DNS changer Trojan for Mac (!) in the wild
We received some reports of various companies (http://www.intego.com/news/ ism0705.asp) reporting about a Mac DNS changer Trojan in the wild. As I happened to receive a sample of it, I decided to analyze it quickly.
Context & Ripple Effects
Intego's October 31 security alert flagged a DNS changer Trojan circulating against Macs inside various companies, and within a day SANS Internet Storm Center handlers had obtained a live sample of their own to analyze rather than relying on secondhand vendor reports.
The significance is less the individual binary than what it signals: a monetizable, redirect-traffic Trojan aimed at OS X at a moment when most corporate endpoint defenses assume Macs are not worth attacking.
First-order effects
- Machines infected by this Trojan have their DNS resolver settings rewritten, so affected companies' Mac users can be silently steered to attacker-controlled lookups without any visible compromise.
- Security teams that excluded Macs from their Windows-centric malware monitoring now have a confirmed, in-the-wild sample forcing them to treat OS X endpoints as in scope.
Second-order effects
- Mac-focused security vendors such as Intego gain a concrete sales argument with enterprise buyers, shifting detection tooling demand from optional to budgeted for mixed Windows-Mac fleets.
- DNS-based redirection puts pressure on registrars and DNS operators as the choke point where hijacked lookups can be detected or blocked, since endpoint cleanup alone does not undo poisoned caches.
Third-order effects
- If DNS-hijacking proves profitable on OS X, the platform's low-attacker-interest era erodes structurally, pushing Apple and enterprise buyers toward built-in verification and default-deny controls rather than reliance on market share as a defense.
- Repeated incidents of this class would push incident-response practice toward treating name-resolution integrity as a monitored control across all operating systems, not a Windows-only concern.
The trend: Mac malware is crossing from proof-of-concept curiosity to operationally profitable attacks, with DNS manipulation an early monetization vector.