Possible OS X Trojan?

bbloke

bbloke

Registered
MacRumors.com is carrying a story about a possible new trojan for OS X, although they first termed it a virus. It appears to be in the form of a file that must be decompressed, and the content pretends to be a JPEG.

MacRumors.com said:
The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but is actually a compiled Unix executable in disguise. An initial disassembly (from original discussion thread) reveals evidence that the application is virus-like or was designed to give that impression. Routines listed include:

_infect:
_infectApps:
_installHooks:
_copySelf:

The exact consequences of the application are unclear, but according to the users that originally executed the application have noted that it appeared to self propogate:

"If anyone remembers last night, when lasthope spread that picture that opened in terminal. I just turned on my other computer and it said it had an incoming file, from my computer, which was the latest pics file. Any help. I have already secure deleted it off of my harddrive, but how do i know that it will not come back."
Click to expand...
I thought I should mention this article in case it is true and anyone here comes across the file, but I'm not panicking and saying the sky is falling, though. :)
 
Sophos have stated it is the first Mac OS X virus, and that it spreads via iChat software:

First ever virus for Mac OS X discovered

OSX/Leap-A worm spreads via iChat instant messaging software

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have announced the discovery of the first virus for the Apple Mac OS X platform. The virus, named OSX/Leap-A (also known as OSX/Oompa-A) spreads via instant messaging systems.

The OSX/Leap-A worm spreads via the iChat instant messaging system, forwarding itself as a file called latestpics.tgz to contacts on the infected users' buddy list. When the latestpics.tgz archive file is opened on a computer it disguises its contents with a JPEG graphic icon in an attempt to fool people into thinking it is harmless.

The worm uses the text "oompa" as an infection marker in the resource forks of infected programs to prevent it from reinfecting the same files.

"Some owners of Mac computers have held the belief that Mac OS X is incapable of harboring computer viruses, but Leap-A will leave them shellshocked, as it shows that the malware threat on Mac OS X is real," said Graham Cluley, senior technology consultant for Sophos. "Mac users shouldn't think it's okay to lie back and not worry about viruses."

Experts at Sophos are continuing to examine OSX/Leap-A and will issue further information shortly. Sophos customers have been automatically protected against the worm since 12:25 GMT, 16 February 2006.

"This is the first real virus for the Mac OS X platform," continued Cluley. "Apple Mac users need to be just as careful running unknown or unsolicited code on their computers as their friends and colleagues running Windows."

Sophos advises all computer users, whether running PCs or Macs, to practise safe computing and keep their anti-virus software updated.
Click to expand...
 
Sophos advises all computer users, whether running PCs or Macs, to practise safe computing and keep their anti-virus software updated.
Click to expand...
Bad advice. Safe computing = good. Anti-virus Mac software = a cure that's worse than the disease.

This is certainly interesting. Didn't Apple make it so the OS would warn you the first time it launched an application in a certain way? They probably ought to expand that to include launching an application by double-clicking it.
 
And probably the most detail I have come across can be found on the Ambrosia forums, believe it or not! Here are some excerpts:

A few important points

-- This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- It requires the admin password if you're not running as an admin user

-- It doesn't actually do anything other than attempt to propagate itself via iChat

-- It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching

-- It's not particularly sophisticated
Click to expand...
Here's what it does if a user double-clicks on the file, or otherwise executes it:

1) It copies itself to /tmp as "latestpics"
2) It recreates its resource fork in /tmp (with the custom icon in it) from an internally stored gzip'd copy, then sets custom icon bit for the new file in /tmp
3) It then tar + gzips itself so a pristine copy of itself in .tgz format is left in /tmp
4) It renames itself from "latestpics.tar.gz" to "latestpics.tgz" then deletes the copied "latestpics" executable from /tmp

--This gives it a pristine copy of itself, for later transmission.--

5) It extracts an Input Manager called "apphook.bundle" that is embedded in the macho executable, and copies it to /tmp
6a) If your uid = 0 (you're root), it creates /Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
6b) If your uid != 0 (you're not root), it creates ~/Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
7) When any application is launched, MacOS X loads the newly installed "apphook" Input Manager automatically into its address space

--This allows it to have the code in the "apphook.bundle" injected into any subsequently launched application via the InputManager mechanism--

8a) When an application is subsequently launched, the "apphook.bundle" Input Manager then appears to try to send the pristine "latestpics.tgz" file in /tmp to people on your buddy list via iChat (who will then presumably download the file, double-click on it, and the cycle repeats).

8b) (It looks like the author intended to get it to send the "latestpics.tgz" file out via eMail as well, but never got around to writing that code)

--This lets it send itself to people on your buddy list via iChat; this appears to be the only way it self-propagates externally--

9) It then uses Spotlight to find the 4 most recently used applications on your machine that are not owned by root
10) In an apparent "Charlie and the Chocolate Factory" reference, it then checks to see if the xattr 'oompa' of the application executable is > 0... if so, it bails out, to prevent it from re-infecting an already infected application
11) If not, it sets the xattr 'oompa' of the application executable to be 'loompa' (this does nothing, it is just a marker that it has infected this app)
12) It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan

--It has thus effectively injected its code in the host application--

13) When an infected application is launched from then on, the trojan code is executed, and it tries to re-infect and re-propagate itself to other applications
14) It then does an execv on the resource fork of the executable, which is the original application, so the application launches as it normally would (in theory... see below)
15) Due to a bug in it's code for executing the original app from it's resource fork, it is only allocating a buffer 4 bytes bigger than the path when appending "/..namedfork/rsrc" to the path, it will stop any app it infects from running. Instead of adding the length of the string, it errantly adds the length of the pointer to the string, which is always 4 bytes.

