First Mac Botnet Activated, Engages in DDoS Attacks

Remember the Mac trojan that we reported about earlier this year? A trojan was found piggybacking on the back of copies of iWork and Photoshop CS4 found on warez sites and networks, and it would install itself after the user had entered his or her administrator password during the software’s installation. This trojan didn’t seem like much of a threat back then, but as it turns out, it’s now in use in the first Macintosh botnet.

Security researchers from Symantec have found evidence that said trojans, OSX.Iservice and OSX.Iservice.B, are being used in creating a botnet used for DDoS attacks. There’s at least one documented case of these trojans being used for DDoS attacks, and the researchers have found out that the botnet has encryption, a peer-to-peer engine, and remote startup capabilities.

“The code indicates that, wherever possible, the author tried to use the most flexible and extendible approach when creating it – and therefore we would not be surprised to see a new, modified variant in the near future,” the researchers said. Interestingly enough, they added that the person who wrote the trojans is not the same person who activated the botnet.

If you think you’ve been infected, you can use any Mac antivirus tool to clean your system; most of them have been updated to include removal instructions for these trojans. Since we’re talking trojans here, there’s no need to worry about self-replication, as it’s incapable of doing that. As always, steer clear of pirated software to prevent things like this from happening.

113 Comments

  1. Moredhas 2009-04-18 9:49 am EST
    • liber 2009-04-18 10:22 am EST
      • lemur2 2009-04-18 3:19 pm EST
        • google_ninja 2009-04-18 5:25 pm EST
          • lemur2 2009-04-19 7:02 am EST
          • PlatformAgnostic 2009-04-19 8:17 am EST
          • lemur2 2009-04-19 10:11 am EST
          • darknexus 2009-04-19 4:34 pm EST
          • ssa2204 2009-04-19 9:03 pm EST
          • lemur2 2009-04-19 11:37 pm EST
          • flynn 2009-04-20 2:23 am EST
          • lemur2 2009-04-20 3:10 am EST
          • flynn 2009-04-20 4:22 am EST
          • lemur2 2009-04-20 4:32 am EST
          • lemur2 2009-04-19 11:27 pm EST
          • Replaced 2009-04-20 8:48 am EST
    • lqsh 2009-04-18 1:12 pm EST
      • sbenitezb 2009-04-18 1:26 pm EST
        • Moredhas 2009-04-18 9:37 pm EST
      • broch 2009-04-22 4:24 pm EST
    • ruel24 2009-04-19 12:16 am EST
  2. matto1990 2009-04-18 10:20 am EST
    • Kroc 2009-04-18 10:37 am EST
      • ephracis 2009-04-18 12:22 pm EST
        • dvzt 2009-04-18 12:41 pm EST
          • sbenitezb 2009-04-18 1:29 pm EST
          • Thom Holwerda 2009-04-18 1:34 pm EST
          • sbenitezb 2009-04-18 2:14 pm EST
          • lemur2 2009-04-18 3:26 pm EST
          • smashIt 2009-04-18 5:15 pm EST
          • BluenoseJake 2009-04-18 9:07 pm EST
          • bousozoku 2009-04-18 2:31 pm EST
          • Valhalla 2009-04-18 3:42 pm EST
          • Thom Holwerda 2009-04-18 3:49 pm EST
          • darknexus 2009-04-18 4:25 pm EST
          • Valhalla 2009-04-18 5:17 pm EST
          • werpu 2009-04-18 5:54 pm EST
