How did you first find out about this Trojan horse?

Intego first heard about this from a Mac user who sent an e-mail message to our customer support department on April 6, 2004 at 11:16 am. This user provided us with information regarding this Trojan horse. This user also sent this message to Apple, Symantec and McAfee.

It has been known for some time that you could "hide" an application on Mac OS X as another type of file, simply by changing its name. Why is this Trojan horse different from any application whose name has been changed to, say, Song.mp3?

First of all, Mac OS X runs two types of applications: Cocoa and Carbon. Cocoa applications are native OS X applications, and have an .app extension. Cocoa applications are, in fact, folders containing all the bits and pieces of a program-code, resources, graphics, etc. The .app extension tells Mac OS X that an application is going to run natively.

Carbon applications are different. Most Carbon programs can run under either Mac OS 9 or Mac OS X, and, for this reason, have no .app extension. The Mac OS knows they are executable programs because of two resources, carb and cfrg. The carb resource indicates that it is a Carbon application and the cfrg resource indicates the location of executable code in a file's data fork.

This Trojan horse is, in reality, an MP3 file, to which the two resources mentioned above (carb and cfrg) have been added. In addition, the ID3 tag of the MP3 file contains the actual code of the Trojan horse and the cfrg resource contains a pointer to that location in the file's data fork.

(ID3 tags are an integral part of MP3 files: they are designed to contain information such as song titles, artist and album names, etc. These tags also exist in AAC files.)