Latest OS X Threat: “iWorkServices”
A new OS X threat disguised as a legitimate application iWork 09 currently in-the-wild. Few OS X users had been tricked by this, so be careful!
This malicious piece of code could create startup entry and copy itself as /usr/bin/iWorkServices.
Once installed, it will attempt to remotely communicate and execute HTTP request. It will also create /tmp/.iWorkServices and sets CHMOD 755 which is a read and execute for everyone, which may relate to its P2P activity.
It is also referencing to “Users/jason/diarrhea/aes/aes_modes.c”.
Notice that this will also attempt to connect in this URL:
Ok, so the culprit is in Mach-O universal binary format:
I know this details are not enough, for now I can say that this is indeed a threat; a backdoor, trojan and P2P controlled bot. **Updated
**Note the file size that contains this threat is ~ 450MB**
Btw, this is currently discussed here:
http://thepiratebay.org/torrent/4630952/iWork.09
http://thepiratebay.org/torrent/4627720/iWork__09_Trial
Your report is really basic and doesn’t go into depth. Anyways … The really interesting part about this (fortunatly poorly coded) little beast is, that it comes with a Lua (scripting language) interpreter … This is the part neither you nor F-Secure found out yet … In theory this means it can be expanded in every imaginable way via it’s p2p network.
Regards
Code-signing is present in Mac OS X starting with 10.5. Security updates use SHA-1 checksums for years now. So at least some people at Apple know how to guarantee for software downloads integrity.
But it seems that not all teams at Apple use this technology for ALL their applications.
Lets see how they will deal with this …
finally, thanks for this reference…
Thank’s very much.
I got infected with this thing via. Photoshop CS4. I’m curious to know what it does when it runs. I’ve deleted this trojan itself, but does anyone know what code it executes from the remote site? Because it got to do that at least once and I need to know if I need to completely reinstall?!
Have you checked this http://ithreats.wordpress.com/2009/01/26/how-to-remove-iworkservices/ this includes instruction and what it does. However, if you think you are able to remove it but still suspicious on possible left overs, you might want to further investigate (in terminal) your running processes and open ports.
thanks this post. I made some adjustments
I love this site
Thanks! Keep coming back and please send me an email if you find some suspicious relating to Mac.