Exploit: OSX.Trojan.iServices.B Trojan Horse
Discovered: January 25, 2009
Risk: Serious
|
|
Description: Intego has discovered a new variant of the iServices Trojan horse that the company discovered on January 22, 2009. This new Trojan horse, OSX.Trojan.iServices.B, like the previous version, is found in pirated software distributed via BitTorrent trackers and other sites containing links to pirated software. The Trojan horse, OSX.Trojan.iServices.B Trojan, like it's predecessor, can be used for DDoS (distributed denial of service) attacks. According to Intego, at least 1,000 copies of the application have been downloaded.The crack application installs a back door into a machine and allows the machine to be controlled remotely, and can be used to install additional components into the affected Mac. |
A note from the Guys at Forevermac: This is NOT a virus- it may slow your mac down, but it won't infect your computer. It requires user input and can be stopped from installing itself on your system. It's a Trojan- designed to trick the user into inadvertantly installing in onto your system. As ever, macs appear to remain Virus Free!
OSX.Trojan.iServices.B Trojan horse is found bundled with copies of Adobe Photoshop CS4 for Mac. The actual Photoshop installer is clean, but the Trojan horse is found in a crack application that serializes the program.
After downloading this version of Photoshop, users will run the crack application to be able to use it. The crack application extracts an executable from its data, than installs a backdoor in /var/tmp/, a directory which is not deleted when the computer is restarted. (If the user runs the crack application again, the Trojan horse creates a new executable with a different name; these random names make it harder to ensure safe removal of the malware.)
The crack application then requests an administrator password, launching the backdoor with root privileges. This copies the executable to /usr/bin/DivX, then creates a startup item in /System/Library/StartupItems/DivX. The program checks to see if it has been launched with root privileges, then saves the root hash password in the file /var/root/.DivX. It listens on a random TCP port, and answers requests such as GET / HTTP/1.0 by sending a 209-byte packet, and makes repeated connections to two IP addresses. Next, the crack application opens a disk image which is hidden in its resource folder, in a folder named .data, and proceeds to crack the Photoshop program, allowing it to be
used.
Since the malicious software connects to a remote server over the Internet, the creator ofthis malware will be alerted that this Trojan horse is installed on different Macs, andwill have the ability to connect to them and perform various actions remotely. TheTrojan horse may also download additional components to an infected Mac.
