Warning about a New OSX Trojan

**ArielMT** · 11-03-2009, 02:23 PM

Don't laugh.

According to a post on Symantec's Security Response, the new trojan called OSX.Loosemaque presents itself as a video game while secretly deleting files from the player's home directory.

It arrives as a Mac OS file named "lose lose.app" and 3,691,880 bytes (3.5 MB) in size.

When a user is tricked into running the trojan, the user is presented with a video game:

If the player shoots an enemy character, a file or folder is deleted from the player's home directory. When the player's character is destroyed, the trojan sends the high score to a remote server and then deletes itself from the computer.

Symantec recommend the following practices, among others, regarding this trojan:

Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.

Sensible, but irrelevant.

Symantec recommend the following steps to remove this specific trojan:

Update the virus definitions.
Run a full system scan and repair or delete all the files detected.

This is interesting because, according to the write-up, this trojan won't be detected by the weekly virus definition updates until tomorrow, November 4th.

Now you can laugh.

ToeClaws · 11-03-2009, 02:25 PM

Not surprised - with the rising popularity of Non-MS operating systems, we'll likely see a lot more of these. Have to admit though - I like the creative approach.

Aurali · 11-03-2009, 02:26 PM

Greatest virus ever...

is it bad I wanna play it?

**ArielMT** · 11-03-2009, 02:34 PM

I'm more disappointed at Symantec's response than I am at the trojan itself.

I have some Mac-owning customers, and I dread the day one of them brings it in with the complaint of missing documents and video games. "But I got a really high score on it, and I don't want to lose that score!"

Edit: And I love the trojan's filename.

Aden · 11-03-2009, 02:40 PM

Quote:

Originally Posted by ArielMT

the new trojan called OSX.Loosemaque presents itself as a video game

Oh. Well there's nothing to worry about then. Nobody expects to play videogames on their Mac.

Sinjo · 11-03-2009, 02:54 PM

This isn't a virus.

The developer provides this for free and warns you that it will delete files as you play.

http://www.stfj.net/art/2009/loselose/

**ArielMT** · 11-03-2009, 03:00 PM

Quote:

Originally Posted by STFJ

Lose/Lose is a video-game with real life consequences. Each alien in the game is created based on a random file on the players computer. If the player kills the alien, the file it is based on is deleted. If the players ship is destroyed, the application itself is deleted.

Hahah, oh wow! WTG Symantec!

BTW, Web Of Trust scorecard.

ToeClaws · 11-03-2009, 03:13 PM

Best kind of virus - one that lets you voluntarily run it and wreck your system with it! There were some for both DOS and Windows like that too.

Runefox · 11-03-2009, 03:22 PM

Quote:

Originally Posted by ToeClaws

Best kind of virus - one that lets you voluntarily run it and wreck your system with it! There were some for both DOS and Windows like that too.

Yeah, I remember those, it was awesome. XD It's amazing how the Mac crowd are only just now catching up with the trend.

**Irreverent** · 11-03-2009, 03:27 PM

Quote:

Originally Posted by Aurali

is it bad I wanna play it?

I used my boss' Airbook.

Quote:

Originally Posted by Runefox

Yeah, I remember those, it was awesome. XD It's amazing how the Mac crowd are only just now failing to learn from the trend.

Fixed.

Really, Symantech..WTF?

AshleyAshes · 11-03-2009, 04:18 PM

Wait, the virus REMOVES ITSELF WHEN YOU LOSE?

...What kinda stupid design element is that?

Aurali · 11-03-2009, 04:25 PM

Quote:

Originally Posted by Irreverent

I used my boss' Airbook.

Should bring out my old mac and see if it works no?

Quote:

Originally Posted by AshleyAshes

Wait, the virus REMOVES ITSELF WHEN YOU LOSE?

...What kinda stupid design element is that?

Read the rest of the thread.

maybe even the links within it

The Drunken Ace · 11-03-2009, 04:26 PM

Quote:

Originally Posted by AshleyAshes

Wait, the virus REMOVES ITSELF WHEN YOU LOSE?

...What kinda stupid design element is that?

Read the replies. ITS A GAME. One that was made to have "real consequences" to your actions.

Sinjo · 11-03-2009, 05:13 PM

Quote:

Originally Posted by AshleyAshes

Wait, the virus REMOVES ITSELF WHEN YOU LOSE?

...What kinda stupid design element is that?

I'm not sure whether I should yell at you or feel sorry for you.

Azbulldog · 11-03-2009, 06:17 PM

Quote:

Originally Posted by Sinjo

This isn't a virus.

The developer provides this for free and warns you that it will delete files as you play.

http://www.stfj.net/art/2009/loselose/

This.
I heard about this game weeks ago, and it's not just OSX. I wish I had a crappy computer to waste just to be on the high scores.

Aden · 11-03-2009, 06:39 PM

Step 1: Flood home directory with a few thousand junk files and play game
Step 2: ???
Step 3: Profit

Aurali · 11-03-2009, 06:46 PM

lol at "permanent deletion" do they overwrite sectors or what?

