Mac Trojan Builds Botnet, Symantec Researchers Say

Malware attacks targeting users of pirated Mac software earlier in 2009 culminated in the creation of the first known Mac botnet, according to Symantec.

According to researchers at Symantec, the Mac botnet was built on the backs of users of pirated versions of iWork '09 and the Mac version of Adobe Photoshop CS4. In an article in the latest edition of Virus Bulletin, Symantec researchers Mario Barcena and Alfredo Pesoli of Symantec Ireland dubbed the network of computers iBotnet and stated it was used to launch a denial-of-service attack against a Web site in January.

The botnet is not especially large, most likely due to the fact that it was targeting users of pirated software. When Mac-focused security company Intego first released an advisory about the Trojan in late January, it put the number of infected computers at 5,000. The malware that infected the bots, known as OSX.Iservice, installs a backdoor on infected systems and begins contacting other hosts for commands. Hidden in the pirated software, the malware infects users sharing the files over peer-to-peer networks.

Talk of the botnet attracted attention because of the platform. Historically, little in the way of malware has touched the Mac. Depending on whom you ask, this is due to either smaller market share—Gartner estimates Apple controlled about 7.4 percent of the market in the first quarter of 2009—or better default security, as many Mac users contend.

Still, a MacBook Air did fall at the annual CanSecWest Pwn2Own contest courtesy of an exploit targeting the Safari browser. Dave Marcus, director of security research and communications at McAfee's Avert Labs, said while Mac users may not be immune to malware attacks, they remain largely out of the path of attackers.

"I think what it really comes down to is it's just not on their minds as [much as] the Windows platform," Marcus said. "We see little if any Mac malware … when you compare it to the flood of malware for the PC-based world, [there are] literally thousands of new pieces of malware a day for the PC world."

Perhaps the most important lesson is for users to be wary of pirated software.

"I always describe it as training wheels for newbies, because it's just so easy to do," said Kevin Haley, director of Symantec Security Response. "All you need to do is go to peer-to-peer and see what people are sharing ... insert your malware into one of those files, post it up on the peer-to-peer network and wait for people to download it."