Warning!!! Mac iWork Pirates: Trojans Everywhere

February 2, 2009 Mac Tips

Mac security firm Intego announced Thursday on a Trojan horse it spotted hiding in pirated copies of Apple’s (Nasdaq:AAPL) iWork `09.

What does the Trojan horse do?

Firstly, Mac installer packages are made-up scripts that install the applications and various files in the correct places on a Mac’s hard drive. Whilst installing iWork `09 , the iWorkServices package is installed, and the installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password.

The Trojan is installed as a startup item in /System/Library/StartupItems/iWorkServices,
where it has installed read-write-execute authorizations for root. The malicious software then connects to a remote server over the Internet and fundamentally holds open a door to the Mac.

This Trojan could scan the infected Mac for sensitive information, track Internet activity, record logins and passwords.

Intego stated that as of last night, 20 000 people have downloaded the pirated iWork `09 installer.

SecureMac is offering a free download - iWorksServices Trojan Removal Tool from its home page, that will remove the trojan from compromised Macs.

In an update to its original alert, Intego is now reporting that the iServices.A Trojan horse is actively “downloading new code and acting as a botnet, participating in distributed denial of service attacks on certain Web sites.”