Mac antivirus maker, Intego, have published an interesting alert about a potential OS X virus that an enterprising individual is trying to sell through auction. With absolutely no technical information to go on, the antivirus maker is treating the announcement with caution.
Based on the rate and type of vulnerabilities identified by projects like the Month of Apple Bugs it isn't too far fetched to expect that there are dozens or even hundreds of OS X specific viruses/malware creations that are sitting on the systems of their developers but which do not have many opportunities for widespread distribution.
Some of the more successful OS X-specific pieces of malware have been distributed through file sharing sites and P2P applications, usually claiming to be for highly desirable software. A 5-10MB download for an application suite that should be 500-600MB generally leaves clues as to something not being quite right. More common, though, are exploit attempts against QuickTime and popular OS X web browsers, with US developer Sunbelt Software having identified and tracked a number of these types of vulnerability, though their effectiveness at infecting OS X targets in the wild isn't known. The exploits used in these types of attack will compromise a victim's system, but there aren't any readily available figures as to how many victims have actually been affected by them.
From Intego's posting, it appears that the enterprising auctioneer seems determined to make sure that his name is one that is not forgotten when it comes to Apple security, claiming that his exploit is a poisoned ZIP archive that will "KO the system and Hard Drive" when unarchived. He may not be operating on the scale of David Maynor, Tom Ferris, or Kevin Finisterre, and there might not even be the kernel of truth that InfoSec Sellout had with their claimed OS X malware, but it is feasible that there is something in the OS X Archive Utility that lends itself to exploitation and system control like the recent ARDAgent vulnerability did.
From appearing on July 21, to disappearing soon after Intego's post, there is more mystery than substance about the hacker, the claimed vulnerability and the site itself. There are plenty of ways to take an OS X system to its knees by manually launching malicious software or content, there just aren't very many that have demonstrated a capability of being set up for malicious use (despite their potential) and there are even fewer that demonstrate any sort of viability for (semi-)autonomous spreading.
Time will tell, but it's possible that Intego has stumbled across something that could cause as much interest as last year's InfoSec Sellout soap opera.