Gadget gift ideas and product recommendations from ZDNet editors.
The Great Debate series aims to emulate an Oxford-style debate, with a dash of Fight Club mixed...
After years of development, Microsoft takes the wraps of its next-gen operating system.
See the managed print services conversation come to life.
Happy birthday, ZDNet! Twenty years ago, this site began as a subscription-based digital service...
The Trojan — called 'OSX.RSPlug.D' by Intego, the Mac security specialist that discovered the threat — is a variant on an older piece of malicious code but with a new installer, Intego said.
"It is a downloader, and it contacts a remote server to download the files it installs," Intego said in an advisory. "This means that, in the future, the downloader may be able to install payloads [other] than the one it currently installs."
In other respects the Trojan is similar to previous versions of RSPlug, which first surfaced in October 2007, Intego said. It installs a piece of malicious code known as DNSChanger, which routes the user's internet traffic through a malicious DNS server, leading users to phishing websites or pages displaying advertisements.
The Trojan is found on porn websites posing as a codec needed to play video files, a technique used to trick the user into downloading and installing it.
Intego said OSX.RSPlug.D has been widely confused with a separate threat publicized this week by several security firms. That threat is called OSX.TrojanKit.Malez by Intego and OSX.Lamzev.A by other vendors, including Symantec and Trend Micro.
OSX.Lamzev.A is a hacker tool designed primarily to allow attackers to install backdoors in a user's system, according to Intego. However, the company dismissed the tool as a serious threat because a potential hacker has to have physical access to a system to install the backdoor.
"Unlike true malware and Trojan horses, OSX.TrojanKit.Malez requires that a hacker already have access to a Mac in order to install the code," Intego stated.
Other antivirus vendors noted that Lamzev could be disguised as a piece of legitimate software and used to trick users into creating the backdoor themselves.
Lamzev is not related to RSPlug, despite several high-profile reports confounding the two, Intego emphasized. "This hacker tool has nothing to do with the RSPlug Trojan horse," Intego stated.
Security vendors have long warned that the Mac platform is not as secure as some users might like to believe. Apple had not responded to a request for comment at the time of publication.
Get the best of ZDNet delivered straight to your inbox
Get geared up for whatever the office environment throws at you.
The latest version of Mary Jo Foley's Microsoft Codename Tracker is ready for download.
Facebook's privacy and security settings have changed massively. It's time to catch up and ensure your settings are up to date.
In the world of business and technology, what's different? What's unchanged?
