Pirated Mac versions of Photoshop CS4 infected with Trojan in Crack

(image found on photoshopsupport.com website)
"Well when it rains it pours" the old saying goes. This can be no truer then with Apple Mac OS users when it comes to using pirated software. Last week it was one thing and now its another. It turns out that pirated versions of Mac Adobe Photoshop CS4 are clean but the crack used to get around the serial number forced registration come with a Trojan horse for users that implement it.

"As of 6 a.m. EST on Jan. 25, nearly 5,000 are believed to have downloaded the Trojan, according to the advisory.

After downloading this version of Photoshop, users will run the crack application to be able to use it, the advisory continues. The crack application extracts an executable from its data and installs a backdoor in /var/tmp/, which is not deleted when the computer is restarted.

The crack application then requests an administrator password and launches the backdoor with root privileges, the advisory continues. The program saves the root hash password in the file /var/root/.DivX. In addition, it listens on a random TCP port, answers requests such as GET / HTTP/1.0 by sending a 209-byte packet and makes repeated connections to two IP addresses.

“Since the malicious software connects to a remote server over the Internet, the creator of this malware will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely,” the advisory reads. “The Trojan horse may also download additional components to an infected Mac.”"

So the moral of the story, beware of links bearing gifts........

More Malware Targeting Users of Pirated Software for Mac (eWeek)

Mac Malware tide on the rise (The Register)

New Mac Trojan Spread By Pirated Adobe Software (ChannelWeb)