January 26th, 2009
Mac Trojan horse found in pirated Adobe Photoshop CS4
A new variant of the iServices Trojan horse has been discovered by Intego.
The new Trojan horse, OSX.Trojan.iServices.B, is found in pirated software distributed via BitTorrent trackers and other sites containing links to pirated software, just like the previous version.
OSX.Trojan.iServices.B Trojan horse is found bundled with copies of Adobe Photoshop CS4 for Mac. The Photoshop installer itself is clean, but the Trojan horse is found in a crack application that serializes the program.
According to Intego:
After downloading this version of Photoshop, users will run the crack application to be able to use it. The crack application extracts an executable from its data, than installs a backdoor in /var/tmp/, a directory which is not deleted when the computer is restarted. (If the user runs the crack application again, the Trojan horse creates a new executable with a different name; these random names make it harder to ensure safe removal of the malware.)
The crack application then requests an administrator password, launching the backdoor with root privileges. This copies the executable to /usr/bin/DivX, then creates a startup item in /System/Library/StartupItems/DivX. The program checks to see if it has been launched with root privileges, then saves the root hash password in the file /var/root/.DivX. It listens on a random TCP port, and answers requests such as GET / HTTP/1.0 by sending a 209-byte packet, and makes repeated connections to two IP addresses.
Next, the crack application opens a disk image which is hidden in its resource folder, named .data, and proceeds to crack Photoshop.
Since the malware connects to a remote server over the Internet, the creator will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely, the company says.
The Trojan horse may also download additional components to an infected Mac.
WHAT TO DO: If you’re a Mac user, do not download Photoshop CS4 installers from sites offering pirated software. According to Intego, nearly 5,000 people on one BitTorrent site have downloaded this installer since 6am EST.
In other words, don’t do crack.
The risk of infection is serious, Intego says: “Due to the number of infected users, these users may face extremely serious consequences if their Macs are accessible to malicious users. The first version of this Trojan horse was seen downloading new code to infected computers, which were then used in a DDoS (distributed denial of service) attack on certain web sites. Since this new variant uses the same technology, and contacts the same remote servers, it is likely that it will attempt to download new code and perform such actions.”
The company also noted that the iWork 09 torrent that they warned about on January 22 has been downloaded by at least 1,000 more people since the warning.
Andrew J. Nusca is an associate editor for ZDNet and SmartPlanet.
See his full profile and disclosure of his industry affiliations.
Email Andrew Nusca 
Follow on Twitter
Subscribe to The ToyBox via Email alerts or RSS.
| 01/26/09
