SillyDog701 Message Centre

[Antony]

This thread is to provide some organised information regarding security holes, viruses, worms etc that targets Mac OS X and Safari, Mail.app.

This thread will be updated from time to time. To discuss each individual case, please follow each each thread.

OSX/Leap-A: thread
cause: A proof-of-concept piece of malware, the worm attempts to spread via iChat instant messaging. The worm sends itself to available contacts on the infected users' buddy list in a file called "latestpics.tgz" This worm requires users to enter administrator password.

official words: "Leap-A is not a virus, it is malicious software that requires a user to download the application and execute the resulting file."

solution: (obvious,) don't launch untrusted applications.
update solution: install Security Update 2006-001

Safari (launches unsafe file) thread
cause: (by default) Safari launches downloaded ZIP archives by itself, no user interaction.

solution: Go to Safari's preferences, and in General preferences un-tick “Open "safe" files after downloading”. (see this screenshot)
update solution: install Security Update 2006-001

Mail (launches unsafe file) discussion thread (also this one)
cause: (similar to above Safari case) error in file association meta data in ZIP archives and mail messages may be used to trick user to execute malicious shell scripts.

solution: Do not click any attachments in Mail.app. If you want to see the attached file, Save it to your harddisk first. Otherwise, do not open files in archives or mail attachments originating from untrusted sources.
update solution: install Security Update 2006-001

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/417.9 (KHTML, like Gecko) Safari/417.8

---

MozInfo701 | MacCentre701 | AntBlog701 | don't steal music.

[Antony]

Security Updates 2006-003 is now available for Mac OS X 10.4.6 and 10.3.9 users.

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.2

---

MozInfo701 | MacCentre701 | AntBlog701 | don't steal music.

[Antony]

installer issue ("iAdware") was addressed in Security 2006-007

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/418.9 (KHTML, like Gecko) Safari/419.3

---

MozInfo701 | MacCentre701 | AntBlog701 | don't steal music.

[Antony]

According to Cnet News.com, Apple fixed 45 security holes in Mac OS X 10.4.9 update and Security Updates 2007-003 for Panther.