{"id":498,"date":"2009-01-22T21:58:09","date_gmt":"2009-01-23T05:58:09","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=498"},"modified":"2009-01-22T22:03:05","modified_gmt":"2009-01-23T06:03:05","slug":"itrojan","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/01\/22\/itrojan\/","title":{"rendered":"iTrojan"},"content":{"rendered":"<p class=\"MsoNormal\">It turns out Macs can catch something. Apple\u2019s most recent version of iWork, the counterpart of Microsoft Office, contains a Trojan. Well, almost.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">The pirated version that you can download from places such as The Pirate Bay is <a href=\"http:\/\/www.computerworld.com\/action\/article.do?command=viewArticleBasic&amp;articleId=9126609\">the one that contains the Trojan<\/a>. It includes an extra package when installing, and when the user gives the iWork installer administrator privileges, the Trojan package uses them to launch its own installer. After a successful install, the Trojan sends a message back to the mothership and awaits further orders.<\/p>\n<p class=\"MsoNormal\"><!--more--><\/p>\n<p class=\"MsoNormal\">Bundling viruses with pirated versions of popular software seems a logical choice; frankly, I\u2019m surprised it doesn\u2019t happen all the time. Many many many people pirate software, and if you can break the copy protection of the software it\u2019s probably not too hard to insert a virus into the installer, and you\u2019ll already have whatever permissions the installer has, if you work it right. So it makes sense.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">It does put publishers in a bind though, because even though they don\u2019t want their product pirated, they probably don\u2019t want their (potential) customers\u2019 computers contracting horrible diseases on account of their software becoming so popular. One of the few ways I see to prevent such occurrences is to solve the piracy problem. People usually pirate because buying the product is too costly, so if you can lower the cost you can prevent piracy to some degree. I know I\u2019d be more inclined to purchase Adobe products if they weren\u2019t so cripplingly pricey. Or if they came with gold bars inside.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">Another approach could be for Apple to configure the firewall that comes with OSX to block Trojan-like activity. Perhaps they already do and users decide to turn off the firewall because it\u2019s too complicated, or perhaps the Trojan accesses the internet under the name of iWorks and tricks them.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">The sites hosting pirated files could also try filtering them for viruses, but this is too difficult to be practical. Not only that, but file-sharing sites don\u2019t monitor content, so this would never happen either.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">That leaves trying to prevent people from pirating in the first place, and that\u2019s a noble but nigh-impossible goal if you ask me. Bootlegging has always been and it always will be. I\u2019m sure many people who enable the process break the products for fun, not because of any deep-seated malicious intent. You can\u2019t stop them, and it\u2019s (apparently) easy for them, so it\u2019s futile to try.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">Piracy is a whole other issue entirely, both in ethics and prevention, so I won\u2019t get into it here. But I do wonder whether anyone who was already morally on the fence about piracy would swing over to the side of corporations when hearing of the risks such as Trojans.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">I do find it interesting that after the virus-ridden version was posted to file-sharing sites but before the publishing of this story, Apple announced\u00a0<a href=\"http:\/\/www.computerworld.com\/action\/article.do?command=viewArticleBasic&amp;articleId=9126480\"><\/a>that it <a href=\"http:\/\/www.computerworld.com\/action\/article.do?command=viewArticleBasic&amp;articleId=9126480\">removed the need for a serial number when installing iWork<\/a>, and is allowing users to install the product on as many machines as they wish. This causes me to wonder whether Apple knew about the special virus edition of its software and wished to decrease the chance that people would be attracted to pirated versions in the first place. But I do believe that trying to lessen piracy is a good response to the leveraging of their software to attack their customers. Another way Apple could respond is by announcing the issue themselves, and by reiterating the security features built into OSX which can prevent such attacks when utilized properly.<\/p>\n<p class=\"MsoNormal\">I don&#8217;t see attacks via pirated software preventing people from downloading such pirated software, but it&#8217;s something to consider if you do decide to partake.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It turns out Macs can catch something. Apple\u2019s most recent version of iWork, the counterpart of Microsoft Office, contains a Trojan. Well, almost. The pirated version that you can download from places such as The Pirate Bay is the one &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/01\/22\/itrojan\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":90,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-498","post","type-post","status-publish","format-standard","hentry","category-current-events"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/90"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=498"}],"version-history":[{"count":5,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/498\/revisions"}],"predecessor-version":[{"id":502,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/498\/revisions\/502"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}