Mac security firm Intego has issued a warning about a Mac twist on a
two-year-old Windows spyware app that sends a variety of potentially sensitive
information to external servers. Dubbed "OSX/OpinionSpy," the spyware is
installed along with a number of widely available third-party Mac OS X
screensaver modules, as well as with at least one shareware tool to strip audio
tracks from Flash videos.
OSXOpinionSpy, aka PremierOpinion, claims in some cases to be a tool to help
collect browsing habits for "market research," while in other cases it installs
without any notification. The application runs in the background with root
permissions, opening an HTTP backdoor. It scans any attached volumes, sending
encrypted information to a number of servers, and can also examine packets
coming and going from an infected Mac, potentially grabbing information from
other computers on a local network. Finally, it injects code into running
versions of Safari, Firefox and iChat, sending a variety of information—e-mail
addresses, iChat message headers and URLs, as well as other data—back to command
servers.