          • werpu 2009-04-18 5:50 pm EST
          • Finchwizard 2009-04-19 12:40 am EST
          • FealDorf 2009-04-19 2:45 am EST
          • dvzt 2009-04-18 7:05 pm EST
          • Alleister 2009-04-18 4:46 pm EST
      • StephenBeDoper 2009-04-19 10:17 pm EST
    • puenktchen 2009-04-18 10:41 am EST
    • CrLf 2009-04-18 12:58 pm EST
    • lqsh 2009-04-18 1:31 pm EST
    • Phloptical 2009-04-18 3:31 pm EST
      • evangs 2009-04-19 6:06 am EST
        • Phase Angle 2009-04-19 8:45 am EST
        • unclefester 2009-04-19 1:03 pm EST
          • sbergman27 2009-04-19 2:12 pm EST
        • StephenBeDoper 2009-04-19 10:29 pm EST
    • Alleister 2009-04-18 4:43 pm EST
    • abraxas 2009-04-19 1:52 am EST
  3. lqsh 2009-04-18 12:52 pm EST
    • FealDorf 2009-04-18 1:14 pm EST
      • sbenitezb 2009-04-18 1:23 pm EST
        • kaiwai 2009-04-18 2:05 pm EST
          • abraxas 2009-04-19 3:30 am EST
          • kaiwai 2009-04-19 4:03 am EST
          • abraxas 2009-04-19 4:42 am EST
          • DrillSgt 2009-04-19 4:14 pm EST
          • abraxas 2009-04-20 9:44 pm EST
          • darknexus 2009-04-20 10:13 pm EST
          • abraxas 2009-04-21 6:01 pm EST
          • darknexus 2009-04-22 6:52 am EST
        • FealDorf 2009-04-18 2:24 pm EST
          • sbenitezb 2009-04-18 3:23 pm EST
          • lemur2 2009-04-18 3:32 pm EST
          • darknexus 2009-04-18 4:22 pm EST
          • FealDorf 2009-04-18 7:20 pm EST
          • werpu 2009-04-19 6:21 pm EST
        • google_ninja 2009-04-18 5:32 pm EST
      • lqsh 2009-04-18 1:26 pm EST
        • FealDorf 2009-04-18 2:26 pm EST
          • lqsh 2009-04-18 2:47 pm EST
          • FealDorf 2009-04-18 2:51 pm EST
          • PlatformAgnostic 2009-04-18 8:42 pm EST
          • darknexus 2009-04-18 9:02 pm EST
          • FealDorf 2009-04-18 11:27 pm EST
      • werpu 2009-04-18 5:58 pm EST
    • Soulbender 2009-04-19 10:17 am EST
  4. sbenitezb 2009-04-18 1:18 pm EST
  5. Milo_Hoffman 2009-04-18 1:35 pm EST
    • Thom Holwerda 2009-04-18 1:37 pm EST
  6. lqsh 2009-04-18 1:40 pm EST
    • Kroc 2009-04-18 5:42 pm EST
      • darknexus 2009-04-18 6:37 pm EST
        • D3M0N 2009-04-18 10:28 pm EST
          • darknexus 2009-04-19 12:41 am EST
          • Phase Angle 2009-04-19 8:41 am EST
    • Moredhas 2009-04-18 9:57 pm EST
  7. helf 2009-04-18 2:36 pm EST
  8. lqsh 2009-04-18 2:49 pm EST
    • evangs 2009-04-19 6:09 am EST
    • vikramsharma 2009-04-20 2:51 am EST
  9. eantoranz 2009-04-18 3:40 pm EST
  10. sigzero 2009-04-18 9:37 pm EST
    • Moredhas 2009-04-18 10:00 pm EST
      • Valhalla 2009-04-19 6:15 am EST
  11. mrhasbean 2009-04-18 11:23 pm EST
    • StephenBeDoper 2009-04-20 12:01 am EST
      • lemur2 2009-04-20 12:37 am EST
        • StephenBeDoper 2009-04-20 12:58 am EST
          • lemur2 2009-04-20 1:25 am EST
  12. 3rdalbum 2009-04-19 8:16 am EST
    • skingers6894 2009-04-20 12:23 am EST
      • sakeniwefu 2009-04-20 3:28 am EST
        • skingers6894 2009-04-20 7:35 am EST
  13. FealDorf 2009-04-20 7:06 am EST
    • lemur2 2009-04-20 9:52 am EST
      • FealDorf 2009-04-20 12:18 pm EST
      • smashIt 2009-04-20 5:08 pm EST