New MacOS X trojan/virus alert, mostly a non-event Options

[andrew]

A file called "latestpics.tgz" was posted on a Mac rumors web site http://www.macrumors.com/ , claiming to be pictures of "MacOS X Leopard" (an upcoming version of MacOS X, aka "MacOS X 10.5"). It is actually a Trojan (or arguably, a very non-virulent virus). We'll call it "Oompa-Loompa" (aka "OSX/Oomp-A") for reasons that will become obvious.

Update: Some of the media reports have been inaccurate, stating that I "discovered" this trojan/virus. This is incorrect; it was discovered by a number of readers of http://www.MacRumors.com/ and was passed along to me by the admin of the site, arn. It has also been stated that I analyzed this trojan/virus alone; that's also incorrect. I did some work trudging through it, but primarily was a filter for the yeoman's work done by Ed Wynne and Glenn Anderson.

Unless you work for an anti-virus company, please don't email/message me asking for a copy of this trojan. It's not going to happen.

You cannot be infected by this unless you do all of the following:

1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file

2) Double-click on the file to decompress it

3) Double-click on the resulting file to "open" it

...and then for non-Admin users, it fails to infect most applications.

You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.

A few important points

-- This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- If you're not running as an admin user, it will silently fail to infect most applications

-- It doesn't actually do anything other than attempt to propagate itself via iChat, and then only via Bonjour! (aka "Rendezvous) -- it does not sent itself over the Internet, rather just to your local Bonjour user list

-- It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching

-- It's not particularly sophisticated

--I'd really be tempted to call this thing a non-event; it's poorly written, can't spread beyond your local network, is unlikely to infect anything on most machines, and needs user interaction to do anything at all--

A good rule of thumb is: if your user account allows you to install an application without entering your password, then this trojan/virus can modify (infect) that application without you entering a password. Regardless, it can install the "apphook" InputManager portion of its payload no matter what type of user account you have (admin or non-admin).

To be on the safe side...

DO NOT DOWNLOAD OR RUN THIS FILE

It's come to my attention that this file was actually originally posted to a "hacking" web board under a different name, purporting to be a picture of the MacBook Pro internals. Someone likely renamed it and posted it to MacRumors.com.

When unarchived (it is a gzip-compressed tar file), which can be done by simply double-clicking on the file, it appears to be a JPEG file because someone pasted the image of a JPEG file onto the file.

After it's been unzipped, tar will tell you there are two files in the archive:

._latestpics
latestpics

...the ._latestpics is just the resource fork of the file, which contains the pasted in custom icon meant to fool people into double-clicking on it to (in theory) open the JPEG file for viewing. In actuality, double-clicking on it will launch an executable file.

The file "latestpics" is actually a PowerPC-compiled executable program, with routines such as:

_infect:
_infectApps:
_installHooks:
_copySelf:

Here's what it does if a user double-clicks on the file, or otherwise executes it:

1) It copies itself to /tmp as "latestpics"
2) It recreates its resource fork in /tmp (with the custom icon in it) from an internally stored gzip'd copy, then sets custom icon bit for the new file in /tmp
3) It then tar + gzips itself so a pristine copy of itself in .tgz format is left in /tmp
4) It renames itself from "latestpics.tar.gz" to "latestpics.tgz" then deletes the copied "latestpics" executable from /tmp

--This gives it a pristine copy of itself, for later transmission.--

5) It extracts an Input Manager called "apphook.bundle" that is embedded in the macho executable, and copies it to /tmp
6a) If your uid = 0 (you're root), it creates /Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
6b) If your uid != 0 (you're not root), it creates ~/Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
7) When any application is launched, MacOS X loads the newly installed "apphook" Input Manager automatically into its address space

--This allows it to have the code in the "apphook.bundle" injected into any subsequently launched application via the InputManager mechanism--

8a) When an application is subsequently launched, the "apphook.bundle" Input Manager then appears to try to send the pristine "latestpics.tgz" file in /tmp to people on your buddy list via iChat (who will then presumably download the file, double-click on it, and the cycle repeats).

8b) (It looks like the author intended to get it to send the "latestpics.tgz" file out via eMail as well, but never got around to writing that code)

9) It only sends itself to people on your local Bonjour! (aka "Rendezvous") buddy list; it cannot send itself over the Internet

--This lets it send itself to people on your Bonjour! buddy list via iChat; this appears to be the only way it self-propagates externally--

10) It then uses Spotlight to find the 4 most recently used applications on your machine that are not owned by root
11) In an apparent "Charlie and the Chocolate Factory" reference, it then checks to see if the xattr 'oompa' of the application executable is > 0... if so, it bails out, to prevent it from re-infecting an already infected application
12) If not, it sets the xattr 'oompa' of the application executable to be 'loompa' (this does nothing, it is just a marker that it has infected this app)
13) It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan

nb: If run via double-clicking on the file, and the user doesn't have privileges to modify an application, it silently fails.

--It has thus effectively injected its code in the host application, but it can only do so for applications that the user has write access to--

13) When an infected application is launched from then on, the trojan code is executed, and it tries to re-infect and re-propagate itself to other applications
14) It then does an execv on the resource fork of the executable, which is the original application, so the application launches as it normally would (in theory... see below)
15) Due to a bug in it's code for executing the original app from it's resource fork, it is only allocating a buffer 4 bytes bigger than the path when appending "/..namedfork/rsrc" to the path, it will stop any app it infects from running. Instead of adding the length of the string, it errantly adds the length of the pointer to the string, which is always 4 bytes.

--In the end, it doesn't appear to actually do anything other than try to propagate itself via iChat over your local Bonjour! buddy list (it cannot send itself over the Internet), and unintentionally prevent infected applications from running--

It seems that this is more of a "proof of concept" implementation that could be utilized to actually do something in the future, depending on how successful it is, or it was simply done to garner attention/press. Which I'm sure it'll get.

.....

The executable itself has a number of interesting things embedded into various macho segments, including an entire Input Manager bundle called "apphook" (stored as "latestpics_hook.tar"); the string data is "protected" with a simple XOR to prevent easy reading of what it's doing. It's definitely trying to mask what it is doing in a number of ways, but is relatively simplistic in nature.

If you are a programmer, attached is the disassembly of the executable (it's just a plain text file) for your reading pleasure. This is just the main executable portion of the code, not the embedded "apphook" InputManager code.

Thanks to Ed Wynne for his crucial help in uncovering the true nature of this trojan, Glenn Anderson for his southern-hemisphere hacking help, and other "smart friends".

Attached File(s)

 latestpics_annotated.txt ( 74.24K ) Number of downloads: 7538