Intego warns of iWork '09 trojan
January 22nd 2009
Intego has announced the appearance of a new trojan horse that targets OS X users, specifically those looking to pirate the latest version of Apple's office productivity suite. The malware--OSX.Trojan.iServices.A, is currently circulating in copies--20,000 downloaded so far by unwary users--of iWork '09 found on BitTorrent trackers and other P2P software sites.
The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer's request of an administrator password (in older versions of Mac OS X, 10.5.1 or earlier, there will be no password request). This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root.
[Click through to continue]
Insidiously, this trojan strikes at just the time Apple has removed the need to use a serial number from this suite, which seemingly invites users to pirate this package. Moreover, the copy of iWork the trojan is embedded in is an actual working copy of the software. So, aside from a single innocuous looking file in the installer--iWorkServices.pkg--and an innocuous looking start up file (image to the right), there's little to give away the fact that a user has been infected.
That said, once OSX.Trojan.iServices.A is installed, it connects to a remote server, giving hackers the ability to connect to the infected Mac and "perform various actions remotely" (ie thieve your passwords, credit card numbers, etc).
Do the latest versions of VirusBarrier X5--see a review here--protect against the OSX.Trojan.iServices.A trojan? Well, of course they do, though you'll need to download the latest virus defs dated today, January 22.
Editor's note: I've been a VirusBarrier X5 user (previously used ClamXav) since purchasing a copy as part of the MacUpdate Holiday bundle.
Choose from over 4.5-Million songs!
