Does iWorm malware make Mac computers no longer safe?

Mac doesn’t get viruses. This is a statement often used by Mac users against Windows lovers. I’m using Mac for more than 5 years as my primary computer at home. I have Mac antivirus installed in my Mac for the last 3 years. I got few virus alerts when it detected Windows virus in my files, saying that even though my Mac won’t be affected by the virus, my computer can be virus carrier and spreading it to Windows computers unless I clean the virus. Makes sense, so I did delete those Windows viruses.

I never got any single alert that the antivirus caught a Mac malware in my computer. Not even once.

Therefore I assumed that Mac is actually safe all these years.

Then I read about a new malware called iWorm few days ago. This malware creates some sort of backdoor connecting to control servers, allowing the creators to send instructions to a Mac computer. After iWorm connects to the control server, it can send sensitive user informations, parameters in configuration files, put Mac to sleep, perform GET queries and other backdoor activities. Previously, it used Reddit’s search service to retrieve botnet server list. This search string has been shut down, but the creators can easily set up another server list that we haven’t known yet.

So, does this mean that Mac computers are no longer safe?

Interestingly, according to this article, iWorm doesn’t actually spreading like virus. This malware was started from a user named aceprog on PirateBay. This user uploaded some installers of pirated software, such as Adobe Photoshop, Adobe Illustrator, Microsoft Office and many more. These installers are actually modified and infected with iWorm. When a Mac user downloads one of these installers and tries to install the pirated software, iWorm can self-install BECAUSE those Mac users typed their administrator password. So, to put it frankly, this malware is not auto-spreading. Those users INSTALLED the malware from their own action and gave it admin privileges.

It becomes a simple issue now. If you don’t want to have iWorm malware infects your Mac, don’t install pirated software.

Speaking about malware and virus, do understand that virus is just one of few types of malware. Other than virus, there are other malware such as trojan and worm. Loosely speaking, this iWorm malware fits more into the definition of trojan, even the name contains “worm”.

Most Mac haters will rejoice upon reading news about iWorm. Little do they know that no sophisticated OS security will be able to fix stupidity.

Another good news, yesterday Apple has released an XProtect update with iWorm.A, iWorm.B and iWorm.C definitions. This update should be received by Mac computers automatically. OS X versions before Mavericks used to have a way to “force” update this definitions. But since Mavericks, there is no way to manually forcing an update (yet). Most users should automatically got this silent update within the next few days though.