Pirated Mac versions of Photoshop CS4 infected with Trojan in Crack

(image found on photoshopsupport.com website)
"Well when it rains it pours" the old saying goes. This can be no truer then with Apple Mac OS users when it comes to using pirated software. Last week it was one thing and now its another. It turns out that pirated versions of Mac Adobe Photoshop CS4 are clean but the crack used to get around the serial number forced registration come with a Trojan horse for users that implement it.

"As of 6 a.m. EST on Jan. 25, nearly 5,000 are believed to have downloaded the Trojan, according to the advisory.

After downloading this version of Photoshop, users will run the crack application to be able to use it, the advisory continues. The crack application extracts an executable from its data and installs a backdoor in /var/tmp/, which is not deleted when the computer is restarted.

The crack application then requests an administrator password and launches the backdoor with root privileges, the advisory continues. The program saves the root hash password in the file /var/root/.DivX. In addition, it listens on a random TCP port, answers requests such as GET / HTTP/1.0 by sending a 209-byte packet and makes repeated connections to two IP addresses.

“Since the malicious software connects to a remote server over the Internet, the creator of this malware will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely,” the advisory reads. “The Trojan horse may also download additional components to an infected Mac.”"

So the moral of the story, beware of links bearing gifts........

More Malware Targeting Users of Pirated Software for Mac (eWeek)

Mac Malware tide on the rise (The Register)

New Mac Trojan Spread By Pirated Adobe Software (ChannelWeb)

Pirated Copies of Software are like a box of Chocolate, Ya never know what your gonna get...

(image found on informationweek.com website)

No where is this more true then with the people who downloaded the Pirated Apple iWork 09 software. Intego (Mac security software company) on Wednesday has announced it has identified an unknown Trojan software that affects machines running Mac OS X. The Trojan was found in pirated copies of Apples new software iWork 09 on various site where pirated software is illegally distributed. Intgo has identified the Trojan as "iWorkServices". The item is installed when the pirated copy of iWork09 suite is installed on the machine.

"The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer's request of an administrator password (in older versions of Mac OS X, 10.5.1 or earlier, there will be no password request)," the company said. "This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root."

Once installed, the malware connects to a remote server over the Internet, potentially allowing the malware author to steal information, control the compromised computer remotely, or trigger the downloading of additional malicious components. Intego claims that at least 20,000 people have downloaded infected versions of iWork 09. It urges Mac owners not to download iWork from disreputable sites."

Hopefully, more Mac OS X owners will heed this warning and not download this illegal software suite and just go buy it if they need it. I think to many people have gotten to comfortable in the Mac world and forgotten that they can too be susceptible to little nuances that PC owners have become use too.

Mac OS X Trojan Found In Pirated iWork 09 (Information Week)
Mac Trojan Targets Pirated Apple iWorks (ChannelWeb)
Trojan hides in pirated copies of Apple's iWork '09 (Computerworld Security)
Plagiarized iWork software contaminating Macs with Trojan horse (themoneytimes.com)