Friday, January 23, 2009

Reason #1013 not to Pirate software

There are many reasons NOT to pirate software: ethics, legal issues, inevitable corrupted files, lack of tech support, denying developers the money they need to continue the software, etc. But we have a reminder of perhaps the best reason not to download software off of the internet: it is very likely to be infected with a virus or trojan horse. A pirated version of iWork is infecting naive and unethical users with a back door into their Macs.

Security firm Intego identified the trojan in question late yesterday. Dubbed "OSX.Trojan.iServices.A," the trojan is hidden as an extra package—iWorkServices.pkg—in an otherwise fully-functional iWork '09 installer. Once you authenticate with your password to install the software, the trojan installs as a startup item in /System/Library/StartupItems/iWorkServices, an area normally reserved for Apple-only files, giving it read, write, and execute permissions as root. It then connects to a remote server, essentially creating a wide open back door for malicious attackers to do just about anything they want.

2 comments:

Ward said...

While I understand the wrongness of pirating software and all, I'm a bit disappointed by the response of many mac users that people who download illegal software "deserve" to have something like this happen.

What we're seeing is the beginning of malicious intent by a mac-user against other mac users. It has been one of the defining characteristics of Mac users that we are united by our taste in computer use. From the first time I picked up a Mac, I've felt like a part of something more than just a nameless PC in a crowd and I instantly get along with many other people because of their Mac computer preference.

What this trojan represents is a change in that and while we might all think that hackers, pirates, ect deserve it, I find it hard to be too smug because of what it means for the fellowship that Mac users have.

Nomad said...

While I agree that the "glee" some people are having about this incident is wrong, I am not sure I agree with your fundamental thesis. (1) The news about this is propagating across the blogsphere at lightspeed which seems to uphold the "Mac community", far faster than most Windows virii are reported, (2) Mac users have always been a bit snarky to outsiders, which has earned the group the nickname "fanboy", and (3) this is hardly a new occurrence. That it happened with a piece of software owned by Apple is new, but people have been hacking up Photoshop installers for years with trojan horses and bringing down Mac users.

Still, your point is well taken. As the Mac umbrella widens, we have to expect not only good new members of the Apple family, but also some troublemakers.