[OK, last post on the generalities of viruses, etc. in this thread. -Adam]
On 6/22/05 06:53, "Google Kreme" <gkreme
gmail.com> wrote:
>>
http://securityresponse.symantec.com/avcenter/venc/data/
>> macos.mw2004.trojan.html
>
> This is not a virus at all, it is a trojan, an application which is
> clearly an application to all but the most casual inspection (it has
> a custom icon, but it is an executable file and shows up as such).
> This is equivalent to having a .exe on Windows in default
> configuration where it doesn't show the extension. Ant no anti-virus
> will protect you from this type of 'attack' even if it can alert you
> to one specific application, after the fact.
Actually, yes it can. The malware code is going to have a farily distinctive
binary signature that is identifiable, and from there, can be dealt with in
a number of ways. It's not like AV software looks for names like
"iamanevelvirus.app"
> So, if you are a total moron and intentionally set your machine up to
> allow anything to access it at any time, then this so-called 'virus'
> can install itself. Otherwise, it can't. And even if it installs
> itself, it can't spread. At all. In an OS X default configuration,
> in fact, this is a non-starter. Add to that that even if you ARE a
> moron and open up your machine to anything and everyone, you STILL
> have to manually install this. It can't install itself. It can't
> spread itself. It's a piece of social-engineering that relies on
> stupidity, and nothing can prevent stupidity.
It reilies on two things:
1) In OS X pre 10.4, the /Library/StartupItems folder doesn't exist, so only
requires an administrator - level, (NOT root) access to create a startup
item that runs AS root. Note that pre-Tiger, the code in
/Library/StartupItems doesn't have to be owned by root to run as root. So if
you are a non-technical user, (none of those in the Mac world), running on a
default setup, (first user created has administrator privileges) and not
running Mac OS X 10.4, you can get thoroughly rooted and never see an
authentication dialog. Not that an authentication dialog is any protection
because....
2) Pretty much any OS X user, regardless of reason or source, will, when
requested, enter in administrator credentials without a second thought.
They've been trained by Apple and a host of other installers to do that.
"Installing software requires administrator credentials". It's trivial to
fake an authentication dialog, and get a nice set of administrator
credentials. At that point, you own the box.
>
>> 2) Many OS9 viruses run just fine in emulation, where they happily
>> inflict their damage.
>
> There are not "many" OS 9 Viruses, so this statement is flat-out
> false. As far as I know, the only viruses that operate at ALL under
> OS 9 are Microsoft Macro viruses. None of the OS 7 era viruses will
> operate under Classic, or under OS 9, with the possible exception of
> the "auto-start worm", but I can't find details on that.
The QT autostart worm relied on QuickTime and was OS independent.
> These statements have equal validity. You can ignore the body of
> evidence, or you can not. If you don't ignore it, the only logical
> conclusion is that OS X is not susceptible to viruses.
>
> Until there is a proven in-the-wild virus that can spread infection
> from machine to machine it is correct to say that OS X is immune.
>
> Yes, there may at some point in the future be some extremely limited
> cases where viruses might affect some tiny fraction of installed OS X
> machines, but most OS X machines are insanely secure. And even this
> remote possibility has little more probability of occurring than the
> Vogon Constructor Fleet showing up this Thursday.
This is the hair-splitting argument I love from geeks. "If it doesn't
completely spread and propogate all on its own, it doesn't count." Trojans
are, and always have been a far greater problem than viruses, and they are,
just like "classic" virii, detectable and preventable. But a trojan that
doesn't behave in an obvious manner, just sitting there and collecting data,
running as root, and every so often dumping out a zip file to some haxx0r
site is going to cause you just as much damage as a classic virii ala Witty
or Michelangelo.
If this data includes personal data, and when the auditors come asking why
you were so vulnerable, saying "That's a trojan, not a virus, so I don't
need AV software or precautions of any kind outside of login security" is
NOT going to be the defense you want to use.
> (And please note, an exploit is not a virus unless the exploit can be
> spread from machine to machine, automatically.)
So you're saying that nothing but virii count, and that trojan propagation
is completely, 100% due to stupidty, and therefore, nothing can ever be done
about it, so we should either throw up our hands, or never install anything
that we can't first review the source on.
Splitting malware hairs like this helps no one, and is remarkably
short-sighted, especially in a business environment.
> And this ignores the key fact that is so often ignored about anti-
> virus software and which makes running it on a a Mac truly silly:
>
> Anti-Virus software is REACTIVE.
>
> That is, it can't do anything about a virus it's never seen, and
> since it's never seen an OS X virus, it can't protect you AT ALL from
> any potential mythical OS X virus that may come down the line,
> however unlikely that is. And since it can't protect you, it seems
> like a waste of perfectly good money to pay some FUD spreading
> markedroids money for software that does nothing but possibly help
> out the 95% of people out there who run an inferior OS riddled with
> tens of thousands of viruses, exploits, root kits, and trojans.
That's not correct. While AV software is most effective at preventing
attacks it knows about, it's quite capable of detecting virus - like
behavior, such as modifying files in /etc, /var, adding startup items, and
dealing with them in a user-configurable way so as to prevent problems. The
most common way is to quarantine the new/modified files and notify the user
or administrator that it's done so. The configuration can be tricky, but to
say that AV software is utterly useless unless it has the proper malware
signature is simply wrong.
joh
--
John C. Welch Writer/Analyst
Bynkii.com Mac and other opinions
jwelch
bynkii.com
![[F]](/Images/i7/site.gif){kind=small}
TidBITS 
TidBITS 