Slashdot Log In
Trojan Hides In Pirated Copies of Apple iWork '09
Posted by
timothy
on Thu Jan 22, 2009 10:40 PM
from the good-reason-not-to-pirate-software dept.
from the good-reason-not-to-pirate-software dept.
CWmike writes "Pirated copies of Apple's new iWork '09 suite that are now available on file-sharing sites contain a Trojan horse that hijacks Macs and leaves them open to further attack, a security company said yesterday. The 'iServices.a' Trojan hitchhikes on iWork '09's installer, said Intego, which makes Mac security software. 'The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer's request of an administrator password,' Intego said in a warning. Once installed, the Trojan "phones home" to a malicious server to notify the hacker that the Mac has been compromised, and to await instructions."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Now unveiling... (Score:5, Funny)
The iPwn!
Re:Now unveiling... (Score:5, Funny)
Parent
Re:Now unveiling... (Score:5, Funny)
I'd like to take this opportunity to welcome mac users to the pc world...I mean really....pirated software with a virus...who would have seen that one coming?
I just wish someone would do this for the Linux world. I've tried nearly every ISO download under "Applications -> Unix" on The Pirate Bay, but everything seems to be *legal*.
It won't be the year of Linux on the Desktop(tm) until you can download pirated linux applications from The Pirate Bay complete with virii and rootkits.
Parent
Re:Now unveiling... (Score:4, Funny)
no, no, no. Virii in Linux world work on the honor system. You randomly delete a dozen of your files and mail the virus on to everyone in your address book.
Parent
Re:Now unveiling... (Score:5, Funny)
Argh. Please don't say "virii", even ironically. It encourages idiots.
QED
Parent
Re:Now unveiling... (Score:4, Funny)
yeah, but viruses sounds like breastuses.
Parent
Pirates (Score:5, Insightful)
Not to troll, but as far as I'm concerned anyone who pirates software deserves it...
Parent
Re:Now unveiling... (Score:5, Insightful)
Go learn about the difference between a virus and a trojan.
Parent
Re:Now unveiling... (Score:5, Funny)
Go explain the difference to a Mac user.
Parent
Re:Now unveiling... (Score:4, Insightful)
Is this a virus?
Didn't think so.
This is social engineering at its finest - an untrusted source, launching executable code (via user action) and gaining elevated privileges (via user input of password).
Welcome to any operating system's severe vulnerability to attack.
Still no viruses on OS X though, beyond that proof of concept thing a while back. Still, 1 versus.... how many on Windows? So many you *require* a dedicated third party app to bog down your system and act as doctor, surgeon and nurse to keep the machine clean?
I'll take OS X thanks.
Also, don't steal software. You're just asking for trouble. This isn't the first time that OS X has been targeted with dodgy copies of software from download sites - I seem to remember an app that claimed to be the MS Office for Mac installer that did nothing except delete the contents of your home folder.
Moral of the story again: Untrusted code could do anything. Don't download copied software.
Parent
Re:Now unveiling... (Score:5, Insightful)
That was exactly my point. It's a trojan that relies on social engineering to defeat system security, and that's not unique to any one operating system, Windows, Mac or even your favourite flavour of Linux if you're in the market of using dodgy packages.
I didn't mention anything about porn or music.
Parent
Re:Now unveiling... (Score:4, Insightful)
Parent
Not that I condone piracy but (Score:3, Funny)
Re:Not that I condone piracy but (Score:5, Funny)
Then you don't get the trojan from iWorks, but from the keygen that further frustrates you by playing an annoying and loud tune while you go through the serial generating process.
Note to keygen creators: I do not want to hear your brother's crappy techno remixes when using your app. Is there some way I can pay you to disable this feature?
Parent
Re:Not that I condone piracy but (Score:5, Informative)
Not that I'd ever use a keygen or anything, but that's definitely only a Windows problem. From what I *cough* hear, most apps are either pre-cracked, have a drag-and-drop crack (how Mac-like), or just need any of a hundred serials floating around with no further mess.
