• On TV.com: THE LAST AIRBENDER Movie Trailer
advertisement
April 20, 2009 9:20 AM PDT

A Mac first - botnet is active

by CNET staff
  • Font size
  • Print
  • 12 comments
After the release of iWork '09 earlier this year, a Trojan was discovered circulating in pirated copies of Apple's productivity suite of applications (as well as pirated copies of Adobe's Photoshop CS4). Security professionals now believe that the botnet (from iServices) has become active. Although the potential damage range is projected to be minimal, an estimated 20,000 copies of the Trojan have been downloaded.

From MacWorld U.K.:

"The installer contains two files called OSX.Trojan.iServicesA and OSX.Trojan.iServicesB. These are installed alongside the full software package."
Security experts Symantec caution that the iServices botnet code is structured to be extremely flexible, which could result in variations of the Trojan surfacing in the next couple of months. Symptoms users should be aware of begin with excessive CPU usage on their Macs (a result of instigating a denial-of-services attack on Web sites).

This malicious software has the capability to produce peer-to-peer communication, remote start-ups, and encryption, said researchers Mario Ballano Barcena and Alfredo Pesoli.

A botnet is a group of computers unknowingly linked together and remotely administered to perform specific tasks. Most commonly, they send out e-mail spam and collect and report personal information.

Be protected
Although it is extremely unlikely that most users have an infected computer--currently the only way to get the Trojan is by illegally downloading iWork '09 or Photoshop CS4, typically from peer-to-peer Web sites, installing it, and entering your administrator password--there are a few ways to check your system.

1. Most antivirus software has been updated to block the iServices botnet. Companies such as SecureMac offer removal tools specifically designed to block iServices.
2. You may be able to neutralize the activity of the Trojan by deleting these folders:
1. "System/Library/StartupItems/DivX"
2. "System/Library/StartupItems/iWorkServices"
3. The most effective way of staying safe is by not subjecting your Mac to even the possibility of being infected by malicious software--most abundantly distributed in pirated software packages, so don't download pirated software.

Resources
Read the MacWorld U.K. article describing the activation of the iServices botnet.
Click here to download and install iServices Trojan Removal tool.
(Note: this will begin an immediate download from MacScan.)

Experiencing problems? Have feedback? Let us know!

Resources

  • Read the MacWorld U.K. art...
  • Click here to download and...
  • Let us know!
  • More from Late-Breakers
  • Recent posts from MacFixIt
    Address Book: Search not working properly
    iTunes 9.0.3 breaks AirTunes connection for some
    Apple releases Aperture 3.0
    Manage iCal's automatic e-mail generation for invitations
    CNET TV Apple Byte: Apple faces critics
    Weekly Utilities Update: Net Monitor, MiniUsage, TimeMachineEditor, more...
    Odds and Ends: Essential video codec packs for OS X
    Address Book: Unable to add, view contacts
    Add a Comment (Log in or register) (12 Comments)
    • prev
    • next
    by Joe6Macs April 20, 2009 1:26 PM PDT
    This infers that there are 20,000 illegal users of this software. Seems like a lot, but I may be naive.
    Reply to this comment
    by baddawg65 April 20, 2009 1:26 PM PDT
    >
    This is a reply to a previous comment by Joe6Macs


    Some Mac user think iWork is free, like in beer.
    Like in some free beer, there could be "date rape" drug or something worst in it so be careful with it.
    I think 20,000 people could be right but only the bot master would know.
    Reply to this comment
    by Joe_Gillespie_548 April 20, 2009 1:26 PM PDT
    >>
    This is a reply to a previous comment by baddawg65


    I keep seeing this phrase - "free like in beer". I haven't seen any free beer - or viruses or trojans!
    Reply to this comment
    by j.warbler.madman April 20, 2009 1:26 PM PDT
    >>>
    This is a reply to a previous comment by Joe_Gillespie_548


    This is the other half of a phrase used by the open-source software movement when when describing the "free" aspect of open-source software (free as in free speech, not as in free beer...)

    A more apt phrase for this situation might be TANSTAAFL (you can easily google this one folks).
    Reply to this comment
    by kucharsk April 20, 2009 3:10 PM PDT
    Perhaps this will teach people not to steal.

    (Probably not, but one can always hope.)
    Reply to this comment
    by leskern_dotmac April 20, 2009 6:19 PM PDT
    Zzzzz......
    Pirates got what they deserved, and "suffering"from 10,000 or 100,000 'puters doing a DOS attack is less than a bite from a dust mite.
    SELL MORE ANTI-VIRUS APPS!
    See, that's the meme that's being planted.
    Reply to this comment
    by Tripod April 20, 2009 10:24 PM PDT
    Article from March 26th, 2006 describes a Perl driven "botnet" that affected the MacOS X.

    http://voices.washingtonpost.com/securityfix/2006/03/when_macs_attack.html
    Reply to this comment
    by joe.aimonetti April 20, 2009 10:24 PM PDT
    >
    This is a reply to a previous comment by Tripod


    As the article states:
    "The botnet Taylor had tracked was created using a known security hole not in Linux or OS X, but in something that runs on top of the operating system. This is PHP, a development programming language built specifically for Web sites."

    It was not an OS-based botnet for Linux or Mac OS X. This botnet was OS-based. Hence, the first.
    Reply to this comment
    by Andreas.. April 21, 2009 3:36 AM PDT
    All pirated software should contain some malicious code, at least malicious enough to cause the poor, poor unfortunate victim quite a lot of work to recover from - and ideally some considerable expense.

    Whose side are Symantec et al on by facilitating protection against such infections or making removal/recovery easy? A no-brainer - their sales figures will give the answer.

    ---
    Andreas

    G5 2.1GHz ? OS 10.5.6 ? OS 10.4.10 for Classic & Applescript

    Reply to this comment
    by macdad614 April 21, 2009 3:36 AM PDT
    >
    This is a reply to a previous comment by Andreas..


    So I paid a lot of money for the LEGAL version of Adobe CS3 Master Collection. It was for my daughter's work. But I cannot use it on my computer because activating this expensive suite with the registered owner numbers would prevent it from being used on my daughter's computer. I can understand, therefore, why someone might download an illegal copy of any of these apps.
    Reply to this comment
    by X-ified April 21, 2009 3:36 AM PDT
    >>
    This is a reply to a previous comment by macdad614


    That pro software is expensive... but since you bought it for your daughter's work, maybe she can repay you with some of the money she makes on your investment in her. Then you don't have to steal.
    Reply to this comment
    by Cromdubh April 21, 2009 6:33 AM PDT
    What worries me is, with this botnet out and about,"In the wild?", whether being able to say all my software is legit, is sufficient protection against it and it's inevitable clones?
    Reply to this comment
    (12 Comments)
    • prev
    • next
    advertisement
    Click Here

    About MacFixIt

    MacFixIt is CNET's troubleshooting resource for all things Mac. The information here helps you navigate the ins-and-outs of Mac ownership with how-tos, troubleshooting information, news, reviews, and more.

    Add this feed to your online news reader