cryptsucks
06-23-2008, 10:47 PM
Source:Washingtonpost (http://blog.washingtonpost.com/securityfix/2008/06/new_trojan_leverages_unpatched.html?nav=rss_blog)
New Trojan Leverages Unpatched Mac Flaw
A tool for exploiting an unpatched security hole in Mac OS X systems has been developed and until earlier today was being distributed through an online forum that caters to Mac hackers, Security Fix has learned.
The exploit tool, labeled "Applescript Trojan horse template" by hackers at Macshadows.com, appears to be a collective and ongoing effort to create a package of malicious software that capitalizes on the ARDagent security hole first publicized last week. The vulnerability essentially allows any program to run on a Mac user's machine without first prompting the user to enter his or her user name and password.
The first Macshadows.com post on developing this Trojan, dated May 18.
Currently, the Macshadows user forum appears to have been wiped clean, both from the Macshadows.com Web site and from Google's cache. However, Security Fix obtained screen shots of forum postings from the code's authors, which are sprinkled throughout this blog entry. It appears that development of this malware started back in mid-May.
Security Fix also obtained a copy of the Trojan horse template from an anti-virus industry expert who asked to remain anonymous. An analysis of the code by noted security researcher Dino Dai Zovi indicates that it is designed to be bundled with any downloadable Mac program, with the aim of turning an otherwise legitimate program into an exploit toolkit capable of handing control of the system to attackers.
"This could be bundled with any arbitrary application very easily," Dai Zovi said of the Trojan template. "Most people assume that if something is going to do something dangerous, that it will ask you for your password first, but this won't."
Dai Zovi said the Trojan tries two different exploits to install itself without having to prompt the user for his or her system credentials. One exploit is the aforementioned ARDagent attack; the other is for a privilege escalation vulnerability that Apple patched in 2006. (As an interesting aside, Dai Zovi himself reported that latter vulnerability to Apple back in 2006, only to later learn that exploit code for that same vulnerability had been publicly posted online prior to Apple issuing a patch for the flaw).Once installed, the Trojan drops a keystroke logger called "logkext" on the Mac user's system. It then sets up a virtual network computing (VNC) server listening on the victim's machine, which would provide an attacker remote access to the victim's computer.
The code also installs a Web-based "PHP shell" program that allows the attackers to remotely manipulate the infected machine using nothing more than a Web browser. That component of the Trojan also sets the victim's system so that it can be tracked using dynamic DNS services, which permit remote users to remain connected to a system even if its numeric Internet address changes over time.
Security Fix contacted "Andrew" -- one author of the malware and an individual whose e-mail address is included in the guts of the malicious code. Andrew said he and friends wanted to test the boundaries of OS X security.
"Apple tells us that OS X is safe and secure and fails to actually confirm that it is so on their own. We are left to experiment and test our own security and too often we discover that we aren't actually as secure as we were led to believe," Andrew said in an e-mail. "When you are seeking information about how to secure your own system, frequently the best sources of that information are hackers, not the vendors."
I want to stress that there is absolutely no evidence that this Trojan is spreading in the wild, despite warnings from Mac anti-virus vendor SecureMac that it has spotted multiple variants of this code.
Still, the exploit code is now out there, and it remains unclear whether Apple intends to address the ADRagent flaw with a patch (Cupertino has yet to respond to my inquiries from last week). In the meantime, Mac users would do well to use one of the stopgap fixes mentioned in this article.
Dai Zovi said the programming approach in the Mac Trojan toolkit resembles the Visual Basic script-based Trojans that were used to infect Windows machines back in the earliest months of this decade.
"What this demonstrates is that regardless of what the larger security community is focused on, people are interested in writing malware for the Mac," Dai Zovi said.
Indeed, Andrew said he helped code the Trojan template out of curiosity.
"I helped write it because well why not its programing experience and it was in a subject I was interested in."
Update, 6:15 p.m. ET: Updated to include comment from one of the Trojan's authors.
beware
New Trojan Leverages Unpatched Mac Flaw
A tool for exploiting an unpatched security hole in Mac OS X systems has been developed and until earlier today was being distributed through an online forum that caters to Mac hackers, Security Fix has learned.
The exploit tool, labeled "Applescript Trojan horse template" by hackers at Macshadows.com, appears to be a collective and ongoing effort to create a package of malicious software that capitalizes on the ARDagent security hole first publicized last week. The vulnerability essentially allows any program to run on a Mac user's machine without first prompting the user to enter his or her user name and password.
The first Macshadows.com post on developing this Trojan, dated May 18.
Currently, the Macshadows user forum appears to have been wiped clean, both from the Macshadows.com Web site and from Google's cache. However, Security Fix obtained screen shots of forum postings from the code's authors, which are sprinkled throughout this blog entry. It appears that development of this malware started back in mid-May.
Security Fix also obtained a copy of the Trojan horse template from an anti-virus industry expert who asked to remain anonymous. An analysis of the code by noted security researcher Dino Dai Zovi indicates that it is designed to be bundled with any downloadable Mac program, with the aim of turning an otherwise legitimate program into an exploit toolkit capable of handing control of the system to attackers.
"This could be bundled with any arbitrary application very easily," Dai Zovi said of the Trojan template. "Most people assume that if something is going to do something dangerous, that it will ask you for your password first, but this won't."
Dai Zovi said the Trojan tries two different exploits to install itself without having to prompt the user for his or her system credentials. One exploit is the aforementioned ARDagent attack; the other is for a privilege escalation vulnerability that Apple patched in 2006. (As an interesting aside, Dai Zovi himself reported that latter vulnerability to Apple back in 2006, only to later learn that exploit code for that same vulnerability had been publicly posted online prior to Apple issuing a patch for the flaw).Once installed, the Trojan drops a keystroke logger called "logkext" on the Mac user's system. It then sets up a virtual network computing (VNC) server listening on the victim's machine, which would provide an attacker remote access to the victim's computer.
The code also installs a Web-based "PHP shell" program that allows the attackers to remotely manipulate the infected machine using nothing more than a Web browser. That component of the Trojan also sets the victim's system so that it can be tracked using dynamic DNS services, which permit remote users to remain connected to a system even if its numeric Internet address changes over time.
Security Fix contacted "Andrew" -- one author of the malware and an individual whose e-mail address is included in the guts of the malicious code. Andrew said he and friends wanted to test the boundaries of OS X security.
"Apple tells us that OS X is safe and secure and fails to actually confirm that it is so on their own. We are left to experiment and test our own security and too often we discover that we aren't actually as secure as we were led to believe," Andrew said in an e-mail. "When you are seeking information about how to secure your own system, frequently the best sources of that information are hackers, not the vendors."
I want to stress that there is absolutely no evidence that this Trojan is spreading in the wild, despite warnings from Mac anti-virus vendor SecureMac that it has spotted multiple variants of this code.
Still, the exploit code is now out there, and it remains unclear whether Apple intends to address the ADRagent flaw with a patch (Cupertino has yet to respond to my inquiries from last week). In the meantime, Mac users would do well to use one of the stopgap fixes mentioned in this article.
Dai Zovi said the programming approach in the Mac Trojan toolkit resembles the Visual Basic script-based Trojans that were used to infect Windows machines back in the earliest months of this decade.
"What this demonstrates is that regardless of what the larger security community is focused on, people are interested in writing malware for the Mac," Dai Zovi said.
Indeed, Andrew said he helped code the Trojan template out of curiosity.
"I helped write it because well why not its programing experience and it was in a subject I was interested in."
Update, 6:15 p.m. ET: Updated to include comment from one of the Trojan's authors.
beware
