[39072] in bugtraq
Malicious Bundles on Mac OS X
daemon@ATHENA.MIT.EDU (Braden Thomas)
Sat Jun 4 22:01:40 2005
Mime-Version: 1.0 (Apple Message framework v730)
To: bugtraq@securityfocus.com
Message-Id: <364D1FF3-1B5E-464E-9D15-51F11A60F7F4@myrealbox.com>
Content-Type: multipart/mixed; boundary=Apple-Mail-5-33680811
From: Braden Thomas <braden127@myrealbox.com>
Date: Sat, 4 Jun 2005 19:21:57 -0400
--Apple-Mail-5-33680811
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=US-ASCII;
delsp=yes;
format=flowed
I wrote some information about Malicious Bundles on Mac OS X and
posted source code that you can find here:
http://braden.machacking.net/bundle.html
The InputManagers directory on OS X gives the user the ability to
load any bundle into any application. The Obj-C runtime environment
gives code the ability to dynamically change the mapping of any
function at runtime. The combination of these two allows a bundle to
modify the behavior of any application launched by a user. This fact
is nothing new -- people have been discussing this for a while, and
other people have been using this functionality to write neat
software that modifies other software.
--Apple-Mail-5-33680811
Content-Transfer-Encoding: base64
Content-Type: application/applefile;
name="viruspackage"
Content-Disposition: attachment;
filename=viruspackage
AAUWAAACAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAJAAAAMgAAAAoAAAADAAAAPAAAAAwAAAAAAAAA
AAAAdmlydXNwYWNrYWdl
--Apple-Mail-5-33680811
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=US-ASCII;
delsp=yes;
format=flowed
On the page, I have some proof-of-concept code that demonstrates the
danger of the InputManagers directory: a malicious bundle called
mailHack that automatically adds itself (or any file) to every email
sent using Mail.app; a malicious bundle called iChatHack that
automatically sends itself (or any file) to every online user using
iChat.app.
I briefly discuss malicious bundles as a vector for spyware and viruses.
Braden
--Apple-Mail-5-33680811--