Runefox · 11-03-2009, 06:58 PM

Quote:

Originally Posted by Aurali

lol at "permanent deletion" do they overwrite sectors or what?

You idiot! You own a Macintosh! The file is fucking gone! It's just gone!

**Irreverent** · 11-03-2009, 07:08 PM

Quote:

Originally Posted by Runefox

You idiot! You own a Macintosh! The file is fucking gone! It's just gone!

I swear that gets funnier every time I see it.

Aden · 11-03-2009, 07:21 PM

Quote:

Originally Posted by Aurali

lol at "permanent deletion" do they overwrite sectors or what?

I know Disk Utility gives the option to zero everything when formatting with a few options for amount of passes, but to my knowledge that doesn't happen with standard file deletion.

Sinjo · 11-03-2009, 08:08 PM

Quote:

Originally Posted by Aden

Step 1: Flood home directory with a few thousand junk files and play game
Step 2: ???
Step 3: Profit

Except that it chooses every and anything on the HDD

**ArielMT** · 11-03-2009, 08:13 PM

Quote:

Originally Posted by Runefox

You idiot! You own a Macintosh! The file is fucking gone! It's just gone!

Aden · 11-03-2009, 08:22 PM

Quote:

Originally Posted by Sinjo

Except that it chooses every and anything on the HDD

Quote:

Originally Posted by ArielMT

the new trojan called OSX.Loosemaque presents itself as a video game while secretly deleting files from the player's home directory.

...

If the player shoots an enemy character, a file or folder is deleted from the player's home directory.

Just going with what was said in the OP, bro.

Shino · 11-03-2009, 08:26 PM

Must resist... must resist... res..i...s..t...

ah, screw it.

I told you so.

Also, +1000 to Runefox for posting the ultimate Mac quote...

CryoScales · 11-03-2009, 09:08 PM

Someone actually went through the effort to make a macbased virus? I have to applaud them for their tenacity.

11-03-2009, 02:25 PM	#2
ToeClaws Writer, artist, Canuklehead 2,500 Club Gender: Male Species: checks Dammit... still human Location: London, Ontario, Canada Join Date: Jul 2008 Posts: 2,746	Re: Warning about a New OSX Trojan Not surprised - with the rising popularity of Non-MS operating systems, we'll likely see a lot more of these. Have to admit though - I like the creative approach.

11-03-2009, 02:26 PM	#3
Aurali Zen 2,500 Club Gender: Female Species: Celestial Boreal Ratteguhn Location: Valley of the sun Join Date: Apr 2008 Posts: 2,922	Re: Warning about a New OSX Trojan Greatest virus ever... is it bad I wanna play it? __________________ There really is nothing more satisfying then making someone smile. So ask me if you need help, I can point you to where to go at least. I have a new FA.

11-03-2009, 02:54 PM	#6
Sinjo Jerkface You Have Taken the Lead Gender: Male Location: Georgetown Join Date: Oct 2009 Posts: 645	Re: Warning about a New OSX Trojan This isn't a virus. The developer provides this for free and warns you that it will delete files as you play. http://www.stfj.net/art/2009/loselose/

11-03-2009, 03:13 PM	#8
ToeClaws Writer, artist, Canuklehead 2,500 Club Gender: Male Species: checks Dammit... still human Location: London, Ontario, Canada Join Date: Jul 2008 Posts: 2,746	Re: Warning about a New OSX Trojan Best kind of virus - one that lets you voluntarily run it and wreck your system with it! There were some for both DOS and Windows like that too.

11-03-2009, 04:18 PM	#11
AshleyAshes Arcade Snowmew Of Doom Elder God Gender: Male Species: U. Uncia Sapien Location: Ottawa, Canada Join Date: Jan 2009 Posts: 2,013	Re: Warning about a New OSX Trojan Wait, the virus REMOVES ITSELF WHEN YOU LOSE? ...What kinda stupid design element is that? __________________

		Fur Affinity Forums > General Discussion > Bits and Bytes
Warning about a New OSX Trojan

11-03-2009, 06:46 PM	#17
Aurali Zen 2,500 Club Gender: Female Species: Celestial Boreal Ratteguhn Location: Valley of the sun Join Date: Apr 2008 Posts: 2,922	Re: Warning about a New OSX Trojan lol at "permanent deletion" do they overwrite sectors or what? __________________ There really is nothing more satisfying then making someone smile. So ask me if you need help, I can point you to where to go at least. I have a new FA.

11-03-2009, 08:26 PM	#24
Shino Now with more Writer's Block! Forum Legend Gender: Male Species: Blue Wolf Location: Middle of Nowhere, VT Join Date: Nov 2008 Posts: 1,241	Re: Warning about a New OSX Trojan Must resist... must resist... res..i...s..t... ah, screw it. I told you so. Also, +1000 to Runefox for posting the ultimate Mac quote... __________________ Shino - also known as IAmTheDonut on the rest of the Interwebs. When I'm not here, I can usually be found on the ]TGP[ or uB\| CS:S servers.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Username:		Remember Me?
Password: