Member Avatar for The Dude


Two pieces of malicious software affecting Apple's Mac OS X appeared this week: a Trojan horse with the ability to download and install malicious code of an attacker's choice, and a hacker tool for creating backdoors, according to security vendors. [more]

Its sad that Macs arent even safe anymore........

  • 3 Contributors
  • 3 Replies
  • 211 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

Quick clarification and context: the 2008 coverage was actually about two different things — a DNS-changing Trojan (variants commonly called RSPlug/DNSChanger) that was pushed as a “missing codec” and rewrote DNS so victims were redirected, and a separate hacker toolkit (often called Lamzev / TrojanKit / Malex) that’s a utility for building backdoors rather than a mass‑spreading worm. RSPlug-style trojans were the real user‑facing threat; Lamzev required local access or an attacker to trick a user into running an infected app. (protectmac.com)

Why that matters now: many Mac incidents of that era relied on social engineering — users running an installer or launching a disguised app — rather than a silent OS exploit. Apple has since added layered protections (Gatekeeper, notarization, XProtect/MRT and runtime checks) to reduce these vectors, but social engineering still gets people to bypass those checks. Basic hygiene is the effective first line of defense. (tenable.com)

Practical checks and immediate steps (can be done from Terminal / System Settings): if a machine looks compromised, disconnect it from the network and check for altered DNS and persistent launch items. Useful commands and places to inspect:

scutil --dns
networksetup -getdnsservers "Wi-Fi"
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Also review Login Items (Users & Groups), open Activity Monitor for unfamiliar processes, and look for odd files inside app bundles (ApplicationName.app/Contents/MacOS). If there’s evidence of malware, run a reputable Mac removal tool and follow published removal guidance; consider reinstalling from a known-good backup if you can’t confidently remove it. (ithy.com)

Bottom line for readers here: was correct that social engineering and privilege prompts were the main vectors, and ’s caution about avoiding unknown “plugins” is exactly the right habit. The threat is real only when users run untrusted installers — vigilance, updates, and using a non‑admin daily account make Mac infections far less likely. ’s point about user behaviour applies across platforms.

Recommended Answers

All 3 Replies

Member Avatar for John A

Macs are actually very safe; it's the users that are dumb. This is actually old news for the most part, a Trojan that's already been around for a year now has just been upgraded to version 2.0. You still need to be surfing porn sites to even find the Trojan in the first place, you still need to download and install a program that claims to be a media player plugin from some random site, and most of all, you still need to enter the administrator username and password before the Trojan can do anything.

This isn't much of an achievement for the malware author; I could write a similar one for a Linux system, but of course the press wouldn't take any interest because it's not targeting the operating system that's been hailed as immune from malware (which is, of course, impossible for any usable OS).

I'm pretty sure that no other operating system has as much malware available for it than Windows XP, which can be almost entirely attributed to the way that permissions are handled on it. Vista, OS X, and the other *nix's have much more sophisticated permissions, making it far more difficult to write malware that can compromise an entire system (at least, not without the administrator's password).

Member Avatar for The Dude

Ah thank you for that John,

Yes all things like this are avoidable....

Some people when they get that "Plugin" request they just install (They dont know)

Sometimes i get those and i just check the script and extract the media link and watch it that way.... (The plug in isnt needed but most ppl dont know that)

Member Avatar for jbennet

Macs are actually very safe; it's the users that are dumb

same for windows

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.