iWork 2009 Trojan building a botnet

This week security researchers reported that pirated copies of iWork 2009 may contain a Trojan horse. Experts note that with Mac OS X threats, you have to be fooled into installing them. In this case, the chance to own iWork 2009 on the cheap is the potential draw. Most antivirus programs for the Mac are capable of stopping this threat.

But hasn't been widely reported is what happens after a machine is infected.

Jose Nazario of Arbor Networks today posted an interesting blog on the iWork Trojan. He found that it's creating a botnet (of course).

Earlier this week I speculated that the Downadup/Conficker worm might be doing the same.

Nazario says, like other botnets, it keeps trying until it connects to the command and control server. "It also grabs a list of seed P2P peers from the file itself by decrypting the running file (thwarting static analysis) and managing the known peers as you would expect. It generates a port to listen on as needed (although it’s not quite clear to me how it would handle being behind a NAT device)…. What’s more is that there is an embedded Lua interpreter, giving a very sophisticated command language some additional structure."

What is this new botnet been up to? So far, Nazario reports it has been creating distributed denial of service (DDoS) attacks.

Is the Downadup/Conficker worm building a new botnet?

There's a new Internet worm spreading that may be comparable to Melissa, Sasser, and Blaster in terms of the number of machines infected.

The worm, Downadup (also known as Win32.Conficker.B or simply "Conficker"), exploits a specially crafted RPC request vulnerability found in unpatched versions of the Windows Server service. Microsoft issued a rare out-of-cycle patch, MS08-67, for this flaw on Oct. 23, 2008.

However, estimates of up to nine million Downadup infections within the last week alone suggest that many systems worldwide haven't been patched. Thus the greatest danger from Downadup is to businesses that have not updated their desktops and servers on a regular basis. Home computers protected by a firewall are less at risk, although an infected laptop from work could nonetheless infect a home network. Microsoft has rated the MS08-067 patch Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008.

According to the SAN Internet Storm Center Downadup uses multiple vectors to infect PCs.

1) Computers without the October 2008 patch can be attacked remotely and taken over.

2) Downadup can also "brute force" or guess Administrator passwords on local networks and then spread through ADMIN$ shares.

3) Finally, Downadup can create a special autorun.inf file and include its DLL on an infected removable device, such as a USB or external hard drive.

Once executed, Downadup disables a number of system services, including Windows Security Center, Windows Defender, Windows Automatic Update, and Windows Error Reporting. Downadup then generates a list of possible domains, selects one, and then attempts to connect to a malicious server to download additional malware onto the infected computer.

Given all the secrecy just to download additional malware, I'm thinking this is a botnet-creating worm.

Although Microsoft added Downadup detection to its January 2009 Malicious Software Removal Tool (MSRT), an anti-malware utility distributed to Windows machines via the Windows Update process, experts recommend that users apply the MS08-068 patch from last October if you haven't already done so. Additionally, users may also want to disable Autorun so that an infected USB drive or removable media device won't infect your PC, however, disabling Autorun in Windows involves editing the System Registry and should only be done by experienced personnel.