Mac Software Detected With Spyware

Intego, the security provider of Mac OS X, warns users of a Mac contort on a Windows spyware software which forwards potentially confidential data to external servers.

Intego stated in a press release that several screen savers and applications distributed via sites including VersionTracker, Softpedia and MacUpdate are detected downloading something more than the software that users negotiate for.

In addition to this, Apple's Mac OS X Download website also included entries from some of these applications; however, the download web links now seem inactive. The spyware that has caused the problem is "OSX/OpinionSpy", which is a Windows spyware variant that has been in scene since 2008.

As far as operation of the spyware is concerned, it supposedly tricks users into revealing their admin passwords claiming that it will install "market research" software to collect browsing and purchasing habits.

Then OSX/OpinionSpy installs "PremierOpinion" which executes as root. According to Intego, the spyware, after this, opens HTTP backdoor on port 8254, scans all the accessible networked and local volumes, and finally injects malicious code into Firefox, Safari and iChat in the memory, which means that it doesn't alter the applications.

The spyware regularly sends out encrypted information to different servers, which includes iChat message headers, e-mail addresses, and URLs along with potentially personal information like passwords, usernames, bookmarks, credit card numbers as well as browsing habits.

Interestingly, the spyware can be upgraded automatically so as to include new features even without the user's knowledge. On certain occasions, it also asks for the name of the user, or persuades him to fill a survey through a dialog box. In some of the cases, the infected system fails to work properly, forcing the user to go for a reboot.

Intego notes that the spyware won't get removed even if the user gets rid of the original application. Thus, the user should be extremely cautious while installing any software from an unknown source.

Finally, according to security experts, with the growing popularity of Mac platform, such malware are expected to spread more widely.

Related article: Mac OS X Devoid of Malware, Vexing Experts

» SPAMfighter News - 6/10/2010