Internet Security and Programming

A tool for exploiting an unpatched security hole in Mac OS X systems has been developed and until earlier today was being distributed through an online forum that caters to Mac hackers, Security Fix has learned. The exploit tool, labeled “Applescript Trojan horse template” by hackers at Macshadows.com, appears to be a collective and ongoing effort to create a package of malicious software that capitalizes on the ARDagent security hole first publicized last week. The vulnerability essentially allows any program to run on a Mac user’s machine without first prompting the user to enter his or her user name and password. The first Macshadows.com post on developing this Trojan, dated May 18. Currently, the Macshadows user forum appears to have been wiped clean, both from the Macshadows.com Web site and from Google’s cache. However, Security Fix obtained screen shots of forum postings from the code’s authors, which are sprinkled [...]

Read more…