New MacOS X trojan/virus alert, mostly a non-event Options

[andrew]

A file called "latestpics.tgz" was posted on a Mac rumors web site http://www.macrumors.com/ , claiming to be pictures of "MacOS X Leopard" (an upcoming version of MacOS X, aka "MacOS X 10.5"). It is actually a Trojan (or arguably, a very non-virulent virus). We'll call it "Oompa-Loompa" (aka "OSX/Oomp-A") for reasons that will become obvious.

Update: Some of the media reports have been inaccurate, stating that I "discovered" this trojan/virus. This is incorrect; it was discovered by a number of readers of http://www.MacRumors.com/ and was passed along to me by the admin of the site, arn. It has also been stated that I analyzed this trojan/virus alone; that's also incorrect. I did some work trudging through it, but primarily was a filter for the yeoman's work done by Ed Wynne and Glenn Anderson.

Unless you work for an anti-virus company, please don't email/message me asking for a copy of this trojan. It's not going to happen.

You cannot be infected by this unless you do all of the following:

1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file

2) Double-click on the file to decompress it

3) Double-click on the resulting file to "open" it

...and then for non-Admin users, it fails to infect most applications.

You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.

A few important points

-- This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

-- It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

-- If you're not running as an admin user, it will silently fail to infect most applications

-- It doesn't actually do anything other than attempt to propagate itself via iChat, and then only via Bonjour! (aka "Rendezvous) -- it does not sent itself over the Internet, rather just to your local Bonjour user list

-- It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching

-- It's not particularly sophisticated

--I'd really be tempted to call this thing a non-event; it's poorly written, can't spread beyond your local network, is unlikely to infect anything on most machines, and needs user interaction to do anything at all--

A good rule of thumb is: if your user account allows you to install an application without entering your password, then this trojan/virus can modify (infect) that application without you entering a password. Regardless, it can install the "apphook" InputManager portion of its payload no matter what type of user account you have (admin or non-admin).

To be on the safe side...

DO NOT DOWNLOAD OR RUN THIS FILE

It's come to my attention that this file was actually originally posted to a "hacking" web board under a different name, purporting to be a picture of the MacBook Pro internals. Someone likely renamed it and posted it to MacRumors.com.

When unarchived (it is a gzip-compressed tar file), which can be done by simply double-clicking on the file, it appears to be a JPEG file because someone pasted the image of a JPEG file onto the file.

After it's been unzipped, tar will tell you there are two files in the archive:

._latestpics
latestpics

...the ._latestpics is just the resource fork of the file, which contains the pasted in custom icon meant to fool people into double-clicking on it to (in theory) open the JPEG file for viewing. In actuality, double-clicking on it will launch an executable file.

The file "latestpics" is actually a PowerPC-compiled executable program, with routines such as:

_infect:
_infectApps:
_installHooks:
_copySelf:

Here's what it does if a user double-clicks on the file, or otherwise executes it:

1) It copies itself to /tmp as "latestpics"
2) It recreates its resource fork in /tmp (with the custom icon in it) from an internally stored gzip'd copy, then sets custom icon bit for the new file in /tmp
3) It then tar + gzips itself so a pristine copy of itself in .tgz format is left in /tmp
4) It renames itself from "latestpics.tar.gz" to "latestpics.tgz" then deletes the copied "latestpics" executable from /tmp

--This gives it a pristine copy of itself, for later transmission.--

5) It extracts an Input Manager called "apphook.bundle" that is embedded in the macho executable, and copies it to /tmp
6a) If your uid = 0 (you're root), it creates /Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
6b) If your uid != 0 (you're not root), it creates ~/Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder
7) When any application is launched, MacOS X loads the newly installed "apphook" Input Manager automatically into its address space

--This allows it to have the code in the "apphook.bundle" injected into any subsequently launched application via the InputManager mechanism--

8a) When an application is subsequently launched, the "apphook.bundle" Input Manager then appears to try to send the pristine "latestpics.tgz" file in /tmp to people on your buddy list via iChat (who will then presumably download the file, double-click on it, and the cycle repeats).

8b) (It looks like the author intended to get it to send the "latestpics.tgz" file out via eMail as well, but never got around to writing that code)

9) It only sends itself to people on your local Bonjour! (aka "Rendezvous") buddy list; it cannot send itself over the Internet

--This lets it send itself to people on your Bonjour! buddy list via iChat; this appears to be the only way it self-propagates externally--

10) It then uses Spotlight to find the 4 most recently used applications on your machine that are not owned by root
11) In an apparent "Charlie and the Chocolate Factory" reference, it then checks to see if the xattr 'oompa' of the application executable is > 0... if so, it bails out, to prevent it from re-infecting an already infected application
12) If not, it sets the xattr 'oompa' of the application executable to be 'loompa' (this does nothing, it is just a marker that it has infected this app)
13) It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan

nb: If run via double-clicking on the file, and the user doesn't have privileges to modify an application, it silently fails.

