Security company Intego has discovered new OS X backdoor trojan malware, dubbed Pintsized, that bypasses Gatekeeper to infect Macs and can help attackers get past firewalls by initiating an encrypted reverse-shell connection.
"This threat likely starts with an exploit to get it past Gatekeeper," reports Intego, referring to the security feature launched with OS X 10.7 Lion that aims to prevent users from installing malware by implementing a digital signature system.
"Once on a system, it sets up a reverse shell," Intego continues. "That is to say, rather than announcing to the controller that the machine is infected, the controller periodically contacts the infected machine to perform commands/ Initiating the contact from outside the affected machine potentially helps get past firewalls."
The threat can be difficult to spot, however. Intego explains that the connection is hidden among a file that is usually used for printing, and also erases all command histories to they cannot be tracked. Thankfully, though, the attacker also uses clear text Perl scripts that can be easily discovered by those who know what to look for.
The reported filenames that Intego has seen the malware generate are as follows:
- com.apple.cocoa.plist
- cupsd (Mach-O binary)
- com.apple.cupsd.plist
- com.apple.cups.plist
- com.apple.env.plist
At present, Pintsized doesn't appear to be a widespread threat, and Intego believes that this may have been a targeted attack. Nevertheless, Intego said that, as of 19 February, its VirusBarrier anti-virus software was able to detect Pintsized, but that XProtect is unable to protect against the threat at the time of writing.
See also:
Less than half of Mac owners have anti-virus software installed
Apple releases Java update and malware removal tool following cyber attack
New Mac Malware charging user's mobile accounts
Contact Us
Digg
It's easy and free to get the latest news headlines, reviews and opinions straight to your email inbox. Sign up NOW to make sure you receive the latest Mac news, reviews and tutorials on your favourite topics.
Comments received
stefn said on Thu, 21 Feb 2013
Virus? Virus! A trojan exploit is malware. But it is not a virus. Brush up your Shakespeare.
stefn said on Thu, 21 Feb 2013
BYW, the scorecard on real, genuine viruses is over 100,000 on Windows, 0 on Macs.
jcgarcia4567 said on Thu, 21 Feb 2013
Pintsized hasn't been seen in the wild yet, according to security software maker Intego, since the malware looks to still be in a proof of concept stage.
Therefore it hasn't even been proven to work in the wild, only discovered that someone's trying!
Fear mongering, can you guys do a little research and post the WHOLE STORY? And you call yourselves mac world, get real.
Disclaimer
Opinions expressed here are those of the writers and do not reflect those of Macworld. Macworld accepts no responsibility legal or otherwise for their accuracy of content.
Click here to read the house rules.
Click here for the latest reader comments