More Pirated Mac Software Infected

Security and privacy software vendor Intego has reported that pirated copies of Adobe Photoshop CS4 for Apple may contain a variant of the same virus found in pirated copies of Apple iWorks '09 last week.

Intego warned last week that copies of Apple iWorks '09 found on several popular torrent sites contain a virus dubbed, OSX.Trojan.iServices.A. According to Intego's report released today, a new variant dubbed OSX.Trojan.iServices.B, is now being found in torrent downloads of Adobe Photoshop CS4.

"The actual Photoshop installer is clean, but the Trojan horse is found in a crack application that serializes the program," warns Intego.

After downloading this version of Photoshop, users will run the crack application to be able to use it. The crack application extracts an executable from its data, than installs a backdoor in /var/tmp/, a directory which is not deleted when the computer is restarted. (If the user runs the crack application again, the Trojan horse creates a new executable with a different name; these random names make it harder to ensure safe removal of the malware.)

The crack application then requests an administrator password, launching the backdoor with root privileges. This copies the executable to /usr/bin/DivX, then creates a startup item in /System/Library/StartupItems/DivX. The program checks to see if it has been launched with root privileges, then saves the root hash password in the file /var/root/.DivX. It listens on a random TCP port, and answers requests such as GET / HTTP/1.0 by sending a 209-byte packet, and makes repeated connections to two IP addresses.

Next, the crack application opens a disk image which is hidden in its resource folder, in a folder named .data, and proceeds to crack the Photoshop program, allowing it to be used.

Since the malicious software connects to a remote server over the Internet, the creator of this malware will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely. The Trojan horse may also download additional components to an infected Mac.