Spyware trojan hitching ride on third-party Mac screensavers
Mac security firm Intego has issued a warning about a Mac twist on a two-year-old Windows spyware app that sends a variety of potentially sensitive information to external servers. Dubbed "OSX/OpinionSpy," the spyware is installed along with a number of widely available third-party Mac OS X screensaver modules, as well as with at least one shareware tool to strip audio tracks from Flash videos.
OSXOpinionSpy, aka PremierOpinion, claims in some cases to be a tool to help collect browsing habits for "market research," while in other cases it installs without any notification. The application runs in the background with root permissions, opening an HTTP backdoor. It scans any attached volumes, sending encrypted information to a number of servers, and can also examine packets coming and going from an infected Mac, potentially grabbing information from other computers on a local network. Finally, it injects code into running versions of Safari, Firefox and iChat, sending a variety of information—e-mail addresses, iChat message headers and URLs, as well as other data—back to command servers.
