Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Here's how it goes down.
We write the article. The politically-sensitive Apple fanbuoys come out swinging, saying we only write about Apple malware because we're down on Cupertino.
The artistic fanbuoys (Apple users who are in a band, for example) chime in even more fiercely, saying Mac malware is a figment of everyone else's unimaginative delusion.
The geeky fanbuoys (the ones who know where bash is, and what it's for) come out firmly to remind us - utterly without any accuracy - that if it doesn't ask for the Admin password, it can't be malware.
And then the long-suffering but battle-hardened Windows users pop up and say, "Back in 1991, we felt the same way. It didn't end well." Those of a philosophical bent repeat, with sincerity and concern, the words of George Santayana. "Those who cannot remember the past are condemned to repeat it."
So, with a deep breath, here's some Mac malware news.
There's been a touch of fuss in the media about it, which is the first reason we thought that we ought to tell you about it; the second reason is that it has an engagingly curious name: NetWeird. (No, I don't know why, either.)
NetWeird is interesting primarily because it is uninteresting. It's not very well written; it's not very well tested; it's probably not going to catch you unawares (but watch out if you're in a band!); and so far as we can tell, it's not in the wild.
But someone has gone to the trouble of creating it and, according to our chums at French Mac anti-virus outfit Intego, is actually trying to sell it on the underground market for the ambitious price of $60.
And that makes it interesting: it seems that the crooks really are getting into the habit of churning out new Mac malware, not to show how clever they are, but merely to see if they can repeat the trick that's worked on Windows for years: making money out of next to nothing. Those who remember the past often choose to repeat it, especially if there's money to be made.
And now about the malware.
NetWeird installs itself into your home directory as an application bundle called WIFIADAPT.app.app. That makes it rather obvious.
It adds itself to your login items, presumably with the intention of loading up every time you reboot your Mac. But a bug means that it adds itself as a folder, not an application. All that happens when you log back in is that Finder pops up and displays your home directory.
NetWeird also calls home to a hosted server located in The Netherlands. This makes it a bot, or zombie.
Bots use an outbound connection to listen for command-and-control signals from a cybercrook known as a botmaster. This works because a TCP connection, once established, is fully bidirectional, so the client side can behave as a server, and vice versa.
The commands that the bot can process allow it to run arbitrary programs via the shell, monitor running processes, take screenshots, exfiltrate files, and to rummage through the password files of well-known third-party browsers and email clients Opera, Firefox, SeaMonkey and Thunderbird.
You're not likely to see this thing, but if you do, Sophos Anti-Virus will mop it up for you under the name OSX/NetWrdRC-A.
If you do get infected, deleting the above-mentioned application bundle and rebooting should get it off disk and out of memory.
That's about all you need to know about it.
Follow @duckblog
-
Stirrer image courtesy of Shutterstock.
Tags: apples, bot, cupertino, Malware, netweird, netweirdrc, netwrd-a, OS X, osx, Trojan, zombie
After agreeing earlier in the month to cough up a record $22.5 million in a settlement with the Federal Trade Commission for sneaking tracking cookies past Safari browsers' no-tracking controls, Google is creating a privacy "Red Team" to police its products' own privacy bugs and dangers. 
In March this year we wrote about Pwnium, Google's "hack the Chrome browser for money" competition run at the CanSecWest conference.
MPs in the New South Wales Parliament couldn't resist perpetrating an online prank on one of their number earlier this week.
You should work on the assumption that bad things could happen at any time. Then take a defensive security posture to suit that assumption.
It looks like the whole Facebook-not-deleting-your-photos-when-it-said-it-had saga might be coming to an end.
Megaupload founder Kim Dotcom has been facing extradition to the US for serious charges, including racketeering and money laundering, related to his file-sharing service. 
This police raid - where 18 luxury vehicles were seized, $11 million (NZ) in cash was secured from bank accounts, and 150TB (yes, Terabytes) of data was taken - was later considered illegal, reported Ars Technica. 
Geolocation and related technologies that keep track of you and your devices have loomed large and Big Brotherishly in recent Naked Security coverage.
Of all the call home signals received by Apple's infrastructure, you'd want to bet that a beyond-the-grave WHOOP! WHOOP! STOLEN IPAD ALERT! report from a Jobsian device (and in this context, I mean Jobsian quite literally, not merely in a general economico-spiritual sense) would enjoy the same sort of special attention as "Friend Request from Elvis" and "Voicemail from Alexander Graham Bell."