by DAN CALLOWAY & FRED HANSEN
Published 6 June 2010
HENDERSONVILLE, NC – A close friend and colleague of mine, Fred Hansen, who lives in Hendersonville, NC, is an iMac owner and 
avid Mac user who recently sent me an email making me aware of a new virus that is making its way to Mac users everywhere. As a result, gone are the days when Mac users could say, “I don’t have to run anti-virus software on my Mac because there aren’t any viruses being written for the Mac.” Well, this simply isn’t the case any longer. Due to Apple MacOSX’s gaining market share, virus creators are targeting Mac users in order to take advantage of its growing popularity. However, Fred also wants to make certain that readers of this blog don’t become overly alarmed by its message since the likelihood of anyone becoming infected with the OSX/OpinionSpy is very remote.
Background on OpinionSpy:
Intego, who is perhaps the leading producer of anti-virus software for Macs, broke the news about this particular piece of malware. Rumor has it, though, that OpinionSpy was being discussed in online Mac forums a month or two before Intego got wind of it. Please keep in mind Intego has a reputation for crying wolf every few months to build sales of their anti-virus software on the heretofore barren Mac landscape. (Note the red banner at the top of their home page.)
How OpinionSpy Works:
It rides along with installations of other programs and installs itself while the other program is installing. Once installed on your Mac OpinionSpy acts as a data harvester: It injects code into running instances of Safari or Firefox and that code sends your private data back to servers operated by the people who wrote the program. OpinionSpy is, apparently, hard to detect through an antivirus disk scan, and it also repairs and updates itself. Here’s a blogged summary of OpinionSpy.
Fred Hansen points out that at this point, infection by OpinionSpy is not a big worry because its delivery system is confined to installations for screen savers and media conversion packages. (List of packages here.) At this stage of the game the malware has the feel of a trial balloon or marketing gone over to the Dark Side. However, if you want to check your Mac anyway, just to make sure, here’s how to do it.
Confirmations: In addition to Intego, the Trend Micro Anti-virus Library and McAfee Threat Center have confirmed OpinionSpy as a low-risk Trojan with a high-damage potential. Symantec’s Threat Explorer does not currently list OpinionSpy, though it has about 15 other Mac-specific, low-severity viruses.
Why OpinionSpy Prompted Fred to Write an Email:
- Because of its potential for stealing identities and financial information.
- Because of its stealthiness. You won’t even know your Mac has it.
- Because of its social engineering. True, it requires a Mac administrative user-id and password to install, but so does all the other software I install on my Mac. So it catches me at a point where I’m expecting to enter user-ids and passwords.
A What-If Example: Supposing I’m installing a new application called MyNewSoftware and my iMac tells me that MyNewSoftware requires an administrator’s authorization to install. Fine, I do it. Some brief installation activity ensues then I get another pop-up saying “MyNewSoftware_Updater requires authorization to install.” (This is how OpinionSpy could be renamed for this particular installation script.) I authorize the second pop-up without thinking about it much, and I’ll bet you would too.
Bottom Line: Install anti-virus software on your Mac. Here are some possibilities:
- ClamXAv — I haven’t tried it, but it’s free. It has the reputation for lagging behind on its detection database.
- PC Tools iAnti-virus — Also free. I tried it and removed it two or three months ago. It seemed to do the job, but it also would occasionally max out my CPU cycles for no apparent reason, slowing all other processing to a crawl.
- F-Secure Mac Protection — This is beta program, free for the next six months. I’ll probably try it this afternoon. F-Secure has a good reputation in the anti-virus biz, but you’re loading a work-in-process on your Mac, and public betas on software like this can be a real chore for people who want their Macs “to just work.”
- Intego — The gold standard in AV for Macs, but it will cost you $50 USD. It does have a free trial.
- Kaspersky Anti-virus for Mac — Another AV I’d like to try because Kaspersky has had a good reputation in the Windows world, and because this program is reportedly very conservative in its use of Mac resources. There’s a trial version but the real deal will cost you $40 USD. Kaspersky’s headquarters are in Moscow which might spook those of you old enough to remember the Cold War and grammar school A-Bomb drills.
Recent Comments