Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Java trojan attacks Mac OS X via social networking sites

arstechnica.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: New Java trojan attacks Mac OS X via social networking sites

#11

Post by frou_dh »

Shooter wrote: post #5

What antivirus/security software do other HNers use on their Macs, if anything?

ClamXav for a manual full scan every so often; probably a waste of time.

I find LittleSnitch (outbound firewall) reassuring to let me moderate which applications are allowed to connect to what.

Re: New Java trojan attacks Mac OS X via social networking sites

#12

Post by SpikeGronim »

tjarratt wrote: post #10

Since no one else is going to say it... Suddenly it doesn't seem like such a bad idea to remove Java from OS X. I for one can go without any applets and even minecraft on my macbook pro.

First, Apple isn't removing Java from OS X. They will stop shipping their customized version of Java in several years.

Second, every popular piece of software has vulnerabilities. So if this warrants the removal of Java, you should remove Safari and the BSD kernel from OS X as well.

Re: New Java trojan attacks Mac OS X via social networking sites

#13

Post by msbarnett »

hackermom wrote: post #9

Underlying requirement: that the user running the applet is an administrator (and while this is the default modus operandi as per the installation procedure of OS X, not every OS X user continues on this path).

The user is also alerted when the applet tries to run, and they would need to approve the privilege escalation request for the applet; it has an untrusted, self-signed cert.

Re: New Java trojan attacks Mac OS X via social networking sites

#14

Post by frou_dh »

ihodes wrote: post #6
Shooter wrote: post #5

What antivirus/security software do other HNers use on their Macs, if anything?

Right now, common sense. I'll move to Arch if I need to install anything else that remotely resembles bloat.

Common sense is also enough on Windows, except when it isn't.

Re: New Java trojan attacks Mac OS X via social networking sites

#15

Post by msbarnett »

seles wrote: post #3

It seems to imply that once the link is clicked it downloads and runs the payload automatically, but this is rather hard to believe (I would guess that there is some user action required). Is the article correct?

User action is required; the applet needs permission to get outside of its sandbox, so a standard "This applet wants permission to access your computer and data, Approve or Deny?" dialogue is presented.

Re: New Java trojan attacks Mac OS X via social networking sites

#16

Post by DavidSJ »

msbarnett wrote: post #13
hackermom wrote: post #9

Underlying requirement: that the user running the applet is an administrator (and while this is the default modus operandi as per the installation procedure of OS X, not every OS X user continues on this path).

The user is also alerted when the applet tries to run, and they would need to approve the privilege escalation request for the applet; it has an untrusted, self-signed cert.

If true, this is a huge omission from the article. Got a source?

Re: New Java trojan attacks Mac OS X via social networking sites

#17

Post by msbarnett »

DavidSJ wrote: post #16
msbarnett wrote: post #13

Earlier quoted context omitted.

The user is also alerted when the applet tries to run, and they would need to approve the privilege escalation request for the applet; it has an untrusted, self-signed cert.

If true, this is a huge omission from the article. Got a source?

Sure, here's a couple with less breathlessness, and more details:

http://www.intego.com/news/trojan-horse-os-x-koobface-a-affe...

http://www.tuaw.com/2010/10/27/security-alert-new-trojan-hor...

Re: New Java trojan attacks Mac OS X via social networking sites

#20

Post by X-Istence »

SpikeGronim wrote: post #12
tjarratt wrote: post #10

Since no one else is going to say it... Suddenly it doesn't seem like such a bad idea to remove Java from OS X. I for one can go without any applets and even minecraft on my macbook pro.

First, Apple isn't removing Java from OS X. They will stop shipping their customized version of Java in several years. Second, every popular piece of software has vulnerabilities. So if this warrants the removal of Java, you should remove Safari and the BSD kernel from OS X as well.

There is no BSD kernel in OS X. The entire OS is Darwin running an XNU kernel that has a BSD layer within it. There is no way to remove the BSD layer without removing the entire OS.
Post reply on HN