(Actually, I think all of my software is totally legit except for Photoshop, and I plan to buy it eventually)
Parent
Re:Not that I condone piracy but (Score:5, Funny)
(Actually, I think all of my software is totally legit except for Photoshop, and I plan to buy it eventually)
We all plan to buy Photoshop.
Parent
Re:Not that I condone piracy but (Score:5, Insightful)
Note to keygen creators: I do not want to hear your brother's crappy techno remixes when using your app. Is there some way I can pay you to disable this feature?
Erm, you can indeed. You can pay money to buy a legit serial number - voila - no crappy techno music.
-Em
Parent
Re:Not that I condone piracy but (Score:5, Funny)
Then you don't get the trojan from iWorks, but from the keygen that further frustrates you by playing an annoying and loud tune while you go through the serial generating process.
Note to keygen creators: I do not want to hear your brother's crappy techno remixes when using your app. Is there some way I can pay you to disable this feature?
Send your money to me, and I'll reply with instructions on how to "mute" undesired sounds you find coming out of your computer. Never be forced to listen to crappy music again!
Parent
Re:Not that I condone piracy but (Score:5, Funny)
Will I be able to listen to my mp3s while using the keygen?
Parent
Re:Not that I condone piracy but (Score:5, Informative)
Apple removed serial number requirements from iWork '09 - just install for the CD and go.
Now, explain again how to use a sn with a crippled trail, please...
Parent
Re:Not that I condone piracy but (Score:5, Funny)
Parent
Of course (Score:5, Insightful)
Re:Of course (Score:5, Interesting)
LittleSnitch [obdev.at] is one of my favorite security programs. Shows any outgoing connections and I can allow for that session, once, or forever and to just that port, any port, that host, that host and port.
Does anyone have a torrent to a file with the trojan? I'd like to open the .pkg and and look at it. It's surprisingly easy to look at the 'install' files. Right click on the pkg and open a few folders and look for pre-flight & post-flight scripts (which can be written in about any language). .pkgs are fun little things.
Parent
Re:Of course (Score:4, Insightful)
It's especially nice if such monitoring software is not "on the radar" of malware sites, since they could include a workaround for such software, as is frequently done for Norton and Symantic on Windows.
Parent
Re:Of course (Score:5, Insightful)
You got two fingers [macosxhints.com]? (If not, sorry, I'm an insensitive clod.)
Parent
cynicism (Score:5, Insightful)
Sometimes I wonder if companies that create security software aren't sometimes guilty of either creating or funding the creation of viruses, trojans, worms, &c. simply to justify their own existence.
Is that cynical?
Re:cynicism (Score:5, Insightful)
They certainly use virus news to justify their existence and the cost of their products. The fact that they exist is tantamount to admitting that no OS can be fully secured.
The harder anti-virus vendors bleat on about how good their product is, the more bragging rights a virus writer will get for walking around the security... among their own crowd. It's more or less a case of putting up a wall and telling the world, there, you can't get past this wall now.
The real trouble with anti-virus vendors is that they tend to convince people that once their product is installed, the end user's pc is safe. It is NOT, and won't ever be. Some of the best virus programs in the world are still out in the wild, running as they were intended to run, collecting and passing information as they are supposed to. Since they are not destructive to normal computer activity, they go undetected. Don't say that such does not exist... I know you have not done forensics on all existent computers. Every now and then we hear about some corporate espionage or attacks from state military groups etc. All of this is just hinting at the real problems: The virus programs we don't know about.
Think about it. If a virus program did some key logging for bank URLs then spread itself a bit, then self destructed... hmmmmm They are seeing more sophisticated virus programs now, and fortunately beginning to look for them. Sadly, you'll have some pretty incredibly long scan times to find some types of malicious software: none of this 45 minute scan by Symantec etc.
Soon, you'll need a multicore CPU just to handle real time scanning. It's a giant whack-a-mole game. Always will be.
Parent
Re:cynicism (Score:5, Interesting)
Actually, IMO we are in need of another category of malicious software. Social engineering allows code writers to get their code run by the user in a way that is neither stealthy or without their knowledge. It runs as a user program, and did not necessarily 'infect' the machine, yet is a virus by the definition that it has modified an executable. So we need either a new term, or be satisfied that the generic use of the term 'virus' fits such code.
An example would be a screen saver that does it's work when the computer is idle and the screen saver itself has been run on the user's command to do so. That group of software that claims to be scanning software which does more than look for malicious code is also in this category. It's becoming quite confusing, and at any turn unvalidated code can be malicious. Many end users are unable to know the difference without much more training. Social engineering makes it fairly simple to get users to run malicious code.
We've seen people repackage OOo software and sell it. It won't be long before we discover such tactics used to deliver malicious code. Would that be a virus or a worm?
You see, my favorite scenario for malicious code is quite simple... spreads like a virus, then sits and waits patiently for the moment that it finds itself on a machine whose user is 'bill gates' (as an example) then every time the screen saver is activated, it searches the drive for the oldest .xls or .doc files and deletes two of them that are at least 45 days since last access. Every 17th time (or follow a Fibonacci number sequence) the screen saver is activated, it searches for Symantec installations and deletes the current virus definition file. Every 6th boot, it loads a key logger which looks for a select set of certain bank URLs. Every time you plug in a USB drive, it copies itself to the USB device if the screen saver is activated. You see, there are many ways to create hard to find problems. It won't be long before we are seeing them.
Parent
New anti-virus company (Score:5, Funny)
As long as there are crackers without girlfriends in the world, they don't need to.
I propose starting a new anti-virus company that will focus on dates for crackers rather than OS security.
Parent
Re: (Score:3, Funny)
It's all Apple fault (Score:5, Funny)
If only Apple hadn't stripped out the DRM this would have never happened!
It really should be noted... (Score:4, Funny)
That it is the easiest trojan to use ever. Bravo, Apple.
If Apple were evil... (Score:3, Insightful)
Why not download directly from Apple? (Score:5, Informative)
Re:Why not download directly from Apple? (Score:4, Interesting)
Parent
whew... thank gawd... (Score:4, Funny)
Im running windows...
Re: But, but.... (Score:4, Insightful)
This requires user action and piracy. No one can -ever- claim that -any- computer is safe from, essentially, social engineering.
Parent
Re: But, but.... (Score:5, Insightful)
This requires user action and piracy.
So does 99.99% of windows malware.
No one can -ever- claim that -any- computer is safe from, essentially, social engineering.
Again right. But what's the solution? That is the real question.
Because this is the ecosystem microsoft lives in, we've seen what they're trying... digital signatures on drivers, the inability to put admin items in your startup, UAC prompts... etc, etc.
What is Apple going to do in response to inevitable arrival of social-engineering malware as it gains marketshare?
What is Linux going to if/when it acheives enough marketshare among joe-sixpacks for social engineering to be profitable?
As much as /. likes to take shots at Microsoft, what would you do better? *nix security is just as vulnerable to social engineering as windows is, given the same users.
Parent
Re: But, but.... (Score:5, Interesting)
Um most pirated software is clean of malware. The primary vectors are email and infected websites (often reputable ones that are compromised themselves, often due to sketchy)
The "piracy has VIRUSES!" myth is very much a content industry creation. I'm more concerned about malware in "genuine" software than pirated, and one more reason that I pirate things when I do. Of course, you -are- running an executable from a total stranger. At least "genuine" software makers have it tied to their name, so this could easily become truer.
Given that all three OSes have sudo, social engineering will ALWAYS work. Unless we take sudo away from average users (which is far easier to get away with on linux than windows and still have everything work smoothly)
If you're really paranoid, you might consider running your browser and mail client in a virtual machine
Parent
Re: But, but.... (Score:5, Interesting)
Well, if as few as 10% of the pirated software has viruses, then anyone who downloads and installs 10 software apps has roughly a 66% chance of getting something. It seems bizarre that malware creators wouldn't use pirated software to spread keyloggers and other nasty stuff. I mean - if I went to a website and got a popup to download and install an exe, or I got something in my email that said to run an exe, I'd NEVER do it. And neither would most tech-savy people. But, people who pirate software are installing the software they're downloading. That's a malware-creator's dream come true. I'm sure mafia and identity-theft criminals love the idea (and they can create lots of seeders to create the illusion of being legit).
The "piracy has VIRUSES!" myth is very much a content industry creation.
Uh huh. And the ""piracy has viruses" is a myth" myth is advocated by people who want to believe piracy is totally safe.
I'm more concerned about malware in "genuine" software than pirated, and one more reason that I pirate things when I do.
Well, pirated software has the "malware" created by the genuine software manufacturers plus the malware added to it by anyone who wants to add a trojan.
Parent
Re: (Score:3, Insightful)
So does 99.99% of windows malware.
Somehow I doubt that Windows worms and exploits only make up .001% of all Windows malware. The old lsass exploit (yeah, I know you remember) was pretty widespread and only required an internet connection and an unpatched Windows 2000/maybe XP machine. ...But it was only a part of the .001% of non-user interactive malware that your statistics seem to assert.
Re: But, but.... (Score:4, Insightful)
You can safely say that, out of the box, Apple's OS is safer than Microsoft's (and you can make up your own reasons why), and this particular "virus" (it's a trojan, not a virus) isn't related to a vulnerability in the OS. It's related to a vulnerability in a trusting user. It's vastly different than an exploit that antivirus programs are designed to watch for. No antivirus would protect someone from this, unless it was known already as a trojan (then an update would have to show up, etc.) But you begin to see the fallacy of blaming Apple for social engineering. Educating the novices of ANY OS is something we should be doing, rather than trying to have a pissing contest between Jobs and Ballmer.
Parent
Re:No, that's impossible. (Score:5, Insightful)
Parent
Re:No, that's impossible. (Score:4, Interesting)
Parent
Re:No, that's impossible. (Score:5, Insightful)
Just this week. [nytimes.com]
A worm differs from a virus only in so much that it doesn't need to copy itself into a system program. For all intents and purposes however, the difference between the two terms is antiquated.
Parent
Re:Not a vulnerability (Score:5, Insightful)
Parent
Re: (Score:3)
Re: (Score:3, Insightful)
As I said, it's a PEBKAC error. If you give an installer your admnin password it can do whatever it pleases.
And if you read my post, I'm telling you that is a design flaw in the OS. On a well designed OS, the software has more granularity of permission than "can do everything include connect to random servers" and "can't install". Apple seems to agree with me since they added an ACL framework to restrict applications with a finer level of permissions in the last version, although it is only used for a small subset of applications so far.
Only an idiot installs pirated wares and only a supremely stupid idiot gives said warez the root password.
I think installing pirated software is unethical and risky, but not necessari
Re: (Score:3, Informative)
Have you downloaded something using Apple's servers? I get a solid 1MB/s+ almost all the time, pretty much maxing out my entire connection. It's very rare for me to get anywhere near that on ANY torrent, even very popular ones - plus Apple doesn't ask me to upload the same amount for proper etiquette.
Re:Nice of them to tell you how to remove it. (Score:5, Informative)
Their alert, unlike every other antivirus company alert, does not tell you how to remove the trojan.
Nice.
sudo -s (enter password) /System/Library/StartupItems/iWorkServices
/private/tmp/.iWorkServices
/usr/bin/iWorkServices
/Library/Receipts/iWorkServices.pkg
rm -r
rm
rm
rm -r
killall -9 iWorkServices
Parent