bugtraq - Malicious Bundles on Mac OS X

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 4 Jun 2005 19:21:57 -0400
From: Braden Thomas <braden127@...ealbox.com>
To: bugtraq@...urityfocus.com
Subject: Malicious Bundles on Mac OS X

I wrote some information about Malicious Bundles on Mac OS X and  
posted source code that you can find here:

http://braden.machacking.net/bundle.html

The InputManagers directory on OS X gives the user the ability to  
load any bundle into any application.  The Obj-C runtime environment  
gives code the ability to dynamically change the mapping of any  
function at runtime.  The combination of these two allows a bundle to  
modify the behavior of any application launched by a user.  This fact  
is nothing new -- people have been discussing this for a while, and  
other people have been using this functionality to write neat  
software that modifies other software.
Download attachment "viruspackage" of type "application/applefile" (72 bytes)

On the page, I have some proof-of-concept code that demonstrates the  
danger of the InputManagers directory: a malicious bundle called  
mailHack that automatically adds itself (or any file) to every email  
sent using Mail.app; a malicious bundle called iChatHack that  
automatically sends itself (or any file) to every online user using  
iChat.app.
I briefly discuss malicious bundles as a vector for spyware and viruses.

Braden