Many believe that Macs are immune to viruses. One recently detected Trojan horse that affects Mac OS X debunks that myth, however. SecureMac, a site dedicated to Macintosh security, reported the discovery of the Boonana Trojan horse in a bulletin on its site earlier this week.

The Boonana Trojan, or trojan.osx.boonana.a, is using popular social networking sites to spread itself. Facebook has been a common choice for many hackers lately,  and it seems to be at the center of the Boonana situation. The virus disguises itself through a link in Facebook messages that have the subject “Is this you in this video?” If the user clicks on the link, a series of infective actions begin to take place on their computer.    

First, a Java applet that downloads various files to the computer is run. One of the downloaded files includes an installer. The installer launches on its own and modifies system files. When it modifies the files, it eliminates the need for passwords. By doing so, the Trojan grants outside access to whatever computer files the hacker may need. 

From that point on, the Trojan runs when the computer is started. To avoid detection, it runs invisibly in the background. It then attempts to spread itself to other computers by hijacking user accounts on the infected system to send spam messages. Some users have reported that Boonana uses emails in addition to social networking messages for spreading purposes. As the virus is active, it sends reports to command and control servers from time to time that provide information on the infected computer. To hide itself, Boonana uses masked code across multiple files. If the primary servers are unavailable, it attempts to contact additional command servers.

Boonana affects Mac OS X, including the latest Snow Leopard OS X 10.6 version of the operating system. It can also affect Microsoft Windows, since its Java component is cross-platform. Mac users can download a free removal tool from SecureMac to eliminate the virus. To protect themselves from infection, Mac users can also disable Java in the Safari web browser. To disable Java in Safari, go to Safari Preferences and click on the Security tab. Look for the Enable Java box, and make sure that it is unchecked.

In addition to using the free removal tool and disabling Java, SecureMac's bulletin also offered other web surfing tips to prevent infection. When downloading files, only do so from trusted websites or from sources you know. The same holds true for browsing web pages. 

A large number of sites on the web are infected, and visiting an unknown site could result in compromising your online security. If you receive an email or message on a social networking site, do not click on any suspicious links. If you have to, send a message to the friend first to confirm that they actually sent the link themselves. Many users whose accounts have been hijacked can unknowingly send messages to others that contain malicious links. Finally, use updated security software and a firewall for added protection.    

For more, visit http://www.securemac.com/boonana-bulletin.php

DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware.

More Web Hosting Security Articles
More By wubayou