jQuery.extend(Drupal.settings, {"basePath":"\/","CTools":{"pageId":"page-ec7c114c705ce40f9515869521b61565"},"googleanalytics":{"trackOutgoing":1,"trackMailto":1,"trackDownload":1,"trackDownloadExtensions":"7z|aac|avi|csv|doc|exe|flv|gif|gz|jpe?g|js|mp(3|4|e?g)|mov|pdf|phps|png|ppt|rar|sit|tar|torrent|txt|wma|wmv|xls|xml|zip"},"lightbox2":{"rtl":0,"file_path":"\/(\\w\\w\/)sites\/default\/files","default_image":"\/sites\/all\/modules\/lightbox2\/images\/brokenimage.jpg","border_size":"2","font_color":"000","box_color":"fff","top_position":"","overlay_opacity":"0.6","overlay_color":"000","disable_close_click":1,"resize_sequence":"0","resize_speed":100,"fade_in_speed":100,"slide_down_speed":100,"use_alt_layout":0,"disable_resize":0,"disable_zoom":0,"force_show_nav":0,"loop_items":1,"node_link_text":"","node_link_target":0,"image_count":"Image !current of !total","video_count":"Video !current of !total","page_count":"Page !current of !total","lite_press_x_close":"press \x3ca href=\"#\" onclick=\"hideLightbox(); return FALSE;\"\x3e\x3ckbd\x3ex\x3c\/kbd\x3e\x3c\/a\x3e to close","download_link_text":"","enable_login":false,"enable_contact":false,"keys_close":"c x 27","keys_previous":"p 37","keys_next":"n 39","keys_zoom":"z","keys_play_pause":"32","display_image_size":"","image_node_sizes":"()","trigger_lightbox_classes":"","trigger_lightbox_group_classes":"","trigger_slideshow_classes":"","trigger_lightframe_classes":"","trigger_lightframe_group_classes":"","custom_class_handler":0,"custom_trigger_classes":"","disable_for_gallery_lists":true,"disable_for_acidfree_gallery_lists":true,"enable_acidfree_videos":true,"slideshow_interval":5000,"slideshow_automatic_start":true,"slideshow_automatic_exit":true,"show_play_pause":true,"pause_on_next_click":false,"pause_on_previous_click":true,"loop_slides":false,"iframe_width":"600","iframe_height":"400","iframe_border":0,"enable_video":0},"thickbox":{"close":"Close","next":"Next \x3e","prev":"\x3c Prev","esc_key":"or Esc Key","next_close":"Next \/ Close on last","image_count":"Image !current of !total"}});
<div class="content_inn"><!--[if !IE]>Start left content<![endif]-->
<div class="left_panal">
<div class="left_content_box">
<div class="left_inner_box_heading"><h1>Q & A ABOUT THE MP3CONCEPT TROJAN HORSE</h1></div>
<div class="left_inner_box_inn">
<div style="float:right; margin:5px;">
</div>
<p>QUESTIONS AND ANSWERS ABOUT THE MP3CONCEPT TROJAN HORSE</p>
<p>9 April 2004 - Intego, the Macintosh security specialist, yesterday<br />
announced that it had updated its virus definitions for Intego VirusBarrier<br />
to protect Mac users against the first Trojan horse that affects Mac OS X.<br />
This document contains questions and answers and provides more information<br />
about this Trojan horse and detailed technical information as to how it<br />
functions.</p>
<p>Why did Intego decide to make an announcement about a Trojan horse affecting<br />
Mac OS X?</p>
<p>While the first versions of this Trojan horse that Intego has isolated are<br />
benign, this technique opens the door to more serious risks. The exploit<br />
that it uses is both insidious and dangerous and it is our duty as a vendor<br />
of Macintosh security solutions to protect our users. We don't believe in<br />
waiting until the damage occurs, unlike some of our competitors. The Intego<br />
Virus Security Laboratory quickly discovered how to block this Trojan horse<br />
and prevent it from running its code and as part of our commitment to our<br />
users, it was only natural that we release this in our latest virus<br />
definitions for Intego VirusBarrier.</p>
<p>We initially hesitated about releasing this information, but finally decided<br />
that it was our responsibility to alert users to this security risk.</p>
<p>It should be noted that while Intego was the first to publish information<br />
about this Trojan horse, both Symantec and McAfee released updates to their<br />
antivirus software after the publication of our press release. However,<br />
these companies do not specify whether their updates protect against this<br />
Trojan horse.</p>
<p>Is this simply a hoax?</p>
<p>Absolutely not. As we explain below, this is a major security risk, and<br />
should be taken very seriously. A hoax is something that is not true, that<br />
is created just to make people think there is a risk and to make them worry<br />
and doubt. This Trojan horse exists. We have samples of it, and it is<br />
