The end of innocence for Mac users

Posted on by

Great BBC column by Bill Thompson on the first Mac trojan.

The first serious threat to Mac users has been observed “in the wild”.

It’s a Trojan Horse, a piece of code that pretends to do one thing but actually compromises your computer.

This one spreads through online video sites, taking advantage of the fact that there are many different ways to display video, each requiring slightly different software to encode and decode moving images.

That puts my son right in the middle of the vulnerable population because he likes to watch video clips via sites like YouTube and Flixster.

Although Quicktime, the Apple media player that comes bundles with every Mac, makes a good shot of dealing with most common formats, if it can’t figure out what to do with a particular file type it can go online to find the right “codec”.

The Trojan sits behind an online video and when you try to play it you get a message from Quicktime telling you to get a new codec, and if you follow the link you’ll be sent to a site that hosts the malicious software.

Click “ok” and enter your systems adminstrator’s password and it will be installed on your computer with full system access after which you are, to use the jargon, “pwned”, or scuppered.

And you don’t even get to see the video you were after.

At the moment the fake codec is being spread via porn sites, but it will quickly spread to more mainstream sites, and that’s when it will get dangerous and could affect a lot of Mac users who believe that they don’t need to worry about system security…

Richard Earney emails:

It’s unfortunate, because this Trojan is an actual attempt by Ukrainian criminals to hijack Macs, but it’s not exploiting any sort of security hole in any version of Mac OS X. To get hit by it, you must (a) be the sort of moron who downloads “video codecs” from porno sites; (b) mount the disk image and launch the installer; and (c) grant the installer administrator privileges to install whatever it wants, wherever it wants on your system. No system can prevent that.

If anything, the fact that you have to manually install the software and supply your administrator password is a sign that Mac OS X security works.

Hmmm…. I’ve just looked at Safari Preferences, which has a check-box for “Open ‘safe’ files after downloading” which some users might leave checked in their innocence.

Later: Charles Arthur emailed to point out that ” it’s not strictly the first; but it does seem to be the first *commercial* one, where the professional malware writers have gotten into the game”.

Well, I’ll be Skyped…

Posted on by

My Skype phone arrived today, and it’s a very interesting gadget indeed. It’s got a lovely implementation of Skype and does Skype-to-Skype calls smoothly — and free. Also the Skype IM client works smoothly and efficiently. It’s also a perfectly good ‘ordinary’ phone (and has quite a decent 2MP camera) with Bluetooth and a micro SD card. What with this and the iPhone and the revelations about Google phone plans, the mobile phone business is about to become a LOT more interesting than it has been up to now.

Haven’t read all the small print yet, so haven’t been able to check what happens when you want to make Skype-to-Skype calls in another country. There has to be a downside to this somewhere. But it’s a neat and innovative package just for UK use.

Oh — I almost forgot — it’s also got a nice app which makes it easy to post Facebook status updates. See photograph.

Missing column

Posted on by

As a result of some — as yet unexplained glitch — yesterday’s Observer column didn’t make the leap from print to Web. If you’re interested here’s a pdf.

Who said there isn’t life after death? Hard on the heels of Radiohead’s ‘pay what you like’ experiment — in which fans were able to decide how much (or how little) they wanted to pay for the group’s latest album — comes news that Cliff Richard is also testing new online business models. He’s asking his fans to determine the price of his forthcoming meisterwerk, ‘Love, the Album’. The maximum anyone will be charged is £7.99 (the price of an album on the iTunes store) but the the final price will be determined by how popular the album is — as measured by the volume of advance orders.

Ingenious, eh? It just shows that there’s still life in these old codgers. Sir Cliff says he had no choice but to embrace new technology. ‘Who’d have thought I’d get a buzz from creative marketing?’ he told the Daily Telegraph. ‘As artists we face a stark choice. We either keep one step ahead of the technology which is changing our industry so radically – or we throw up our hands and quit. Personally I’m not for quitting.’

Right on…

Correction: The column was published on the Web edition, but in a different location. Phew!

BuzzMachine in Cambridge

Posted on by

Jeff Jarvis came to Cambridge yesterday and had lunch with a group of us in the Eagle. I’ve been reading his blog for years, and greatly admire his sharpness and clarity. As he talked over lunch, I was reminded of something Noel Annan said once about a colleague. “I wish I was as sure of anything as that man is about everything”. Afterwards we went on a stroll down Free School Lane past the Old Cavendish laboratory where the electron was discovered (by J.J. Thompson) and the atom was split for the first time (by John Cockroft and Ernest Walton) and the structure of the DNA molecule was elucidated (by James Watson and Francis Crick). We paused by the plaque commemorating the discovery of the electron and Jeff pulled out his camera.

So of course I photographed him doing so. What I didn’t realise is that Quentin was at that moment trying to get into position to photograph me photographing Jeff. But the main subject moved and so what David Good described as a perfect postmodernist photographic moment passed unrecorded.

Thanks to Bill Thompson for arranging a great lunch.