Discovered: February 17, 2006
OSX/Inqtana.A is a Java-based worm that exploits the directory traversal vulnerability in the Bluetooth file and object exchange services in Mac OS X 10.4 (Tiger). (For details on the vulnerability, see CVE-2005-1333).
Inqtana is a proof-of-concept worm, coded with a stop date of February 24th and confining its spread to very specific bluetooth addresses. In other words, Inqtana in its current form poses no real threat to Mac users. However, antivirus vendor F-Secure advises that, "it is possible that some virus author will create similar worms that are not intentionally limited" and cautions Mac users to ensure their OS X installation has the latest security patches installed. At least three variants of the Inqtana worm are known to exist.
Inqtana spreads as an OBEX Push request. If the user accepts the data transfer, the worm exploits the directory traversal vulnerability to install itself, after which it then begins searching for other susceptible devices that will accept OBEX Push transfers.
Action upon infection
Inqtanta.A creates the following files upon infection:
/Users/w0rm-support.tgz
/Users/InqTest.class
/Users/com.openbundle.plist
/Users/com.pwned.plist
/Users/libavetanaBT.jnilib
/Users/javax
/Users/de
/Users/<username>/Library/LaunchAgents/com.pwned.plist
/Users/<user name>/Library/LaunchAgents/com.openbundle.plist
Manual removal
Delete the aforementioned files and install the latest security patches for Mac OS X.
As of February 22, 2006, three variants of the Inqtana Mac OS X worm were known to exist.