potentially dangerous.</p>
<p>But you say this Trojan horse, or at least the examples that you have<br />
obtained, is benign. So why worry?</p>
<p>As far as we know, this Trojan horse is benign today, but nothing prevents a<br />
malicious hacker from using this same technique to create a dangerous Trojan<br />
horse. We have examined the code contained in this Trojan horse and it doesn<br />
=92t delete any files or change anything in Mac OS X, but we cannot be sure<br />
exactly what this Trojan horse is doing now, or whether it will have other<br />
effects in the future. In any case, protecting users now is better than<br />
responding too late, especially when we are aware of the threat.</p>
<p>How did you first find out about this Trojan horse?</p>
<p>Intego first heard about this from a Mac user who sent an e-mail message to<br />
our customer support department on April 6, 2004 at 11:16 am. This user<br />
provided us with information regarding this Trojan horse. This user also<br />
sent this message to Apple, Symantec and McAfee.</p>
<p>It has been known for some time that you could "hide" an application on Mac<br />
OS X as another type of file, simply by changing its name. Why is this<br />
Trojan horse different from any application whose name has been changed to,<br />
say, Song.mp3?</p>
<p>First of all, Mac OS X runs two types of applications: Cocoa and Carbon.<br />
Cocoa applications are native OS X applications, and have an .app extension.<br />
Cocoa applications are, in fact, folders containing all the bits and pieces<br />
of a program-code, resources, graphics, etc. The .app extension tells Mac OS<br />
X that an application is going to run natively.</p>
<p>Carbon applications are different. Most Carbon programs can run under either<br />
Mac OS 9 or Mac OS X, and, for this reason, have no .app extension. The Mac<br />
OS knows they are executable programs because of two resources, carb and<br />
cfrg. The carb resource indicates that it is a Carbon application and the<br />
cfrg resource indicates the location of executable code in a file's data<br />
fork.</p>
<p>This Trojan horse is, in reality, an MP3 file, to which the two resources<br />
mentioned above (carb and cfrg) have been added. In addition, the ID3 tag of<br />
the MP3 file contains the actual code of the Trojan horse and the cfrg<br />
resource contains a pointer to that location in the file's data fork.</p>
<p>(ID3 tags are an integral part of MP3 files: they are designed to contain<br />
information such as song titles, artist and album names, etc. These tags<br />
also exist in AAC files.)</p>
<p>How exactly does this Trojan horse work?</p>
<p>When a user double-clicks the file, Mac OS X sees the carb and cfrg<br />
resources, assumes that the file is an application and launches it. The cfrg<br />
resource, which points to the actual code contained in the ID3 tag, allows<br />
this code to be executed. The application then opens, launches iTunes via an<br />
AppleEvent and plays the sound contained in the MP3 file.</p>
<p>Next, the code contained in the file's ID3 tag continues executing. In the<br />
current Trojan horse, an alert is displayed, saying that it is indeed an<br />
application.</p>
<p>This type of Trojan horse could launch any application that runs under Mac<br />
OS X.</p>
<p>There seems to be some confusion regarding the actual way the code is hidden<br />
in the file. Can you be more specific about this?</p>
<p>As we said in our first press release, the actual code, which can be<br />
dangerous, is stored in the ID3 tag of the MP3 file. This tag usually<br />
contains comments about a song, but in this Trojan horse, executable code is<br />
stored in this tag. As mentioned above, the cfrg resource indicates where in<br />
the file the code is stored.</p>
<p>What sort of damage can a Trojan horse like this do on Mac OS X?</p>
<p>Fortunately, unless a user is logged in as root, this type of Trojan horse<br />
cannot damage any system files as the permissions applied to these files<br />
protect them. However, it could conceivably delete any or all of a user's<br />
personal files. If a user is logged in as root, then a Trojan horse of this<br />
type could delete system files as well.</p>
<p>A Trojan horse like this could also easily delete files on external hard<br />
disks, where users generally turn off ownership and permissions, authorizing<br />
anyone to act on the files they contain.</p>
<p>How can this Trojan horse propagate?</p>
