It seems that a bunch of free screensavers have been infected with OS X/OpinionSpy.
http://www.zdnet.com/blog/security/malw ... ag=nl.e589
http://blog.intego.com/2010/06/01/integ ... lications/
 | | |
| Quote: According to the Intego’s security alert, despite the fact that the “market research” program also known as RelevantKnowledge, claims to collect only browsing and purchasing information, a deeper investigation reveals a much more intrusive approach. More details on what the spyware does once it’s executed, and the list of the screensavers bundled with it: * It opens an HTTP backdoor using port 8254 * It injects code, without user intervention, into Safari, Firefox and iChat, and copies personal data from these applications. Code injection is a form of behavior similar to that of a virus, and this malware “infects” applications when they are running to be able to carry out its operations. (It infects the applications’ code in the Mac’s memory, and does not infect the actual applications’ files on the user’s hard disk.) * It regularly sends data, in encrypted form, to a number of servers using ports 80 and 443. It sends data to these servers about files it has scanned locally, and also sends e-mail addresses, iChat message headers and URLs, as well as other data. This data may include personal data, such as user names, passwords, credit card numbers, web browser bookmarks, history and much more * If a user deletes the original application or screen saver that installed this spyware, the spyware itself will remain installed and continue to operate. | |
| | |
This is a well known Windows spyware module, which looks like it has now been ported to OS X.
Mish Inc's FLV to MP3 converter software is also "infected".
(This is deliberately included in a software bundle to help generate revenue for free software - by spying on the users.)
