RSSPirate to pwned with Apple's iWork '09
By Angela Gunn | Published January 22, 2009, 6:05 PM
File sharers picking up pirated copies of the newly released iWork '09 apps suite may be biting into a poisoned Apple. Various Mac-security sites and sharing sites such as BitTorrent are reporting that some versions of the file are carrying a Trojan that can phone home and install additional malware.
PC users are encouraged to console their Mac brethren about what sounds, frankly, like a rather familiar scenario. The Trojan, which Intego is calling OSX.Trojan.iService.A rides along with the pirated versions of iWork as a package called iWorkServices.pkg. It installs as a startup item during the usual installation process and gets in contact with a remote server. What happens next can vary, but considering that the Trojan gives itself read/write/execute permissions, it's capable of doing anything from grabbing more malware to turning into a botnet-style zombie under the command of a remote server.
A Mac botnet? There's an exciting prospect; as a security professional of our acquaintance points out, with Mac's superior multitasking, such a bot could percolate along in the background with relatively little effect on the machine's overall performance. That could, ironically, make detection much harder, since users wouldn't notice that anything was sluggish or otherwise wrong.
Tens of thousands of people are believed to have downloaded the karmically enhanced version of iWork '09. Readers who suspect they've caught a dose of the compu-clap should check /System/Library/StartupItems for iWorkServices. If it's present, a reformat and clean reinstall is recommended, with apps reinstalled from master disks rather than backups.
"A Mac botnet? There's an exciting prospect; ...."
That's exactly what it was designed to do. How do I know this? I was the target. I don't know how/why I was able to capture the attention of the person who launched such a malicious attack, but it was very effective. Fortunately, I was able to enlist people to thwart it and we didn't lose our business entirely.
Further details of this iWork trojan and it's task can be found in this article at the Washington Post:
http://voices.washington...ects.html?hpid=sec-tech
Be Safe!
Best Regards,
John
Score: 0
|(reading SF update) Mr. Valente, WOW -- what a rotten experience. Glad your new ISP had the know-how to fight it off. Keep us updated, won't you? (Love to hear more in any case; if you prefer, I'm at ag@betanews.com...)
Score: 0
|But most software I download from bittorrent has viruses these days... it's like sharing a needle in a back alley. Why is this news?
Score: 0
|Why is this news?
Two reasons.
First because Apple was mentioned.
And two, because so many idiots here think that by one voluntarily installing a trojan application that works exactly as designed, that this is the same as contracting a virus in the wild. LOL!
So...on second thought...make that one reason.
Stupidity.
Score: 0
|internetworld7, where are youuuu!
Score: 0
|Hmm..Anti Virus company must be happy with this news. One more reason for them to sell their products now :).
Still remember the slogan, no need anti virus for Mac, since Mac is secured by design.
But how secure if there are people who still downloading pirated software and the pirated software have trojan?
And guess what, no need antivirus for Mac.
This would be fun.
Score: -1
|Voluntarily installing a trojan application is not the same as acquiring a virus in the wild on a sandboxed system where the most damage that a virus can cause is to crash the program running in the sandbox, and the solution is a VERY complex procedure called "delete".
Anti-virus softwre has NOTHING to do with this issue. Operator stupidity in installing a program that is functioning exactly as designed is the problem!
...Obviously a shortcoming you have yet to resolve.
Get a clue, fanboy.
Score: 0
|I'ts about time those macs hold up their end of the botnets -- windows machines were doing all the work!
Score: 1
|lol...at 2 things.
The obviousness of inevitable infection...and "superior multitasking"...at least I'm glad that Macs are known for that now. I remember the days when I could only do one thing at a time on the macs...save a file and go for a coffee break. "shudder" ;)
Score: 1
|LOL, it had to happen. All those Mac morons (fan boys) out there think that their iCraps with crap OS X are immune to viruses. It's all about market share. All systems have had and will have security holes. This is a trojan and it doesn't exploit security hole :(
Score: 0
|What is even funnier is to listen to nitwits who still think the Mac is IMMUNE to malware!
