Intego, a company which is specialized in producing security software for the Mac operating system, has issued a warning regarding a pirated version of iWork 09.

 

The iWork 09 was introduced by Apple earlier this month at Macworld event and apparently now a pirated version is available on the file sharing networks.

 

But Intego discovered that beside the applications, the pirated version of iWork 09, includes also a Trojan horse, called OSX.Trojan.iServices.A.

More specifically, the installer of iWork 09 contains an additional package called iWorkServices.pkg

 

When one installs the pirated version the installation of iWorkServices package is also started. The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password.

 

This software is installed as a startup item (in  System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root.

 

After that, OSX.Trojan.iServices.A connects to a remote server over the Internet; this means that a malicious user will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely.

 

Intego noted that the as of 6 am EST, at least 20,000 people have downloaded this installer and the risk of infection is serious. Also in a note posted on Intego’s blog, the company reported that is getting reports of the iServices.A Trojan horse actively downloading new code and acting as a botnet, participating in distributed denial of service attacks on certain websites.