<p>This Trojan horse can propagate in several ways: if a user downloads the<br />
file from the Internet, a server or a web site, it must be compressed in one<br />
way or another. This could be zip compression, if created from the Mac OS X<br />
10.3 Finder, or Stuffit compression. This compression is necessary because<br />
the Trojan horse contains resources, which are stripped if it is downloaded<br />
without being compressed. This Trojan horse could also be encoded using<br />
binhex encoding, which maintains the resource fork as well. If the file is<br />
not compressed or encoded, it can be transferred across a local network<br />
between Macs, or even downloaded from a user's iDisk.</p>
<p>If a user sends this file to someone else by e-mail, unaware that it<br />
contains a Trojan horse, there are possibilities that it will be received<br />
intact. Apple's Mail, and Microsoft's Entourage, for example, encode this<br />
file using binhex by default, which transmits the resources that are<br />
required for this Trojan horse to function.</p>
<p>Does this Trojan horse exploit a weakness in Apple's iTunes?</p>
<p>No, iTunes is not involved in this at all. iTunes plays the audio content of<br />
the MP3 file containing the Trojan horse, but does nothing else.</p>
<p>You say that this same technique could work in other types of files, such as<br />
JPEG and GIF files. Why is this the case?</p>
<p>Files such as JPEG or GIF files have tags similar to those in MP3 files. A=<br />
s<br />
long as the code can be hidden in tags like this, it is simple to add carb<br />
and cfrg resources that point to the code's location in the files.</p>
<p>About Intego<br />
Intego develops and sells desktop Internet security and privacy software for<br />
Macintosh.</p>
<p>Intego provides the widest range of software to protect users and their Macs<br />
from the dangers of the Internet. Intego's multilingual software and support<br />
repeatedly receives awards from Mac magazines, and protects more than one<br />
million users in over 60 countries. Intego also offers Windows and Palm OS<br />
versions of some of its software. Intego has headquarters in the USA, France<br />
and Japan. For further information, please visit <a href="http://www.intego.com" title="www.intego.com">www.intego.com</a>.</p>
<p>As the dangers of the Internet grow, Intego is hard at work, developing new<br />
software to protect users and their Macs from the latest security and<br />
privacy threats. We protect your world.</p>
<div class="links"><ul class="links inline"><li class="comment_forbidden first last"><span><a href="/user/login?destination=comment%2Freply%2F84705%23comment-form">Login</a> or <a href="/user/register?destination=comment%2Freply%2F84705%23comment-form">register</a> to post comments</span></li>
</ul></div>
</div>
<div class="left_inner_box_bottom"> </div>
</div>
<!--[if !IE]> End left box inner page <![endif]--></div>
<!--[if !IE]>End left content<![endif]--> <!--[if !IE]>Start right content<![endif]-->
<span class="field-content"><a href="http://forums.applecentral.com/ubbthreads.php/topics/537782/Analyst_sees_iPad_killers_less#Post537782" target="_blank"> Analyst sees iPad killers le...</a></span>
</div>
</div>
<div class="views-row views-row-5 views-row-odd">
<div class="views-field-title">
<span class="field-content"><a href="http://forums.applecentral.com/ubbthreads.php/topics/537649/Small_business_accounting_soft#Post537649" target="_blank"> Small business accounting so...</a></span>
<span class="field-content">Introducing the App Hall of Fame!</span>
</div>
<div class="views-field-body">
<div class="field-content"><div class="body-row" id="body-row-213485"><div style="background:#F5F5F5;">App discoverability continues to be a real issue. With the fast churn of apps in the App Store, an app has only a few weeks of promotional life in it before it‚Äôs largely forgotten. There are a few things developers can do to fix that, but those... | Read more »</div></div></div>
<span class="field-content">Gobliiins Are Coming</span>
</div>
<div class="views-field-body">
<div class="field-content"><div class="body-row" id="body-row-213486"><div style="background:#F5F5F5;">In the midst of the huge Q4 launch schedule, the cult classic, Gobliiins, as well as the rest of the trilogy, are being ported to the iPhone in all of their original glory. The Goblins trilogy was a quirky Atari/Amiga game series from the early 90‚Äôs... | Read more »</div></div></div>
