Trojan Hides In Pirated Copies of Apple iWork '09

CWmike writes "Pirated copies of Apple's new iWork '09 suite that are now available on file-sharing sites contain a Trojan horse that hijacks Macs and leaves them open to further attack, a security company said yesterday. The 'iServices.a' Trojan hitchhikes on iWork '09's installer, said Intego, which makes Mac security software. 'The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer's request of an administrator password,' Intego said in a warning. Once installed, the Trojan "phones home" to a malicious server to notify the hacker that the Mac has been compromised, and to await instructions."

Comments

Not a vulnerability

[The Bungi]

But like many a Windows trojan/malware that relied on user intervention to get its foot in the door, I don't see why this cannot be blamed on Apple's "sloppy code" (to draw a parallel with the same things that get blamed on Microsoft).

A Unix-like system with a root account is not superior to an NT box, even when used by someone who runs under a non-privileged account but cannot be bothered to exercise some damn common sense wrt what they put on their computers.

As their numbers grow, I expect masses of stupid Apple users (probably the same stupid Windows users that migrated to OS X to be "safe") to do things like enter their root password into browser add-ons because they are asked for it, and download "cool" screensavers and pirated software like this, loaded with malware. Membership in botnets cannot be far behind at that point.

And then when Apple machines get hit by exploits to vulnerabilities that have been patched for three months which users can't be bothered to install updates for, all will be good.

And guess what OS will be next up.

Re:Why is this a story?

[Dreadneck]

And if a user is stupid enough to install a pirated ware AND give said ware the root password, what on earth makes you think they will possibly be able to understand what to do if informed that process xyz is opening a connection?