OSX/OpinionSpy Discovered by Intergo

Tuesday, June 1, 2010 at 03:23PM
drStrangeP0rk in Client, Mac OSX 10.5, Mac OSX 10.6, Malware, Server, Spyware, Wild

Intego, which makes a host of excellent Mac security products, is reporting the discovery of spyware named OSX/OpinionSpy which installs with a host of freely available Mac screensavers and software. The spyware reports back various machine, user and file information after executing with root privileges. It leaves the system open to a host of malicious operations including executing code at root privileges without the users knowledge and maintaining a back door using port 8254, 80 and 443. 

Users should update their Intego virus definitions. Users can also do a search for "PremierOpinion" which is what the spyware is installed updater. Intego has updated a list of products that contain the spyware software which can be viewed here. Port scanning information for 8254 can be found here.

There is never any reason to install any screensavers or survey software since usually the terms allow the vendor access to private information. It is important to remember that Mac OSX has a built in screen saver for user to use. In  addition the screen saver should lock idle system at the very least, users/administrators should set the following in the Security Preference Setting Panel:

 

• Require Password Immediately after screen saver begins
• User secure virtual memory

Users/Administrators should set an automatic log out time and lock access to Prefernce Panes.

 

Article originally appeared on magmatic.com (http://www.magmatic.com/).