BTW o virech a malware na apple
run Mac OS 10 so I don’t have to worry about spyware and viruses”
(Apple, Inc,. Television Advertisement
http://movies.apple.com/movies/us/apple ... 80x376.mov)
Common attitudes behind this complacency include;
i) You need a system pass to infect my Mac.
ii) There are no malware problems on a Mac.
iii) Macs are immune to malware.
The result of these ill-founded beliefs is a complacency that seriously compromises the
ability of the user to make informed decisions when dealing with a malware threat. This
complacency can potentially nullify the effectiveness of the new sandboxing technology in OS X
10.5 Leopard.
Hidden Extensions
A file extension is designed to tell the system and the user what kind of file they are
dealing with. Some examples of system extensions are .exe (a Windows executable program),
.app (a Mac OS X executable bundle), and .jpg (a common digital photo format).
Both Microsoft Windows and Mac OS X offer the ability to hide the extension from the
user. This is often used to disguise the true nature of file from the user. If this hiding is combined
with a less technically-oriented user (the majority of all users) then a Trojan can exploit this to
hide its own true nature.
Applications on the Mac OS X system are structured using an architecture called a
“bundle”. A bundle is a special folder that pretends to be a single file. The advantage of this, for
programmers, is that it allows multiple resources to be contained in one single folder that is, from
the users’ perspective, indivisible.
How This Assists Malware
The structure of the bundle architecture makes it easier to piggyback executable code
within an existing trusted application by simply renaming the existing executable iTunes found
in the MacOS subfolder and inserting a second executable into the MacOS folder with the
original’s executable name.
When the user executes the bundle (in this case iTunes.app) the virus code would execute
instead. The virus would then launch the renamed iTunes executable so that the user would not
be aware they had run the wrong program.
Mac OS X also makes use of the bundle architecture for storage of user documents in
many modern applications such as iMovie, iDVD, and the many pro tools. These bundles
typically have their file extension marked invisible so it is possible to disguise an executable
program as a data “file” for such a tool. These bundles can open both their own malware code as
well as the desired real application whilst conserving the look and feel of the real data.
This technology makes the process of creating a virus easier since the bundle architecture
greatly assists the process of installing multiple executables into one “program”.
Reproduction is
greatly simplified since the same architecture is used on most OS X applications. 
