You knew it had to happen sometime. Reports are circulating about a Macintosh worm, called OSX/Leap-A or Oompa-Loompa.
The file first appeared as a submission to a MacRumors.com forum as “latestpics.tgz†– a “package of secret screenshots” of the upcoming Apple MacOS 10.5, aka Leopard. When unpacked, the archive includes an application that resembles a JPEG file. When it’s clicked on, the file executes and attempts to propagate itself via the buddy list of Apple’s instant messaging software iChat.
Mega-programmer Andrew Welch, who is spearheading the story, is emphasizing that this should probably be considered a trojan horse, rather than a virus, “because it doesn’t self-propagate externally.â€
Andrew also reveals that the worm is not very well written – it has an error in its code that prevents it from working as intended and prevents infected applications from launching. Still, he strongly advises users that find the “latestpics.tgz†file to avoid downloading or running it.
Please note: You cannot be infected by this unless you do ALL of the following:
1) Are somehow sent (via email, iChat, etc.) or download the “latestpics.tgz” file
2) Double-click on the file to decompress it
3) Double-click on the resulting file to “open” it
4) …for many users, you must also enter your Admin password (if you are not currently logged in with Admin privileges).
UPDATE: It looks like the virus only affects users of Mac OS X 10.4.0 – 10.4.4 (Tiger) since it relies on the Spotlight feature to propagate .. and only on PowerPC systems (not the new Intel-based Macs) since it only affects Cocoa-based applications. NOTE: It does not appear to affect Macs using the latest Tiger version 10.4.5 – all the more reason to update.
This appears more to be a “proof of concept” than a malicious attack. Still always better safe than sorry.
Sophos, Intego, Symantec, and McAfee have all added the code’s description to their respective Macintosh anti-virus software files, which can be downloaded from each publisher’s respective Web site.
