Pirated iWork 09 Creates Mac Botnet

Lisa Spangenberg, examiner.com, April 18, 2009

Back in January a pirated version of Adobe Photoshop for Mac OS X was released with a Trojan payload. Now, that Trojan has been revised, and it's been inserted into a pirate, illegal unlicensed installer for iWork 09. According to Symantec researchers Mario Ballano Barcena and Alfredo Pesoli, researchers who have published an article in Virus Bulletin (available only by subscription) there are now two separate variants of the malware, that Trojan has created a Mac zombie botnet. Zombie botnets are impromptu networks created by infected computers. The computers' owners are usually unaware that their computers have been corrupted by Trojans and other malware to create networks controlled by a stranger or group of malicious strangers who use the botnet to attack others in a variety of ways, including sending spam and creating DOS attacks. I note that it is not the first Mac botnet (see this), though it is being reported as such.

In the current incarnation, the modified iWork 09 installer installs an illegal copy of iWork in addition to two malicious files called OSX.Trojan.iServicesA and OSX.Trojan.iServicesB. These are installed in addition to the full software package. the Trojan exploits PHP and iServices. This article has some suggestions for removal. When the Trojans were first identified in January, most commercial anti virus applications were updated with tools to spot and remove the Trojan. SecureMac provided an iservices Trojan Removal tool that will check a Mac for infection, and then remove the appropriate files. Keep in mind, however, that there have already been variants of the Trojan.

click here to read the full article