OpenOffice worm hits Mac, Linux and Windows

Submit

update Malware targeting OpenOffice documents is spreading through multiple operating systems including Mac OS, Windows and Linux, according to Symantec.

According to the Symantec Security Response Web site, the worm is capable of infecting multiple operating system platforms and is spreading.

The advisory said: "A new worm is being distributed within malicious OpenOffice documents. The worm can infect Windows, Linux, and Mac OS X systems. Be cautious when handling OpenOffice files from unknown sources".

In an interview with ZDNet Australia on Thursday, Dr Jan Hruska, who co-founded rival antivirus firm Sophos and was one of the first ever PC antivirus experts, said that Apple Mac's are not a virus-free platform.

"Viruses on the Mac are here and now. They are available and they are moving around -- it is not as though the Mac is in some miraculous way a virus free environment.

"In terms of numbers, the number of viruses coming out for non-Mac platforms is higher. It gives a false impression that somehow Apple Macs are all virus free," said Hruska.

The worm was first spotted late last month but at the time, it was not thought to be "in the wild".

Once opened the OpenOffice file (badbunny.odg) launches a macro that behaves in several different ways depending on the user's operating system.

On Windows systems, it drops a file called drop.bad which is moved to the system.ini in the user's mIRC folder, while executing the Javascript virus badbunny.js that replicates to other files in the folder.

On Apple Mac systems, the worm drops one of two Ruby script viruses in files called badbunny.rb and badbunnya.rb.

On Linux systems, the worm drops both badbunny.py as an XChat script and badbunny.pl as a Perl virus.

Symantec rates the worm "Medium Risk".

Talkback

Quick Poll

What is the biggest data management challenge in your organisation?

Inconsistent data and overlapping sources
Rising management and maintenance costs
Scaling the database to meet business needs
Handling analysis of streaming data
Complexity in data security auditing and reporting databases
Inability to keep up with growth in requirements

ZDNet Australia Live

RT @SecMash: Lax data privacy laws hurt Australia - ZDNet Australia http://t.co/NaFCw4Xr #InfoSec

0 minute ago by Dr_Alexander_C on twitter, retweet

Lax data privacy laws hurt Australia - ZDNet Australia http://t.co/NaFCw4Xr #InfoSec

7 minutes ago by SecMash on twitter, retweet

Apple app developers may have copied your address book, despite it being against the rules which Apple has ignored http://t.co/C6PgoMQd

7 minutes ago by CTAspley on twitter, retweet

Lax data privacy laws hurt Australia: Australia may be setting a bad example and limiting its options when it co... http://t.co/f9CnwmTy

12 minutes ago by oztechguy on twitter, retweet

by http://t.co/vmlQ0Ecb: Lax data privacy laws hurt Australia: Australia may be setting a bad example and limitin... http://t.co/G0fEMhs7

17 minutes ago by InternetTechSec on twitter, retweet

LinkedIn posts strong Q4 earnings, up in after hours trading http://t.co/TJSBmtlT

17 minutes ago by EssenteeWeb on twitter, retweet

Twitter now available in emergencies with satellite providers: Twitter is being pumped up to save the day with t... http://t.co/Oz2xsX0K

17 minutes ago by twymy on twitter, retweet

Microsoft plans to release a flavour of Windows 8 on ARM chips http://t.co/10rKSoAs

22 minutes ago by zdnetaustralia on twitter, retweet

RT @zdnetaustralia: Why a $25 computer means revolution http://t.co/ufWQdLzT

27 minutes ago by WauloK on twitter, retweet

Senator Conroy imposes limits on amount of spectrum telcos can buy at Digital Dividend auction: http://t.co/PD7DNr4r

27 minutes ago by janeburton80 on twitter, retweet

Reminders: Be aware and beware @facebook's #rules. You could lose valuable rights | http://t.co/chuIKcIq | via @ZDNet | #socialmedia #smm

31 minutes ago by eeWeeProduction on twitter, retweet

Facebook: 60 million users access apps via mobile http://t.co/jLxQXuQM

31 minutes ago by islandmobile on twitter, retweet

Windows 8 Consumer Preview due February 29: why it's not called beta http://t.co/MEAZzVA6

31 minutes ago by Timothy_Hughes on twitter, retweet

RT @ldignan: New post: LinkedIn posts strong Q4 earnings, up in after hours trading http://t.co/Q95IUhzo

31 minutes ago by TDefren on twitter, retweet

RT @Timothy_Hughes: Windows 8 Consumer Preview due February 29: why it's not called beta http://t.co/sbPX5RwT

31 minutes ago by Angry_Saguaro on twitter, retweet

http://t.co/JaYhkJjV

31 minutes ago by ThaRebeliouZ on twitter, retweet

Armageddon of War 1.5 (Mobile): Top Hit Game for everybodyIdea is simple,Collect red items, Avoid green objects,... http://t.co/BqJhQRiO

31 minutes ago by Sheldonisms on twitter, retweet

Court agrees to speed up case over #Google's privacy policies http://t.co/hCf5CbQT | RT @ZDNet | #privacy

31 minutes ago by ChoiceZnewZ on twitter, retweet

RT @ZDNet: Facebook admits it needs to fight scams more efficiently http://t.co/O7DvYt87

31 minutes ago by InformaFinance on twitter, retweet

Twitter now available in emergencies with satellite providers http://t.co/dZUPbpj1

31 minutes ago by Tuiteventos on twitter, retweet

RT @zdnetaustralia: Why a $25 computer means revolution http://t.co/ufWQdLzT

31 minutes ago by techinbusiness on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

