[CS-FSLUG] Apple's Big Virus

[David Aikema]

On 5/2/05, "國產 Wei-Yee Chan (Made in Chinar)" <survivor at brisnet.org> wrote:
> anti-virus program is capable of detecting it.  On the other hand, if
> your using a Mac or a Linux OS, then chances are that your OS would
> prompt U for the password whenever a program or virus attempts to make
> changes to the system settings, thereby alerting U to the possibility of
> a virus being present.  Without the deliberate action of keying in the
> administrator password, the virus wouldn't be able to propagate itself.

It wouldn't be able to propogate to other user accounts on the local
machine, (or likely reformat the drive).  On the other hand it would
be able to run as a program in user space, and I suspect that it might
even be able to get itself to auto-launch on login without any
superuser access being required.  It would also be able to delete all
of the user's files as well.

Think about all of these viruses being spread through Microsoft
Outlook ... no superuser access would be required for one of those to
propogate.  This may be caused by poor accounting for security on
Microsoft's behalf, but it does demonstrate that a significant amount
of damage can be caused without actually needing superuser access.

> If your talking about unauthorised access to your system, then a simple
> password change for all accounts on that PC would suffice, provided that
> your system is still "intact", meaning that it hasn't been compromised
> by trojans, keyloggers and viruses....etc.

Precisely... and after being compromised I wouldn't trust it to be
"intact". Perhaps I'm slightly paranoid, but I wouldn't trust a
virus-scanner to pickup everything.

David