Renepo/Opener was an excellent example of what is possible, in particular because it revealed how a user-level process could place an executable in the user's StartupItems directory, which would then be run with root privileges upon next boot. It did cause quite a stir.

But it was never found in the wild. It also required a user be socially engineered to execute it, or else the attacker would need physical access to the machine.

OS X is far from indestructable! Jason Miller wrote a good article proving that point. That's not what this article was about, though. For example it would not be very difficult to modify the Opener.sh Bash script and help it propagate in the wild. But no one has done that yet - and hopefully, no one will.

Regards,

Kelly Martin

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/319/31485#31485