Trojan found circulating with pirated iWork '09
updated 10:35 am EST, Thu January 22, 2009
Trojan linked with iWork
A new Trojan attack has been linked with illegal copies of iWork '09, says Intego. The security firm notes that in some copies of iWork found on BitTorrent sites -- and other pirating venues -- a Trojan dubbed OSX.Trojan.iServices.A is attached, masquerading in the form of a package file called iWorkServices. When the iWork installer is launched, iWorkServices is launched as well; while this may be halted by a request for an administrator password, Intego warns that Mac OS X 10.5.1 and earlier will install the Trojan without further prompting.
iWorkServices subsequently becomes a startup item with full root privileges, which are then used to connect to a remote server and inform a hacker that they have access. Further malware may be installed on a victim's computer, though this is not guaranteed.
So far over 20,000 people are believed to have downloaded infected copies of iWork '09, and Intego warns that the Trojan is an "extremely serious" threat. It can, however, be defeated by updating to the latest virus definitions.












Huh?
01/22, 10:58am (1 reply) reply
The installer won't even fire up unless you have 10.5.6 installed...
Guest
Fresh-Faced Recruit
Joined: Nov 1999
Update definitions...
01/22, 11:02am reply
...from a security firm or just remove the startup item? I wonder what would I do.
ViktorCode
Fresh-Faced Recruit
Joined: Jan 2006
How about...
01/22, 11:09am reply
..."Update definitions from a security firm or just remove the startup item? I wonder what would I do."
I would download iWork 09 from Apple instead of some bit torrent site. After all, it is a full, un-crippled version, and it will work for 30 days. If I like it that much, it will cost me very little to remove the 30-day limitation.
vasic
Fresh-Faced Recruit
Joined: May 2005
further Huh?
01/22, 11:11am reply
Maybe one should be downloading pirated software? I haven't had any trouble getting the trial version from Apple, their server seems fast enough. So if the advantage isn't speed, then it is just theft. As they say, if it is too good to be true...
Guest
Fresh-Faced Recruit
Joined: Nov 1999
further Huh?
01/22, 11:12am reply
Maybe one should NOT be downloading pirated software? I haven't had any trouble getting the trial version from Apple, their server seems fast enough. So if the advantage isn't speed, then it is just theft. As they say, if it is too good to be true...
Guest
Fresh-Faced Recruit
Joined: Nov 1999
Deserve
01/22, 11:25am reply
I can't say I feel sorry for anyone hit by this. There's no legitimate reason to download a pirated copy when there is a fully-functional demo available on Apple's site.
hayesk
Professional Poster
Joined: Sep 1999
If you download Warez....
01/22, 11:28am reply
you might as well box up your computer and send it to a botnet. You could build the best security paradigm ever and yet there will always be some stupid user that will defeat themselves.
Guest
Fresh-Faced Recruit
Joined: Nov 1999
Hooey
01/22, 12:14pm reply
Thousands upon thousands of people have downloaded iWork '09 which requires no serial or registration code to work and no one has reported a problem - well, except for a desperate software company that relies on frightening the Mac community. In all my years as a Mac user I've never seen a virus, trojan or worm on any of hundreds of machines I own, use or have access to - all of which participate on the web in every form. I say it is hooey.
OS2Guy
Fresh-Faced Recruit
Joined: Jun 2006
Re: Huh?
01/22, 12:31pm (1 reply) reply
The installer won't even fire up unless you have 10.5.6 installed..
Yes, but this is the hacked installer, which will probably fire up on any machine with 10.5.1, install the trojan, then finally hit the complaint about 10.5.6 not being installed.
testudo
Fresh-Faced Recruit
Joined: Aug 2001
Trojans ARE a threat
01/22, 12:44pm reply
These sort of threats DO exist. While it requires someone to do something bad, writing a trojan program on a mac is pretty trivial. The user thinks they are getting iWork because that's what they are told. Since they are installing software, asking for an admin password is expected. However, once you key in that password, all bets are off and ANYTHING could be installed.
This is the sole reason that anti-virus software would be legit to have on your machine. If it catches these things, it will protect you against getting screwed.
bjojade
Fresh-Faced Recruit
Joined: Jun 2007