Possible OS X Trojan?

[bbloke]

MacRumors.com is carrying a story about a possible new trojan for OS X, although they first termed it a virus. It appears to be in the form of a file that must be decompressed, and the content pretends to be a JPEG.

Originally Posted by MacRumors.com

The resultant file decompresses into what appears to be a standard JPEG icon in Mac OS X but is actually a compiled Unix executable in disguise. An initial disassembly (from original discussion thread) reveals evidence that the application is virus-like or was designed to give that impression. Routines listed include:

_infect:
_infectApps:
_installHooks:
_copySelf:

The exact consequences of the application are unclear, but according to the users that originally executed the application have noted that it appeared to self propogate:

"If anyone remembers last night, when lasthope spread that picture that opened in terminal. I just turned on my other computer and it said it had an incoming file, from my computer, which was the latest pics file. Any help. I have already secure deleted it off of my harddrive, but how do i know that it will not come back."

I thought I should mention this article in case it is true and anyone here comes across the file, but I'm not panicking and saying the sky is falling, though.

[bbloke]

Sophos have stated it is the first Mac OS X virus, and that it spreads via iChat software:

First ever virus for Mac OS X discovered

OSX/Leap-A worm spreads via iChat instant messaging software

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have announced the discovery of the first virus for the Apple Mac OS X platform. The virus, named OSX/Leap-A (also known as OSX/Oompa-A) spreads via instant messaging systems.

The OSX/Leap-A worm spreads via the iChat instant messaging system, forwarding itself as a file called latestpics.tgz to contacts on the infected users' buddy list. When the latestpics.tgz archive file is opened on a computer it disguises its contents with a JPEG graphic icon in an attempt to fool people into thinking it is harmless.

The worm uses the text "oompa" as an infection marker in the resource forks of infected programs to prevent it from reinfecting the same files.

"Some owners of Mac computers have held the belief that Mac OS X is incapable of harboring computer viruses, but Leap-A will leave them shellshocked, as it shows that the malware threat on Mac OS X is real," said Graham Cluley, senior technology consultant for Sophos. "Mac users shouldn't think it's okay to lie back and not worry about viruses."

Experts at Sophos are continuing to examine OSX/Leap-A and will issue further information shortly. Sophos customers have been automatically protected against the worm since 12:25 GMT, 16 February 2006.

"This is the first real virus for the Mac OS X platform," continued Cluley. "Apple Mac users need to be just as careful running unknown or unsolicited code on their computers as their friends and colleagues running Windows."

Sophos advises all computer users, whether running PCs or Macs, to practise safe computing and keep their anti-virus software updated.

[Mikuro]

Sophos advises all computer users, whether running PCs or Macs, to practise safe computing and keep their anti-virus software updated.

Bad advice. Safe computing = good. Anti-virus Mac software = a cure that's worse than the disease.

This is certainly interesting. Didn't Apple make it so the OS would warn you the first time it launched an application in a certain way? They probably ought to expand that to include launching an application by double-clicking it.

[Tommo]

There are more details here.

http://www.theregister.co.uk/2006/02/16/mac_os-x_virus/

They say it prompts for an admin password, but I sometimes think OSX does that so often that some users may become complacent and just type it in before they think why they are being asked.

[bbloke]

And probably the most detail I have come across can be found on the Ambrosia forums, believe it or not! Here are some excerpts:

A few important points

-- This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- It requires the admin password if you're not running as an admin user

-- It doesn't actually do anything other than attempt to propagate itself via iChat

-- It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching

-- It's not particularly sophisticated

Here's what it does if a user double-clicks on the file, or otherwise executes it:

1) It copies itself to /tmp as "latestpics"
2) It recreates its resource fork in /tmp (with the custom icon in it) from an internally stored gzip'd copy, then sets custom icon bit for the new file in /tmp
3) It then tar + gzips itself so a pristine copy of itself in .tgz format is left in /tmp
4) It renames itself from "latestpics.tar.gz" to "latestpics.tgz" then deletes the copied "latestpics" executable from /tmp

--This gives it a pristine copy of itself, for later transmission.--

5) It extracts an Input Manager called "apphook.bundle" that is embedded in the macho executable, and copies it to /tmp
6a) If your uid = 0 (you're root), it creates /Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
6b) If your uid != 0 (you're not root), it creates ~/Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
7) When any application is launched, MacOS X loads the newly installed "apphook" Input Manager automatically into its address space

--This allows it to have the code in the "apphook.bundle" injected into any subsequently launched application via the InputManager mechanism--

8a) When an application is subsequently launched, the "apphook.bundle" Input Manager then appears to try to send the pristine "latestpics.tgz" file in /tmp to people on your buddy list via iChat (who will then presumably download the file, double-click on it, and the cycle repeats).

8b) (It looks like the author intended to get it to send the "latestpics.tgz" file out via eMail as well, but never got around to writing that code)

--This lets it send itself to people on your buddy list via iChat; this appears to be the only way it self-propagates externally--

9) It then uses Spotlight to find the 4 most recently used applications on your machine that are not owned by root
10) In an apparent "Charlie and the Chocolate Factory" reference, it then checks to see if the xattr 'oompa' of the application executable is > 0... if so, it bails out, to prevent it from re-infecting an already infected application
11) If not, it sets the xattr 'oompa' of the application executable to be 'loompa' (this does nothing, it is just a marker that it has infected this app)
12) It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan

--It has thus effectively injected its code in the host application--

13) When an infected application is launched from then on, the trojan code is executed, and it tries to re-infect and re-propagate itself to other applications
14) It then does an execv on the resource fork of the executable, which is the original application, so the application launches as it normally would (in theory... see below)
15) Due to a bug in it's code for executing the original app from it's resource fork, it is only allocating a buffer 4 bytes bigger than the path when appending "/..namedfork/rsrc" to the path, it will stop any app it infects from running. Instead of adding the length of the string, it errantly adds the length of the pointer to the string, which is always 4 bytes.

In the end, it doesn't appear to actually do anything other than try to propagate itself via iChat, and unintentionally prevent infected applications from running

It seems that this is more of a "proof of concept" implementation that could be utilized to actually do something in the future, depending on how successful it is, or it was simply done to garner attention/press. Which I'm sure it'll get.

[fryke]

Doooooooooooooooooooooooon't panic. It's a trojan, which you have to execute yourself, if you want to be harmed. Which, of course, you don't.

[bbloke]

Who's panicking?

It does seem to be another case the user having to "pull the trigger" on themselves, so the user is not exactly defenseless against this delightful offering...

[sinclair_tm]

sounds easy to advoid, just don't open anything sent to you in ichat, unless you have cleared it with the person that sent it to you. and i know i'll never see this rhing, nobody i have in ichat has a mac, they are using aim on windows, or on their cell phone. i just find it humors that my dad and i just had a disscution about malware and macs last night. he must be a prophet because he said it wasn't a matter of if, but when, and promised me that they were coming. don't you just hate it how dads are always right.