Mac Virus

A file called "latestpics.tgz" was posted on a Mac rumors web site http://www.macrumors.com/ , claiming to be pictures of "MacOS X Leopard" (an upcoming version of MacOS X, aka "MacOS X 10.5"). It is actually a Trojan (or arguably, a very non-virulent virus). We'll call it "Oompa-Loompa" (aka "OSX/Oomp-A") for reasons that will become obvious.

You cannot be infected by this unless you do all of the following:
1) Are somehow sent (via email, iChat, etc.) or download the "latestpics.tgz" file
2) Double-click on the file to decompress it
3) Double-click on the resulting file to "open" it

...and then for non-Admin users, it fails to infect most applications.

You cannot simply "catch" the virus. Even if someone does send you the "latestpics.tgz" file, you cannot be infected unless you unarchive the file, and then open it.

A few important points
1) This should probably be classified as a Trojan, not a virus, because it doesn't self-propagate externally (though it could arguably be called a very non-virulent virus)

2) It does not exploit any security holes; rather it uses "social engineering" to get the user to launch it on their system

3) If you're not running as an admin user, it will silently fail to infect most applications

4) It doesn't actually do anything other than attempt to propagate itself via iChat, and then only via Bonjour! (aka "Rendezvous) -- it does not sent itself over the Internet, rather just to your local Bonjour user list

5) It has a bug in the code that prevents it from working as intended, which has the side-effect of preventing infected applications from launching

6) It's not particularly sophisticated

When unarchived (it is a gzip-compressed tar file), which can be done by simply double-clicking on the file, it appears to be a JPEG file because someone pasted the image of a JPEG file onto the file.
After it's been unzipped, tar will tell you there are two files in the archive:

._latestpics
latestpics

...the ._latestpics is just the resource fork of the file, which contains the pasted in custom icon meant to fool people into double-clicking on it to (in theory) open the JPEG file for viewing. In actuality, double-clicking on it will launch an executable file. The file "latestpics" is actually a PowerPC-compiled executable program, with routines such as:

_infect:
_infectApps:
_installHooks:
_copySelf:


Here's what it does if a user double-clicks on the file, or otherwise executes it:

1) It copies itself to /tmp as "latestpics"

2) It recreates its resource fork in /tmp (with the custom icon in it) from an internally stored gzip'd copy, then sets custom icon bit for the new file in /tmp

3) It then tar + gzips itself so a pristine copy of itself in .tgz format is left in /tmp

4) It renames itself from "latestpics.tar.gz" to "latestpics.tgz" then deletes the copied "latestpics" executable from /tmp

5) It extracts an Input Manager called "apphook.bundle" that is embedded in the macho executable, and copies it to /tmp

6a) If your uid = 0 (you're root), it creates /Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder

6b) If your uid != 0 (you're not root), it creates ~/Library/InputManagers/ , deletes any existing "apphook" bundle in that folder, and copies "apphook" from /tmp to that folder

7) When any application is launched, MacOS X loads the newly installed "apphook" Input Manager automatically into its address space

8a) When an application is subsequently launched, the "apphook.bundle" Input Manager then appears to try to send the pristine "latestpics.tgz" file in /tmp to people on your buddy list via iChat (who will then presumably download the file, double-click on it, and the cycle repeats).

8b) (It looks like the author intended to get it to send the "latestpics.tgz" file out via eMail as well, but never got around to writing that code)

9) It only sends itself to people on your local network, it cannot send itself over the Internet

10) It then uses Spotlight to find the 4 most recently used applications on your machine that are not owned by root

11) In an apparent "Charlie and the Chocolate Factory" reference, it then checks to see if the xattr 'oompa' of the application executable is > 0... if so, it bails out, to prevent it from re-infecting an already infected application

12) If not, it sets the xattr 'oompa' of the application executable to be 'loompa' (this does nothing, it is just a marker that it has infected this app)

13) It then copies the application executable to its own resource fork, and replaces the application executable with the OSX/Oomp-A trojan

nb: If run via double-clicking on the file, and the user doesn't have privileges to modify an application, it silently fails.

--It has thus effectively injected its code in the host application, but it can only do so for applications that the user has write access to--

13) When an infected application is launched from then on, the trojan code is executed, and it tries to re-infect and re-propagate itself to other applications

14) It then does an execv on the resource fork of the executable, which is the original application, so the application launches as it normally would (in theory... see below)

15) Due to a bug in it's code for executing the original app from it's resource fork, it is only allocating a buffer 4 bytes bigger than the path when appending "/..namedfork/rsrc" to the path, it will stop any app it infects from running. Instead of adding the length of the string, it errantly adds the length of the pointer to the string, which is always 4 bytes.