Geekery

Another thing I like about the Mac community — there are a lot of very intelligent and creative people in it. Scant days after the proof-of-concept MP3Concept ‘trojan’ caused such a brouhaha in the Mac community, various approaches to dealing with the potential vulnerability are appearing. MacFixIt highlighted two very interesting techniques today.

First, Rick Bargerhuff has created a small AppleScript Folder Action that will scan for potential exploits using the MP3Concept technique:

The Folder Action will check any files or folders to see if a file’s name- extension corresponds to the file’s Type and kind. If it does not meet this criteria, the script asks the user if they want to quarantine the file. If the file does not have an extension and the file’s type and kind indicates it is an application, the script acts as if the file did not meet the criteria. If the user chooses to quarantine a file, the script creates a folder named ‘Quarantined’ which is created inside the directory the Folder Action is attached to. More info is available in the read me.

Secondly, Jack Pate suggested the simple approach of restricting application launch privileges to the system’s Applications folder, so that any application (and hence, any trojan) outside of the Applications folder simply won’t be able to launch and potentially wreak havoc with the system.

To nip this while thing in the bud, simply change the “limitations” of all your users to only applications in the Applications folder (and OS9 Apps, if applicable. . . ). It’s is an easy ‘check-box’ setting, and should TOTALLY eliminate the threat, because it would prevent any executable code from being run outside these apps, while still allowing .sit files to open normally and EVEN ‘real’ MP3 files, because it would be launching a qualified app in the approved folder to play it.

Good solutions, both of them, especially when used in tandem.

iTunes: “Keep Yourself Alive” by Queen from the album Queen (1973, 3:46).

One of the (many) nice things about being a Mac user is our general invulnerability to the multitudes of viruses, trojan horses, and other exploits that threaten the ‘net on a regular basis. So it’s no wonder that the Mac world is all a-tizzy over anti-virus company Intego releasing news of what appears to be the first Mac OS X trojan horse, wrapped inside an apparent .mp3 file.

This Trojan horse, MP3Concept (MP3Virus.Gen), exploits a weakness in Mac OS X where applications can appear to be other types of files.

The Trojan horse’s code is encapsulated in the ID3 tag of an MP3 (digital music) file. This code is in reality a hidden application that can run on any Macintosh computer running Mac OS X.

Mac OS X displays the icon of the MP3 file, with an .mp3 extension, rather than showing the file as an application, leading users to believe that they can double-click the file to listen to it. But double clicking the file launches the hidden code, which can damage or delete files on computers running Mac OS X, then iTunes to play the music contained in the file, to make users think that it is really an MP3 file . While the first versions of this Trojan horse that Intego has isolated are benign, this technique opens the door to more serious risks.

As it turns out, there are some mitigating factors to this announcement that Intego either didn’t know about, or deliberately chose to ignore in their press release that haven’t been as widely reported, and really should be.

First off — and most importantly — yes, this should be taken seriously, as it does appear to be a very possible source of attack against OS X.

However.

This does not appear to be evidence of someone actually attempting to release a malicious attack into the wild.

Dori Smith was kind enough to point out this usenet thread from comp.sys.mac.programmer.misc where the possibility of this exploit was first broached. During the discussion as to whether or not this was a real possibility, one of the people involved took it upon themselves to create a benign proof-of-concept.

This proof-of-concept seems to be what Intego found, and then proceeded to craft an accurate, but very alarmist press release around. While the concept definitely seems to be sound, and is something that OS X users should keep in mind when accepting files from untrusted sources, there does not appear to actually be a malicious attack of any sort currently propagating across the ‘net aimed at OS X users, now matter how much FUD Intego puts into their Security Alert.

As always, while it’s still very true that OS X is a far more safe and secure system than Windows, no system is entirely safe, and the user has to accept some amount of responsibility for their actions.

iTunes: “Gutter Glitter” by Switchblade Symphony from the album Gothik (1995, 3:50).