--It has thus effectively injected its code in the host application, but it can only do so for applications that the user has write access to--

13) When an infected application is launched from then on, the trojan code is executed, and it tries to re-infect and re-propagate itself to other applications
14) It then does an execv on the resource fork of the executable, which is the original application, so the application launches as it normally would (in theory... see below)
15) Due to a bug in it's code for executing the original app from it's resource fork, it is only allocating a buffer 4 bytes bigger than the path when appending "/..namedfork/rsrc" to the path, it will stop any app it infects from running. Instead of adding the length of the string, it errantly adds the length of the pointer to the string, which is always 4 bytes.

--In the end, it doesn't appear to actually do anything other than try to propagate itself via iChat over your local Bonjour! buddy list (it cannot send itself over the Internet), and unintentionally prevent infected applications from running--

It seems that this is more of a "proof of concept" implementation that could be utilized to actually do something in the future, depending on how successful it is, or it was simply done to garner attention/press. Which I'm sure it'll get.

.....

The executable itself has a number of interesting things embedded into various macho segments, including an entire Input Manager bundle called "apphook" (stored as "latestpics_hook.tar"); the string data is "protected" with a simple XOR to prevent easy reading of what it's doing. It's definitely trying to mask what it is doing in a number of ways, but is relatively simplistic in nature.

If you are a programmer, attached is the disassembly of the executable (it's just a plain text file) for your reading pleasure. This is just the main executable portion of the code, not the embedded "apphook" InputManager code.

Thanks to Ed Wynne for his crucial help in uncovering the true nature of this trojan, Glenn Anderson for his southern-hemisphere hacking help, and other "smart friends".

Attached File(s)

 latestpics_annotated.txt ( 74.24K ) Number of downloads: 7538

 

[Begemotike]

Woof, that's interesting. Keep us updated Andrew.

[Ragashingo]

Very Interesting.

[das]

Andrew,

If you have the file, could you send it to me for further disassembly? Also, this file should be submitted to entities like Symantec Security Response (e.g., via this method).

My contact information is below.

This post has been edited by das: Feb 16 2006, 01:46 AM

[InfoSecGuy]

Andrew,

Please check your private messages.

[Steeley]

"177 User(s) are reading this topic (174 Guests and 0 Anonymous Users)
3 Members: artoo-detoo, cpfusion, Steelix"

O.o

Woah.

[_tycho61uk_]

Well tickle me pink! Our first malware!!!

Still, you'd have to be caught napping to actually launch this thing surely? I would get pretty suspicous if upon opening a jpeg, I got an admin password dialog.

[Steeley]

Yeah, but there are some very stupid people out there.

[andrew]

Well tickle me pink! Our first malware!!!     

Still, you'd have to be caught napping to actually launch this thing surely? I would get pretty suspicous if upon opening a jpeg, I got an admin password dialog.

[snapback]1534428[/snapback]

That password dialog won't necessarily appear, if you're an admin already.

[hag]

hi,

thanks for all the information. is it possibel to get the file for more investigation and make an signature for clamav?

thanks,
hag

[GooBallFan]

That password dialog won't necessarily appear, if you're an admin already.

[snapback]1534431[/snapback]

Andrew,

why exactly is that? Normally, the admin password is required to write outside user space, so even a logged-in admin would be ask for a pw. What exactly is the Trojan trying to do when the password dialogue only appears with non-admins? (And wouldn't it be time for us to not run stuff as admins?! Though I thought the OS X admin model was secure.)

[palmeira]

If the trojan adds an "apphook" file into /Library/InputManagers/ or
~/Library/InputManagers/
(depending upon whether one is logged in as Admin), would I be correct in thinking that if one did the following, the "apphook" would only be able to be installed with the user's knowledge?

1. If you don't have an InputManagers folder, create one
2. Then control click on the folder and select "enable folder actions"
3. Next, control click the InputManagers folder again and select "attach a folder action".
4. A window will open, click on "add - new item alert"
5. Click choose.

[andrew]

Andrew,

why exactly is that? Normally, the admin password is required to write outside user space, so even a logged-in admin would be ask for a pw. What exactly is the Trojan trying to do when the password dialogue only appears with non-admins? (And wouldn't it be time for us to not run stuff as admins?! Though I thought the OS X admin model was secure.)

[snapback]1534442[/snapback]

The modifications it does to applications.

A non-admin user may not be able to install/delete applications on a MacOS X machine without entering an admin password. An admin user can do it with impunity. Same rule of thumb applies to the trojan.

[andrew]

If the trojan adds an "apphook" file into  /Library/InputManagers/ or
                                                      ~/Library/InputManagers/ 
(depending upon whether one is logged in as Admin), would I be correct in thinking that if  one did the following, the "apphook" would only be able to be installed with the user's knowledge?

1. If you don't have  an InputManagers folder, create one
2. Then control click on the folder and select "enable folder actions"
3. Next, control click the InputManagers folder again and select "attach a folder action".
4. A window will open, click on "add - new item alert"
5. Click choose.

