - 5/8/2009