>> But has anyone detected any Macs that are infected with the trojan?

> One public reference may be found here:
>
> http://discussions.apple.com/thread.jspa?messageID=5709418

Thank you for passing this on, Philippe.

It's important to note that the infected user, dave123901, made his post on
October 29. Intego discovered RSPlug on October 30 according to
http://www.intego.com/news/ism0705.asp. AV would not have helped dave123901,
even if his virus defs were updated hourly. Being more discriminating when
deciding what to install on his system would have been more effective, but
I'm not sure if a user education program would work to deter a college
student in his pursuit of pornography.

As security professionals, what should our message to Mac users be at this
point? The "install AV" message (note the absence of any additional
recommendation) is no longer appropriate for Windows users as it led to a
complacency that allowed other forms of malicious activity to flourish.
Should we make the same mistake with Mac users now that criminal
organizations (and not just security researchers) have taken an active
interest in attacking OS X boxes?

Non-helpful suggestions:
Macs are not vulnerable to attack, and therefore users need not worry
Mac users are more complacent than Windows users with AV

++++++++++++++++++++++++++++++++++++++++
Kevin Long
Risk Intelligence
Verizon Business Security Solutions
++++++++++++++++++++++++++++++++++++++++

[ reply ]