A blogger claiming to have written a worm -- called Rape.osx -- for Apple Mac OS X has received death threats.
Last weekend in the US, someone using the name Infosec Sellout posted on the BugTraq mailing list news of a worm exploiting a vulnerability in mDNSResponder -- a component of Apple's Bonjour automatic network service.
Apple patched the mDNSResponder vulnerability in May, but the author claims there remains an unpatched vulnerability. They also claim to have a proof-of-concept worm ready to go but says he won't release it. In a security vendor blog, McAfee quotes the author as saying he was compensated for this work.
The author suffered harsh criticism from security colleagues for hiding behind a pseudonym, and for not providing any proof of the worm. He also reportedly received death threats in reader posts to his blog site.
In response, Infosec Sellout says in a blog post that he removed all prior postings on his blog site. Yet, last night in the US someone else claiming to be Infosec Sellout claims the site in question, called Security Information, is not the real Infosec Sellout blog site, but a hijacked site, hence the lack of prior posts.
One of the names thought to be behind the hijack of Infosec Sellout is David Maynor of Errata Security, who might be using the name "LMH".
Last summer, during BlackHat USA, security researchers David Maynor and Johnny Cache disclosed a wireless vulnerability using an Apple Computer Macbook. The team found that malformed network traffic could allow the laptop to be compromised, and they provided a video of the attack.
The researchers did use a third-party wireless card for their video demonstration, but said repeatedly that the Apple Airport wireless driver was also vulnerable. Two months after BlackHat, Apple quietly released a patch which, if the vulnerability that was fixed had been exploited, could have compromised the Airport wireless drivers in MacBooks.
This morning in a post on the Fuzzing mailing list, someone calling himself David Maynor responded. In a post called "The Truth", the author using the name LMH says he is David Maynor and then proceeds to confess that after last summer he needed to hide behind the name "LMH" to get the word out about new vulnerablities.
Yet if you go over to the Errata Security blog site, the real David Maynor says the Fuzzing mailing list post is a sham, and cites several factual errors.
ZDNet Australia's sister site CNET News.com took the text and put it through Hacker Factor Solutions Gender Guesser and it appears a male did indeed write the Fuzzing plot.
Yet, based on the words chosen and sentence length, the tool also suggests it was a male European who wrote it. David Maynor has been based near Atlanta, Georgia for years.
Despite the intrigue, the malware threat to Mac customers is growing. Apple has plugged around 100 vulnerabilities in OS X so far this year.
Software vendor CA's VP of development, Eugene Dozortsev, in a video interview with ZDNet Australia last month said: "... the Mac is as vulnerable as everything else ... Don't make any false assumptions that there are no viruses on Mac. A lot of things like trojans and e-mail worms [affect the Mac] the same as they would in the PC world."
Dr Jan Hruska, who co-founded antivirus firm Sophos and was one of the first ever PC antivirus experts, agreed that Apple Mac's are not a virus-free platform. "Viruses on the Mac are here and now. They are available and they are moving around -- it is not as though the Mac is in some miraculous way a virus free environment," he said in a video interview early last month.
A recent threat, for example, that affected some Mac users was called Badbunny, which was a worm that threatened OpenOffice documents. However, it was attacking the open source office productivity suite rather than the Apple platform itself.
ZDNet Australia's Munir Kotadia contributed to this report.
Can we mac users get a list of these virus that are here and now and moving around??
Sure would be super.