In the end, it doesn't appear to actually do anything other than try to propagate itself via iChat, and unintentionally prevent infected applications from running

It seems that this is more of a "proof of concept" implementation that could be utilized to actually do something in the future, depending on how successful it is, or it was simply done to garner attention/press. Which I'm sure it'll get.
Click to expand...
 
Doooooooooooooooooooooooon't panic. It's a trojan, which you have to execute yourself, if you want to be harmed. Which, of course, you don't.
 
Who's panicking? ;)

It does seem to be another case the user having to "pull the trigger" on themselves, so the user is not exactly defenseless against this delightful offering...
 
sounds easy to advoid, just don't open anything sent to you in ichat, unless you have cleared it with the person that sent it to you. and i know i'll never see this rhing, nobody i have in ichat has a mac, they are using aim on windows, or on their cell phone. i just find it humors that my dad and i just had a disscution about malware and macs last night. he must be a prophet because he said it wasn't a matter of if, but when, and promised me that they were coming. don't you just hate it how dads are always right.
 
I think they're blowing it out of proportion. Everyone's saying "Oh my God, there's a Mac OS trojan now. The world's going to end!" It can propogate via iChat but the program doesn't do anything malicious. On top of that, you have to download and open it yourself, so why worry?
 
bbloke said:
Who's panicking? ;)

It does seem to be another case the user having to "pull the trigger" on themselves, so the user is not exactly defenseless against this delightful offering...
Click to expand...
Well... I just wanted to make it clear. ;) ... I saw the thread, saw three or more linked articles and thought: Wow, I hope this is not too MUCH information for the casual reader. ;)

It doesn't propagate through iChat, really, either. The recipient has to _accept_ the file first, unpack it and run the executable. "It _tries_ to propagate through iChat" is more like it, I think... And yes, it gets blown out of proportion.
 
Back in the old days, propogating from system to system was not the way viruses worked — with Internet usage so common, how could they? A virus is not something that "infects" a system by being installed; it infects multiple programs within a single system by attaching itself to them, altering their code so that it can run when they run, and then spread to other programs, etc.

So it sounds to me like this is a honest-to-goodness VIRUS, not just a trojan. Which is quite rare these days — I can't remember the last "virus" I've heard of that was actually a virus.

I'm giddy with geeky excitement! ;)
 
fryke said:
Well... I just wanted to make it clear. ;) ... I saw the thread, saw three or more linked articles and thought: Wow, I hope this is not too MUCH information for the casual reader. ;)
Click to expand...
Ah, I like to be well-informed. :)

Actually, I thought this was something that could be blown out of proportion, so I wanted to provide information as I came across it. I suspected anti-virus manufacturers would, of course, try to build on people's fears!

It still seems like the user has to assist this malware and so it is not as bad as one could expect, but it is an interesting beast, nonetheless.
 
Mikuro said:
Back in the old days, propogating from system to system was not the way viruses worked — with Internet usage so common, how could they? A virus is not something that "infects" a system by being installed; it infects multiple programs within a single system by attaching itself to them, altering their code so that it can run when they run, and then spread to other programs, etc.
Click to expand...

Well... Back in the old days, propagating from system to system was EXACTLY how viruses worked. With floppies. Where would you get infected if not through those...

It's considered a trojan because like the Trojan Horse (Homer) it comes as something people might want (screenshots of Leopard), so they might double-click the executable, thinking it was a JPEG-file. That makes it a trojan by definition.

A virus, in my opinion, doesn't really need user interaction...
 
The press just couldn't wait for a Mac virus story (virus or not).

The King is dead!
Long live the King!
 
fryke said:
Well... Back in the old days, propagating from system to system was EXACTLY how viruses worked. With floppies. Where would you get infected if not through those...

It's considered a trojan because like the Trojan Horse (Homer) it comes as something people might want (screenshots of Leopard), so they might double-click the executable, thinking it was a JPEG-file. That makes it a trojan by definition.

A virus, in my opinion, doesn't really need user interaction...
Click to expand...
Hmm. Well, spreading from computer to computer was not IN the virus's code. It just happened, through user interaction. Viruses did not specifically target floppies for the purpose of spreading to other computers. All they were programmed to do was infect program after program.

So I still think we've got a genuine virus here, even if it's wrapped up in a trojan. The two terms aren't really mutually exclusive, after all.

Come to think of it, I guess you could call it a worm, too, since it does try to propogate itself through networking. Hmm...
 
Any more info on that second one? What they offer is awfully vague. Using bluetooth sounds interesting, but it also sounds like it would have a very, very narrow scope. I mean, most systems don't even have Bluetooth, and even the ones that do would only be able to spread it to other Bluetooth-enabled machines within, what, 30-100 feet?
 
It was released from Symantec. Figures. They want us to buy their product. And then subscribe yearly for definition updates. And they probably will raise that subscription price just because of this.
 
You must log in or register to reply here.
Back
Top