That is a strawman if ever there was one.
Especially as this is NOT a virus, genius! It is, as Tool correctly notes below, a social engineering trick to get an operator to install a malicious application - an application that is working exactly as designed! There is NO true compromise whatsoever! And as he correctly observes, no OS design can protect itself against stupid operators who think they are putting something over on the man as they voluntarily install crap on their own system.
So what was it that you were saying about viruses and malware?
But then geniuses like you who claim to understand OS security design, STILL fail to acknowledge the fundamental architectural advantages that make OSX and FreeBSD and other OSes that employ said techniques such as sandboxing that render the designs more fundamentally resistent to compromise.
Of course, they don't have the benefit(sic) of the fatally flawed ActiveX as a fundamental part of their OS either! LOL!
Thus preventing an acquired virus from compromising and taking over the machine - something that is almost routine in the world of Windows.
How about trying to frame the question in a manner reflecting just a modicum of intelligence? As both the Mac morons who blindly believe OSX is "immune", AS WELL as the myriad idiots who claim that OSX is JUST AS insecure as Windows, if only more used OSX, simply continue to perpetuate the abject stupidity all too present in both camps.
Score: 0
|Karma
Score: 0
|Score: 0
|lol -1 for UAC. It annoyed the hell out of me today...
Thank goodness I don't use Vista. Win 7 aint jumping out the walls of my VM yet either lol
Score: 0
|Watch out, Linux is next!
Score: 0
|The Kernel (which?) the Dist (which?)
Score: 0
|Bookmarked for every time iTard7 opens up his yawning chasm of stupid in the future.
Score: 0
|Toolie,
Me buddy, I've no idea where iTard7 is, indeed his lack of eloquent insights into the wonderful world of "I" on this thread have been noted. Perhaps his somewhat magical world of unibodies, has been "bricked". Yep, pun intended with my usual magnanimous malice (may not respond to all your junkie post, but am cursed with an eidetic memory).
Anyway, what was this thread about? Time to put on the "Googles" perhaps,.
No, in fact it's time to install this app, courtesy of RapidShare, and ors'.
Was considering at the very least running Clam post install, but don't care, if I get hit so be it.
Install will be done on revision A of the MBA, if there is a bot I'll let you know.
As an aside, even if there is "shrug", my next trick will be to install Windows 7 on a bootcamp (who came up with that term), that there will be no rightclick won't matter, unlike most posters' here I'm prepared to admit feeling joy sticky, and cannot often do 2 at once!
Think about it.
Score: 1
|"think about it"
I would, but I lost interest after "magical world of unibodies."
It turned into an annoying buzzing noise after that. Had to turn up my speakers to drown it out.
You should really do something about that. ;)
Score: 0
|I have no idea what you are listening to Toolie! Perhaps it's your "Steely Dan", me I have on my Halcro DM 65's (yep, made in OZ), with JMLabs Gran Utopia's (French, eat your heart out Bollywood_), the House Martins "Caravan of Love".
As an aside re read what I said, the flame was directed to an anticipated response to the DaveBG, or Pitdingo style of post, pre-empting is I think is the operative term, please humble me should I be wrong.
Whilst typing this this, tune has moved to the next track, Joan Armatrading "Give me Love". Awesome stuff, play it loud and when you get to our age you can hear it.
I know this is very off topic, but where is the fat controller?
Sorry, shoulda had my "googles" on, but I'll post it anyway.
Score: 0
|Listening to: Unwritten Law - Coffin Text. :)
My tastes in music range from Traditional Irish folk, to Metal, to even some country and pop. The only genre I really don't care for is Opera.
*shrug*
Tastes vary wildly... YMMV. Jango is my friend (even better if they'd get some Harvey Danger tracks).
Score: 0
|Now if it only had that "annoying" Vista pop-up to warn you? Maybe you would have been more careful.
I will say that System Restore is by far the best feature ever put on a Windows system. I would imagine that the "Time Machine" would work for Mac too, right?
