The malware seeded by pirated software months ago and creating what was dubbed iBotnet by Symantec security researchers proves the concept of botnets on Apple systems, but doesn't achieve major botnet status.An article in the April issue of Virus
Bulletin by two Symantec researchers says malware
for the Apple Macintosh from January was used to create a botnet, and that
the botnet attempted a denial-of-service attack.
The malware attacks at the time were noteworthy: They hid
inside what apparently pirated copies of Apple's iWork software and Adobe
Photoshop CS4. The programs were spread through BitTorrent and other
peer-to-peer networks.
Symantec identified the malicious code as OSX.Iservice.
According to Mario Ballano Barcena and Alfredo Pesoli of Symantec Ireland,
OSX.Iservice created a backdoor on the systems that allowed control to be
issued from a small number of specific hosts. A remote attacker could use a
vocabulary of 31 commands: socks, system, httpget, httpgeted, rand, sleep,
banadd, banclear, p2plock, p2punlock, nodes, leafs, unknowns, p2pport, p2pmode,
p2ppeer, p2ppeerport, p2peertype, set, get, clear, abortall, p2pihistsize,
p2pihist, platform, script, sendlogs, uptime, uid, shell, and rshell.
Barcena and Pesoli identify this as the first attempt to create a botnet of
Macs, and say that in January the botnet attempted to perform a DoS attack on a
Website. They find the Photoshop version of the bot especially interesting in
that it abuses some of the Mac OS' own authorization interfaces.
Read the rest of this article on eWEEK.com.
