New Tsunami Trojan Variant Discovered

Security researchers have discovered a new variant of the Tsunami Trojan targeting Mac OS, which can be used to turn your Mac into a ‘bot’ that participates in DDoS (distributed denial-of-service) attacks.

Security firm ESET said that the variant is similar to the threat discovered earlier this week but played down the risk it posed to computers running Mac OS X.

“The new version is similar to the previous version with two important differences. The first addition to this threat is that it now implements persistence on an infected system. It also has updated command and control information,” said Pierre-Marc Bureau, a senior malware researcher at ESET.

“The second difference identified in the new binary is a new command and control IRC server and IRC channel. At the time of writing, neither IRC servers are responding.”

Bureau theorised that the Tsunami Trojan was currently being tested as very few incidents of infection had been detected as yet.

“It is our belief that the people behind this threat are in the process of testing their creation. They are probably adapting the code, originally written for Linux, to the OS X platform. We are still unaware of any specific infection vector for this threat. It can be installed manually by an attacker or in an automated way.”

However, Bureau believes that the risk to Mac users is “limited” as the threat doesn’t have the “sophistication or complexity” of other current threats such as Duqu.

Rival security firm Sophos emphasised that the risk from Tsunami variants was currently low, though warned against complacency.

“Because we see considerably less malware for Mac OS X than we do for Windows, new Mac threats tend to make the news headlines. It’s important to note that the sky is not falling, and we believe the threat posed by OSX/Tsunami is currently quite low. Indeed, we have not received any reports from customers yet of infections by this Mac malware,” Sophos’ senior technology consultant Graham Cluley said.

“Nevertheless, it’s clear that someone is working on developing new versions of this code for the Mac platform and you have to presume they are not doing it purely for the intellectual challenge.”