Computerworld
Apple Trojan returns to haunt Mac users
RSPlug.E, has been discovered on porn Web sites masquerading as a missing ActiveX plug-in
John E. Dunn (Techworld)  04 December, 2008 07:43

A nasty Trojan that first hit Mac users just over a year ago has returned with sharpened teeth, a security company has revealed.

According to Mac-only security company Intego, the latest variant of RSPlug, known as RSPlug.E, has been discovered by the company on porn Web sites masquerading as a missing ActiveX plug-in needed to play a video.

As with its many equivalents in the Windows world, the software tries to trick users into installing it after complaining of a "missing Video ActiveX Object", which turns out to be where the program starts its install routine.

Trying to cancel the install at this point by clicking cancel prompts the malware to deliver the message, "Please install new version of Video ActiveX Object". The only way out at this point is to exit the browser.

What users get for their naivety is a DNS hijacker, capable of redirecting web address requests to any website the criminal desires, including phishing websites.

"Mac users are pretty unsavvy as far as security is concerned," said Peter James of Intego, who reckoned that many still Mac users run their computers unprotected, despite numerous warnings.

"As Mac market share is increasing, malware is increasing proportionately," he said.

Intego, of course, admits that it has a vested interest in publicising Mac malware, including drive-by Trojans such as RSPlud.E. Nevertheless, the fact that Mac users are now facing the sort of Trojan programming threats regularly experienced by PC users should alert them to the importance of the issue.

As PC Trojans go, the programming features of RSPlug.E look fairly basic. PC malware is more highly evolved and usually cleverer. But a programmer - probably a Russian - with knowledge of OSX had taken time to create a Trojan that hits Macs instead of PCs, James pointed out.

One curiosity is that one of the key files installed by the program actually bears the name of Intego itself, a provocative reference to the company's publicising of previous versions of the Trojan, and possibly a warning too.

Intego warns Mac users not to download software form unknown sources - advice PC security vendors were handing out to Windows users five years ago.

Computerworld Buyer's Guide - Vendors Matched to this Article
More about , Intego, Macs, Apple

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Add to Google
Computerworld Buyer's Guide - Vendors Matched to this Article
Zones
Zone logoZones provide focussed content from Computerworld and leading technology partners.
Newsletter Subscription
Newsletter Subscription
Sign up for our Computerworld newsletters!
Syndicate content Syndicate content Syndicate content
 

Computerworld Webinar

Thursday, June 11th, 2009
10:30am EST (Sydney, Australia)
Screening at your PC

Computerworld is hosting a 30 minute live webinar to help you to learn how unified communications can save you money, foster innovation and business agility by making it easier for people to find, reach and collaborate with one another.

Register Now

Whitepaper

Wireless LANs: Is My Enterprise At Risk?

This paper details the risks associated with wireless LANs, and offers an overview of the inherent properties of wireless LANs and differences from wired networks. Read about real-life breaches and incidents and strengthen your own defence.

Enterprise IT Buyer's Guide
Find Technology Vendors Fast
 
Find vendors by name | Find by category
Sponsored Links
 
Send Us E-mail | Privacy Policy
Features List | Media Kit | Advertising | Contact Us

Copyright 2009 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.