31 minutes ago by davidhickman13 on twitter, retweet

Facebook: 60 million users access apps via mobile: By Emil Protalinski | February 9, 2012, 10:01am PST Summary: ... http://t.co/Nq0TvzJY

31 minutes ago by Rothschild999 on twitter, retweet

New website hopes to improve the Federal datacenter consolidation process: New website hopes to bring together I... http://t.co/5yeK9VMO

31 minutes ago by datacenters on twitter, retweet

iPhone commands better resale value than Android or Blackberry: @danjames2012 I find it hard to believe that som... http://t.co/GryjHpQZ

31 minutes ago by RazMattic on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

31 minutes ago by nowdoit2011 on twitter, retweet

Court agrees to speed up case over Google's privacy policies http://t.co/NQxH2Ktq

32 minutes ago by informatica411 on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

32 minutes ago by spm221 on twitter, retweet

Why a $25 computer means revolution http://t.co/ufWQdLzT

32 minutes ago by zdnetaustralia on twitter, retweet

Twitter now available in emergencies with satellite providers: http://t.co/FxfaiPqi

32 minutes ago by rtehrani on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

32 minutes ago by acnMobility on twitter, retweet

RT @ZDNet: Twitter now available in emergencies with satellite providers http://t.co/ZKibHIsQ

32 minutes ago by john_fotiadis on twitter, retweet

Facebook admits it needs to fight scams more efficiently http://t.co/AHU5iPKV

32 minutes ago by JeffsTeamFreedm on twitter, retweet

Lenovo posts strong Q3 results: By Larry Dignan, ZDNet US on February 10th, 2012 (14 mins ago) Lenovo reported s... http://t.co/Ld0J83UF

37 minutes ago by LocalMobile911 on twitter, retweet

There is (or at least will be) a better way to fly ;-) http://t.co/SKyfCiiO

37 minutes ago by waldemarhein on twitter, retweet

invention these appreciate Every using after Numerous Not well ordering customer any custom route do make these current can consider of N...

48 minutes ago by gurbapagnonna on Abetz shifted in reshuffle

I'd say a reasonable amount of it would be. In the Queensland Department of Education's case, it said it was trying to make as much of it...

1 hour ago by suzanne.tindal on The application nation

Great article, Suzanne—couldn’t agree more. It is only logical for organisations – private or public-- to take a long, hard look �...

2 hours ago by kashe on The application nation

Every example of action against child molesters in this story related to internet protocols other than the www. This filter then achieves...

2 hours ago by Bob.H on Interpol defends voluntary filter

Soooo... it's okay for Apple to demand use of technologies and designs falling under competitors patents (considered "standards"), but on...

10 hours ago by MoWeb on Apple wants new rules for mobile patents

But I am having an intelligent conversation young fibes, my point is the lofty goal that all are equal is unfortunately not so. That is w...

12 hours ago by Doubt on NBN Co inks $620m satellite deal

May be so, but we do need to lighten up some of these people who are so serious. poor old fibretech nearly brings tears to the eyes and j...

12 hours ago by Doubt on Turnbull decries 'Rolls-Royce' satellites

The latest MS Windows update for XP tries hard to persuade you to update. For those machines that already have IE8 loaded it tries to re-...

13 hours ago by brak on Windows XP clings on as dominant OS

Will be interesting to see if he drives the qld gov political IT agenda or looks to address the IT challenges being faced by qld gov agen...

13 hours ago by Flly on Queensland's CIO returns to the post

So angry! NOKIA has forgotten the main purpose and the user function, and instead prioritised their industry level concerns. I bought my...

14 hours ago by spaceagesoup on Nokia skips Australia in Symbian Belle roll-out

I get what you mean in your context, meski. If the filter is like speed cameras, then people can alternately take side streets and back r...

15 hours ago by techkid on Interpol defends voluntary filter

Remind me again how people can get to a leadership position with absolutely no practical knowledge? I would ask Alexander how he intends...

16 hours ago by cleversoap on Internet won't always be anonymous: ITU

I was reading about DMARC at http://www.unlocktheinbox.com/resources/dmarc.aspx, perhaps they should try to implement something like this...

17 hours ago by wpfn on Phishing scam causes Telstra email woe

As you can tell, I'm a big follower. For AFL read NRL.

17 hours ago by phildobbie on The TV Now aftermath

Im not sure if David Gallop realises he now works for the AFL.

17 hours ago by katerich on The TV Now aftermath

That assumes that people see the stop sign. If you're using proxies, or whatever *all* the time, then these stop signs will never be obs...

18 hours ago by meski on Interpol defends voluntary filter

The advanced remote controlled machines reduce the human working rate from hazardous environment.

18 hours ago by Manasy on Robotic mining worth its high cost: Rio

Internet connection rate tremendously increasingly a lot.

18 hours ago by Manasy on Optus unveils NBN small business plans

content producers see Quickflix as a cheap and effective way of distributing copy-protected content in the Australian market.

18 hours ago by Manasy on Quickflix looks to avoid Netflix's failures

After this it could be very easy to identify the vulnerability products.

18 hours ago by Manasy on Body scanners coming to airports in July

This story has been voted 20 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

This story has been voted 10 times in the last 24 hours!

2 days ago, Symantec confirms hacker extortion

Keep up with ZDNet Australia

Inside ZDNet Australia

ZDNet / Worm / Story

OpenOffice worm hits Mac, Linux and Windows

Topics

Top related stories

Related gallery

Related stories

Talkback

Resource Centre Useful content from our premier sponsors

Quick Poll

ZDNet Australia Live

Facebook Activity

Keep up with ZDNet Australia

ZDNet Events Calendar

Plan Comparison

Sponsored resources

Inside ZDNet Australia

Services