Oh Look. An Apple WORM?

If you visit today the Infosecsellout blog, you will see a blog entry announcing a new Apple Mac OS X vulnerability and a link to the SecurityFocus web site.

There is no detail, but the title suggests that a Mac worm could be created by using that vulnerability. Also there is no mention of the author.

As we were researching this announcement we soon discovered that more accurate and interesting information was originally posted–but rapidly removed–on that blog. If you visited it on Sunday, you were able to read a note from the man who claims to be the worm author. His motivations were clearly visible: “I wrote this for my own purposes and it will be demonstrated to those who asked me to engage in this work. Yes, I am being compensated for this”.

In this blog entry, the possible author gives some details about its proof of concept, which could be easily changed to be more malicious.

He said his code uses a non patched variation of the MDNSResponder vulnerability recently fixed by Apple. According to this guy, the worm gives remote root access, compromises its first system, places a text file on the desktop and moves on to attempting to compromise other systems on the same network.

This story prove both things: the first is that Macintosh with Intel is an interesting target. Real outbreaks are more than ever possible. The second is that the lure of money motivates many people more or less scrupulous. It is another cause for concern.