[snapback]1534444[/snapback]

That would prevent it from attempting to send itself to people on your iChat buddy list, but it would still be able to infect your applications.

[JKT]

That would prevent it from attempting to send itself to people on your iChat buddy list, but it would still be able to infect your applications.

[snapback]1534447[/snapback]

Hi,

how about changing permissions to Read only and/or locking the /Library/Input Manager/ (and user equivalent) folder? Would that lead to a password being requested?

I assume that any copy cats would still have to use the Input Manager folder for this (how else would they inject code into all applications?). I haven't looked at APE for a long time so don't recall how it works, but the method it uses is a potentially similar security hole is it not?

[WeeBull]

Presumably there would be a simple spotlight search to pick up any files that have been oopa loompa'd.

Anybody know what that might be? would 'mdfind oompa' or 'mdfind loompa' at the command line do the job?

[tsfall]

Just a thought, but if you change the permissions of your library folder so that it is read only, and therefore requires a password to be entered for items to be changed etc, would that not protect un-infected users in the short term?

Just a thought from a n00b

[lbutler]

That password dialog won't necessarily appear, if you're an admin already.

[snapback]1534431[/snapback]

OK, correct me if I'm wrong on any of this:

1) you have to be logged in as admin
2) you have to use something OTHER than Safari

So, for the vast majority of users, (like the prototypical grandma) they will get at least one warning, right?

I mean, if I downloaded something that claimed to be pictures I'd be suspicious of 1) a .tgz archive 2) one that Safari told me contain an application.

This seems a bit more like an IQ test than a proper worm, or am I not being charitable again?

[JKT]

OK, correct me if I'm wrong on any of this:

1) you have to be logged in as admin
2) you have to use something OTHER than Safari

So, for the vast majority of users, (like the prototypical grandma) they will get at least one warning, right?

I mean, if I downloaded something that claimed to be pictures I'd be suspicious of 1) a .tgz archive 2) one that Safari told me contain an application.

This seems a bit more like an IQ test than a proper worm, or am I not being charitable again?

[snapback]1534457[/snapback]

I'd agree with 1) but Safari will not warn you that it is an application unless Safari decompresses it for you automatically. I don't use Safari, so I don't know if it auto-decompresses tarred files... I'm guessing not. In which case it won't give you any warning at all.

[andrew]

OK, correct me if I'm wrong on any of this:

1) you have to be logged in as admin
2) you have to use something OTHER than Safari

So, for the vast majority of users, (like the prototypical grandma) they will get at least one warning, right?

I mean, if I downloaded something that claimed to be pictures I'd be suspicious of 1) a .tgz archive 2) one that Safari told me contain an application.

This seems a bit more like an IQ test than a proper worm, or am I not being charitable again?

[snapback]1534457[/snapback]

Honestly, I think the odds of anyone being affected by this are very, very small. You have to get the file somehow (and there seem to be very few people who have it), then you have to explicitly decompress it and double-click on it, then if you're not an admin user, you have to enter your password for it to infect applications (it can still install the InputManager portion without needing a password, though).

Remember, the InputManager portion of this little nasty is what tries to send itself via iChat... so if people you know start trying to send you "latestpics.tgz" via iChat, graciously decline to accept the file.

Regardless of anything, explicit user actions are needed for anyone to become infected by OSX/Oomp-A -- if you don't download, decompress, and then double click on the file, you can't become infected by it. It tries to fool the user into doing this, because it is at its core a rather simplistically written program.

[Captaintripps]

We got dugg Davey...we got dugg.

[lbutler]

I'd agree with 1) but Safari will not warn you that it is an application unless Safari decompresses it for you automatically. I don't use Safari, so I don't know if it auto-decompresses tarred files... I'm guessing not. In which case it won't give you any warning at all.

[snapback]1534459[/snapback]

Even so, that is the default setting for Safari, IIRC, so my point still stands that the prototypical Grandma is going to get at least one warning.

I don't use Safari much... <looks up in surprise> though I'm using it just now ... but I also don't run my machine as an admin.

[ToLazyToMakeAnAc...]

Here's a stupid idea:

What if you were to create files with the names the program uses in /tmp, and make them non-changeable by anyone (owned and grouped to actual root, rather than just admins, and make 'em have no permissions access...)

That would make you need to have a password box too? Or maybe just give the program an error, because its something it can't deal with?

[lbutler]

What if you were to create files with the names the program uses in /tmp, and make them non-changeable by anyone (owned and grouped to actual root, rather than just admins, and make 'em have no permissions access...)

[snapback]1534471[/snapback]

No, that would work. For this specific version. However, it would be trivial to have it use a random directory name in /tmp, or even a not so random name, perhaps your user name, for example?

[ToLazyToMakeAnAc...]

I know, I thought of that too.


But, for this particular nasty, that would work.


EDIT: The "program" uses spotlight, what is its effect on machines running Panther?

This post has been edited by ToLazyToMakeAnAccount: Feb 16 2006, 08:34 AM