Second OS X virus exploits Bluetooth flaw

Second OS X virus exploits Bluetooth flaw




Security experts have reported a new OS X proof of concept virus that spreads using a known vulnerability in the way that the operating system handles Bluetooth wireless communications.

F-Secure referred to the worm as OSX/Inqtana, and emphasized that it is only a proof of concept worm and is unlikely to cause any actual harm.



"Inqtana.A has not been met in the wild and it uses Bluetooth library that is locked into specific Bluetooth address and the library expires on 24 February 2006. So it is quite unlikely that Inqtana.A would be any kind of threat," said Jarno Niemela, a researcher at F-Secure's laboratory.



Apple provided a security patch for the exploited vulnerability in June 2005.



The worm poses only a limited risk as the user is prompted to accept the file.



Upon infection, the onlie pest installs itself in a directory where it will automatically be activated on the next system reboot.



F-Secure urged OS X 10.4 users to upgrade their systems and posted instructions on its website on how to remove the worm. The security vendor doesn’t offer any Mac anti virus products.



The Inqtana.A worm is the second virus is as many days that's targeting Apple's OS X operating system. Last Thursday virus companies reported that they had spotted the Leap-A worm in the wild.



Individuals on Mac forums blasted the report, claiming that the worm was in fact a Trojan and not a worm. Apple too claimed argued against the worm monicker because it requires the user to download the application and manually execute the file. But several security vendors including F-Secure, Symantec and Sophos persisted in describing the pest as a worm because self-propagates using the iChat instant messaging client.



Critics also downplayed the report because the worm didn't exploit any actual software vulnerabilities but instead relied heavily on social engineering to infect systems.