Who said Macs are immune to viruses? Some malware makers aim to bust that myth with a Trojan horse that’s being downloaded across the Internet.
Mac security software firm Intego identified a Trojan on Wednesday that affects computers running Mac OS X. The malware was found on some pirated copies of Apple’s new iWork 09 productivity suite on peer-to-peer sites. iWork is Apple’s answer to Microsoft Office.
“The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password,” Intego said. “This software is installed as a start-up item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple start-up items), where it has read-write-execute permissions for root.” In Mac OS X 10.5.1 or earlier, there will be no password request.
Foolish Behavior
Once installed, the virus, called OSX.Trojan.iServices.A, connects to a remote server, where a cybercriminal is alerted that the virus is installed. At that point, criminals can begin connecting to the infected Mac to perform various actions. The virus may also download additional data to an infected Mac.
Anyone who downloads a pirated copy of iWork 09 is not only breaking Apple’s copyright, but risks becoming infected, according to Graham Cluley, a senior security consultant at Sophos. Like much of the Windows malware we see, he said, that Trojan horse is designed to turn computers into bots (Web robots), which hackers can abuse for whatever nefarious purpose they like, including sending out spam or stealing identities.
“Of course, you would be crazy to download any commercial copyrighted software from a (BitTorrent) site, but that doesn’t seem to stop lots of people from doing precisely that,” Cluley said. “It’s particularly absurd when you realize Apple makes available for free download a 30-day trial version. And so it’s understandable that some Apple fans might…