</div>
</div>
<div class="views-row views-row-3 views-row-odd">
<div class="views-field-title">
<span class="field-content">myPhoneDesktop – Chrome to iPhone Extens...</span>
</div>
<div class="views-field-body">
<div class="field-content"><div class="body-row" id="body-row-213469"><div style="background:#F5F5F5;">Anyone who has used myPhoneDesktop knows that it is a fantastic tool for streamlining your onscreen workflow. Instead of having to type line after line into your phone directly, you can use myPhoneDesktop to type from your computer directly into... | Read more »</div></div></div>
<span class="field-content">AutoVerbal Talking Soundboard Pro helps...</span>
</div>
<div class="views-field-body">
<div class="field-content"><div class="body-row" id="body-row-213471"><div style="background:#F5F5F5;">Being able to speak and communicate with others is something that many of us take for granted. It‚Äôs not so easy for many folks though, in particular for individuals with autism spectrum disorders, as well as those who have suffered various brain... | Read more »</div></div></div>
<span class="field-content">Get Your Roast Right With ‘Time To Roast...</span>
</div>
<div class="views-field-body">
<div class="field-content"><div class="body-row" id="body-row-213473"><div style="background:#F5F5F5;">Roasting meat, in the cooking world, is about as simple as it gets. The greatest roast recipe I‚Äôve ever found is from Michael Ruhlman‚Äôs website, with the recipe titled, ‚ÄúThe World‚Äôs Most Difficult Roasted Chicken Recipe.‚Äù | Read more »</div></div></div>
MacTech is a registered trademark of Xplain Corporation. Xplain, "The journal of Apple technology", Apple Expo, Explain It, MacDev, MacDev-1, THINK Reference, NetProfessional, Apple Expo, MacTech Central, MacTech Domains, MacNews, MacForge, and the MacTutorMan are trademarks or service marks of Xplain Corporation. Sprocket is a registered trademark of eSprocket Corporation. Other trademarks and copyrights appearing in this printing or software remain the property of their respective holders. Not responsible for typographical errors.
</div>
</div>
<div class="footer_bottom"></div>
</div>
<div id="bootom_foo_ter">All contents are Copyright 1984-2010 by Xplain Corporation. All rights reserved. Theme designed by <a href="http://www.icreon.com">Icreon</a>.</div>
<div id="newuser-popup" style="font-size:14px">Greetings, and welcome to the new MacTech web site! Our home page is designed to be your <cite>Industry Dashboard</cite> -- so you can have a snapshot of all that's relevant in the industry in one easy location. Many readers tell us that because the information is updated so frequently, they are now checking the site multiple times a day.
Here's a quick run down of the features on the new web site, which can be subtle.
<UL><LI>We're running regular raffles. If you want free stuff make sure to register. <a href="/register">It's easy and only takes a minute!</a>
<LI>Registering for the site allows you greater functionality.
<LI>The first few blocks are original content from MacTech (for geeks) and our sister web site, MacNews (for general users)
<LI>Below that are MacTech's scanners, which scan the web and organizes it into News, Rumors, and Documentation. Updated every 15 minutes.
<LI>Our Whitepapers, Screencasts, and Videos section give you insight into great products
<LI>The Community Search narrows your search to the most relevant of Apple related sites for better results
<LI>The forums give you a place to ask questions, and share your knowledge.
<LI>Our partners at MacUpdate, MacPrices.net and the Jobs Boards keep you up to date
<LI>Want to see all the news in one big list? Check out our new <a href="/firehose">Information Firehose</a>
<LI>And, don't forget the Apple Central area, and ads throughout the site. Advertisers are what make the site possible</UL>
We truly hope you <a href="/register">register</a> so that we can keep you up to date about new features as they are implemented. And, please use the BETA button in the top right to provide us any feedback, suggestions or bugs. We love to hear from you. </div>
<!--[if !IE]>End pop_up<![endif]-->
<!-- Google Analytics now handled by Google Analytics Module in drupal -->
<!--VISISTAT SNIPPET//-->
<script type="text/javascript">
var DID=13280;
var pcheck=(window.location.protocol == "https:") ? "https://sniff.visistat.com/live.js":"http://stats.visistat.com/live.js";