Score: 0
|LOL, you serious?? UAC is almost as ineffectual as System Restore. And from what I've read, Time Machine is more like TrueImage or Ghost than System Restore.
Score: 0
|BWAHAHAHAHA
Score: 0
|All BS...!!! no way a virus can get on a mac!! I save alot of money not buying security software!!1
Score: 0
|*chuckle* Loving the satire but you must remember to either write in all-caps or add the traditional !!!!!!1 punctuation. What if someone thinks you're serious and starts a platform flame war in a Betanews comment thread? Whatever would we *do*?
Score: 0
|FWIW: This isn't a virus. It's a social engineering trick to get the user to install a malicious program.
No OS on the planet protects against stupid.
Score: 2
|Ahahaha, i've been predicting this for like 2 years. And my predictions are now becoming a reality...
It's nothing but good old market share. As soon as something gains larger userbase it'll become a target of malware writters. Of course no one wanted to believe me back then...
Score: 0
|Forgive my ignorance, but are they suggesting a reformat and clean reinstall of the entire OS in the last paragraph?
Score: 0
|Yep that's what they are saying.
Score: 0
|Yeah. With a trojan like this nasty little thing, you can't really tell if it's gone and installed other software elsewhere on the system. (In fact, the more I read the more I think you should just assume it does. Ick.) Only way to be absolutely sure is to wipe and start over, I'm afraid.
Score: 0
|Amazing that the solution to a trojan on the Mac is to reformat and reinstall the OS. I did a quick search for trojan removers for the Mac and there ARE programs out there. How many trojans out there for Windows do you know that the recommended solution is to reformat and reinstall the OS? Of course some can get nasty but seriously... That's sad.
Score: 0
|Um, actually, once a modern trojan has gone "live" in Windows, you're pretty much screwed. Not many AV programs can reliably remove a serious infection nowadays since the trojan immediately downloads randomized malware that is usually too new to detect. Its like LiveUpdate from hell.
Score: 0
|"Only way to be absolutely sure is to wipe and start over, I'm afraid."
You mean Mac users are finally going to learn how to install their own OS... or is it going to be yet another task delegated to a "Mac Genius"? :-)
Score: 0
|[Extract from Intego's website, related to the iWorkServices]
[... ] Intego VirusBarrier X4 and X5 with virus definitions dated January 22, 2009 or later protect against this Trojan horse. Intego recommends that users never download and install software from untrusted sources or questionable web sites.[...]
Anyway what I really wanted to say is that since the 1st launch of OSX the mac user's world consists of two distinct kind of users: the absolutely non-technical mac users (the traditional ones grabbed by Apple's marketing) and the ones coming from UNIX/Linux world (for various reasons)
These users know exactly why they chose to use Mac and they know exactly what's running under the hood of their Mac systems. I pretty sure they just rolled out laughing when this announcement appeared :-) And laughed even more when they saw the "format and reinstall from scratch" wise advice :-)
Score: 0
|I would guess they need a "genius" hehe
Score: 0
|Unless you have access to "services.msc" and a good "start-up repair" utilit...and google helps.
:)
Score: 0
|"are they suggesting a reformat and clean reinstall of the entire OS in the last paragraph?"
Only as many may have backups made SINCE the Trojan application was installed!
If you have a certifiably clean backup, you can of course use it, as to my knowledge, nothing in the BIOS has been modified by the Trojan.
But based on the all too many reactions of others here, there is ample demonstration they are as stupid as the idiots who voluntarily installed a trojan application that is functioning exactly as designed!
The has everything to do with operator stupidity and NOTHING to do with OS security!
What is needed is not anti-virus software, but anti-idiot operator protection.
Score: 0
|"What is needed is not anti-virus software, but anti-idiot operator protection."
Sales of Mac OS X and Windows would surely plummet! The economy *depends* on these idiots. The fact that you could even suggest such a thing goes against capitalism, democracy, and everything this country was founded upon! You, Sir, are a traitor to your Nation.
;)
That was fun. I should try out for the apparently vacated "internetworld7" position.
Score: 0
|