Skip to main content

News

Thu, 01 Nov 2007 Puper Mac malware 'not a drill' McAfee warns

Mac users get second warning over nasty DNS-affecting Trojan Horse

Jonny Evans

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

Hot on the heels of Intego's declaration of a Trojan Horse exploit affecting Macs comes similar news from McAfee Avert Labs.

McAfee Avert Labs has discovered that the malware family called Puper, which has been plaguing Windows users, is now targeting Mac users. 

Question of the day!

Mark Hattersley
Editor in Chief

Do you share your creations online?

Question of the day!

Do you share your creations online?

% of Macworld readers agree with you

Yes
TBC
No
TBC

What do you create and how do you share it?

124 characters remaining

Follow the conversation at @TabletChat

paintings & illustrations, mostly, which i upload to flickr.RT @fragmentedm

I draw manga/anime characters. I also do graphic design and photography.RT @spialelo

Yes. I usually put them up on my #deviantart account for feedback on how to improve.RT @spialelo

The description of the exploit - which is given on the blog of virus researcher Allysa Myers - sounds remarkably similar to that of the Trojan Horse announced (and named) last night by Intego.

Mac users are being directed to fake codec websites which host malware that changes the settings on their server, warns McAfee.

"This means that when they attempt to visit a website, the malware is able to re-direct them to another website in the background which could be a phishing site."

The Puper malware family has been "plaguing" Windows users since 2005, McAfee warns. It is the same bug that has recently been reported as installing itself from infected MySpace pages.

At present the malware is surfacing on pornographic websites. Like the Intego bug, McAfee warns that users are led to sites which say they must install a new codec to view the videos they offer.

When the newest Puper fake codec site is accessed by a Mac, the file which is offered is a .DMG file rather than the usual .EXE file one would see on Windows.

Depending on your browser settings, this may run automatically. Once it runs, it begins installing an application called MacCodec.

In the background, a script is created which then creates a scheduled task to change the DNS to point to a malicious server. In effect, instead of getting valid entries for websites like you would expect, you’re now getting whatever this malicious site decides to point you to. That could be a phishing site, that could be more malicious files, you can no longer trust that the URL you expected to get will be what is delivered to you.

Avert Labs has identified dozens of different fake codec sites currently serving this Mac malware.

"People have been predicting that as soon as financially motivated malware came to the Mac neighborhood, its denizens could no longer be so smug about security issues. This is a very simple piece of malware, and yet it works. Time will tell if this family will wreak as much havoc as it has on Windows," warns Myers.

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Latest News


More news...