DNS Changer 2.0e Trojan Horse

SecureMac Advisory

Posted: March 17th, 2009

Security Risk: Critical

Just after the DNSChanger 2.0d variant was identified, another new variant of the DNSChanger Trojan Horse, DNSChanger 2.0e, has been discovered in the wild. The trojan horse arrives in a disk image (some samples are called serial_Avid.Xpress.Pro.5.7.2.dmg), and is again disguised as an installer for “MacCinema,” just like the 2.0d variant. Once installed, the trojan horse behaves in a similar manner to past variants.

This variant is being distributed on websites offering “cracked” or pirated copies of software, and is initially disguised as a serial …

Security Alert: Trojan found in Pirated copies of Apple’s iWorks 09

Security Alert: A trojan is being distributed with pirated copies of Apple’s iWorks 09.

Pirated copies of iWorks 09 are being distributed with a trojan bundled in the installer package. Intego has released a warning recommending that users should not download iWorks 09 from pirate software sites.

The malicious software is installed in the startup items folders ( /System/Library/StartupItems/iWorkServices ) where it has full root privilege rights. Once installed the trojan connects to a remote server notifying it of the infected computers location on the net awaiting further instruction including the ability …

DNS Changer Trojan Horse – SecureMac Removal Instructions and Anniversary...

SecureMac Security Bulletin

Posted: December 17th, 2008

Security Risk: Critical

Halloween marked the one-year anniversary since the DNSChanger Trojan Horse was discovered in the wild, and in that time it has grown to become the single most widespread piece of malware on OS X. In order to promote safe web browsing, SecureMac has issued a bulletin on the DNSChanger Trojan Horse, with information on common symptoms of infection, ways to check for and remove the Trojan, and a list of safe practices when surfing the web.

Symptoms of Infection by DNSChanger Trojan Horse

    Website …

SecureMac to exhibit at MacWorld San Fransisco 2009

Las Vegas, Nevada – SecureMac.com, an information security company known for its cutting edge security solutions and security website for Apple Macintosh computers, is pleased to announce it will be attending MacWorld Expo at the Moscone Center in San Fransisco from January 6-9, where it will be demonstrating the latest version of MacScan and answering security questions.

SecureMac will be showcasing its security software, as well as providing product discounts, booth raffles and security demonstrations at Booth 202 in the South Hall from January 6-9, at the Moscone Center, San Fransisco.

Clients …

AppleScript.THT Trojan Horse – Mac OS X

New OS X Trojan Horse in the WildSecureMac Security Advisory

Security Risk: Critical

SecureMac has discovered multiple variants of a new Trojan horse in the wild that affects Mac OS X 10.4 and 10.5. The Trojan horse is currently being distributed from a hacker website, where discussion has taken place on distributing the Trojan horse through iChat and Limewire. The source code for the Trojan horse has been distributed, indicating an increased probability of future variants of the Trojan horse.

The Trojan horse runs hidden on the system, and allows a malicious user …

Intego Virus Barrier Virus Definition Bypass Exploit

Advisory Title: Intego VirusBarrier X4 definition bypass exploit
Release Date: 2006 November 8
Affected Products: Intego VirusBarrier X4
Severity: Moderate
Where: Local System
Author: Kevin Finisterre

Fix: Bug Fixed Starting with 2006/11/01 Vdef files
Exploit: pwntego.tar.gz

Kevin Finisterre, a security researcher with digitalmunition.com has discovered and demonstrated a flaw in Intego VirusBarrier X4, an antivirus program for Macintosh computers. The “pwntego” exploit show how systems running Intego VirusBarrier X4 can lose their protection. Kevin discovered that the program suffered from a flaw related to the number of alerts it can process simultaneously.

Kevin saw that if an attacker is …

Mac OS X URI Handler Security Issues & Exploits

Recently, Mac OS X has been known to be vulnerable to many new remote exploits.

Theses exploits are allowing to remotely execute code on your computer when you surf a webpage. Most of the people reading about theses vulnerabilities often missunderstand or apprehend the impact it can have, for a user.

While many people will use Paranoid Android, from Unsanity, and it does protects you well, many don’t even know about the vulnerability in the first place. Theses can lead to the total erasement of your personal data (by erasing /Users/you), to …

Mac OS X Trojans and Security Threats

Mac OS X is UNIX at the core this is very true as described in Apple’s print advertisement, besides sending all others to /dev/null this OS is also open to all the security issues behind the UNIX environment.

Many features that are offered in the UNIX enviornment can lead to security concerns. They’re not to be considered bugs or exploits, just features. Recently Max Grosse shared with SecureMac.com how a feature in sudo could be used to the advantage of hackers to create backdoors or execute malicius code.

The code Max created …

Mac OS X – Nimda spreads via Mac OS X Samba Service

Stuffing Mac OS and Mac OS X with Nimda Worm

Nimda fills the Macintosh with .eml files if File Sharing is enabled.
Includes Samba.

WW32/Nimda@mm
PE_NIMDA.A
I-Worm.Nimda
W32/Nimda-A
Win32.Nimda.A

W32.Nimda.A@mm, simply known as Nimda is a mass-mailing worm/virus that spread itself via multiple methods. Nimda will send itself out by email and will search for network shares that are open and try to copy itself to vulnerable/unpatched Microsoft IIS web servers and other network connections (Samba/File Sharing).

Nimda is a Windows worm/virus. However, if your Macintosh is connected to the internet or network with File Sharing methods enabled you …

AIM Password Stealing, My AIM Password is incorrect. AIMThief 5.2 for Macintosh

published: 08.31.2001
remote: Yes
updated: yes
vulnerable: all aim accounts under 10 characters

The security issue was addressed by AOL and to this date does not remain a concern.

Information

Has your AOL Instant Messenger (AIM) account password come up as invalid and you are sure that you entered it correctly? Figure that your account was hijacked by someone using the program AIMThief 5.2 for the Macintosh.

Hackers found a hole in the protocol used by AIM that lets them remotely change any users passwords if the user name is 10 characters of less.

After the AIM account …

Monitorer – Macintosh KeyStroke Key Logger Log Keystrokes

Information

Monitorer is a extension to record keystrokes as they are typed. Monitorer records everything you type with your keyboard and saves it. That can be very useful if you just wrote a very long text and your computer crashes. After restarting you will find the saved log-file in your preferences folder where you can copy your lost text! This application can also be used to check if any unauthorized person used your computer or you use it to view what your employees “produced” the whole day.

However Keystroke loggers were originally …

TypeRecorder – Keystroke Logger Review + Information to make secret

Information

Keystroke loggers are common amongst hackers all around the world. Keystroke loggers do exactly what it says, it is a small program that logs to a file everything that you type and the person who installed the logger can retrieve the log whenever he/she wants. Hackers use the software to gain information like logins/passwords or any other useful data.

TypeRecorder 1.5 is a shareware control panel created by Rampell Software. The software itself is marketed as a tool that would be useful in the case your system crashes, power outages or …