Copies of iWork 09 from BitTorrent may contain trojan

A look inside of the installer shows the iWorkServices.pkg file Intego has issued a security alert for pirated copies of Apple's iWork 09, saying that it may contain an OS X trojan known as OSX.Trojan.iServices.A. The pirated copies are appearing on BitTorrent trackers and direct download warez sites. Officially purchased copies and retail copies do not contain this trojan.

The trojan exists as a package within the actual iWork 09 installer. It is notable that the iWork 09 files in these downloads are not affected, but are merely a carrier to get the trojan onto users systems. The installer for the trojan is launched as soon as the installation of iWork begins, following the installers request of the administrator password. Once installed as a start-up item to /System/Library/StartupItems/iWorkServices it has read-write-execute permissions for root. Intego has advised that the trojan connects to a remote server, possibly giving remote access and downloading additional components to the infected Mac.

As always, we recommend not downloading software from untrustworthy or unofficial sources and to always acquire software legitimately.

(crve)