Although it is true that some Trojans use vulnerabilities like the current ARDAgent vulnerability to gain root access, they do not need to. The core message about Trojans is getting lost amidst all the talk about plugging this vulnerability. Even if there was not a single vulnerability in OS X we would be at the mercy of Trojans. That’s the whole point of Trojans. Any program you run can do anything you can do. Let’s think about that for a moment, what can you do on your system without needing a password? Here’s a short list for starters:

  • You can run programs.
  • You can read, edit, and delete files
  • You can use the network
  • You can set programs to auto-start each time you log in

Remember, a Trojan is just an ordinary program that pretends to do something you want, but actually does something else. It could delete all your files. It could run a key logger and phone home with your credit card number, user names and passwords, bank details etc.. It could use your machine to send spam. It can set itself to automatically run each time you log in and continue with it’s nefarious actions. It can do all this WITHOUT the need to exploit a single vulnerability in your OS or your software. If you can do it, a Trojan can. Think about that for a second, it’s not a comforting thought!

[tags]security, OS X, Mac, Trojan[/tags]

It’s fair to say that such a Trojan can completely destroy your machine and your life. It can destroy your files, and steal your identity and your money. Surely that’s enough to be getting on with. Sure, a Trojan can do all that a little more effectively as root, but preventing Trojans getting root is just stopping something disastrously bad becoming a little worse. This is why I worry so much about the amount of attention that is being focused on the ARDAgent vulnerability and protecting yourself from that vulnerability, rather that getting the core message out there that Trojans can strike WITHOUT the aid of any form of vulnerability. The impression being given is that if you work around the ARDAgent vulnerability in some way you are safe. That simply couldn’t be further from the truth.

As always the real security message is getting lost amid the panic. So what is the real security message? It’s simple, NEVER INSTALL ANYTHING FROM AN UN-TRUSTED SOURCE, EVER. The current Trojan is aimed at satisfying people’s need to Gamble. Rest assured we’ll see similar beasts to satisfy people’s need for pornography, or indeed anything. Gardening, knitting, you name it. The bad guys are after all of us, not just the gamblers and pornography lovers! We see this in the Windows world already. As Madeye Moody would bark “constant ever present vigilance!”.

The time for smugness is well and truly over. It has been for some time, but people have been reluctant to read the signs. The bad guys have taken notice of the Mac. It is a prime target for them. Mac users are unsuspecting, often complacent, and generally very naive about security. They simply don’t expect to be targeted so they make an exceptionally juicy target. It’s time to start acting like we’re in the cross-hairs of the bad guys, because we most certainly are.