Reversing iOS/OSX malware : wirelurker

5minutes rump session @ Application Security Forum, Yverdon

Transcript

1. Reversing OSX / iOS malware
   machook / wirelurker
   Julien Bachmann / @milkmix_
   AppSecForum 2014 - RumpSession
   

   View Slide

2. intro | appealing late night twitt
   Like at 1am this morning…
   

   View Slide

3. intro | immediate reaction
   “Maybe it’s more interesting to analyse than Unflod.dylib!”
   But: original download link for the IPA was not working anymore :(
   Solution: start from the beginning, aka find original blog post linked with the
   case
   

   View Slide

4. intro | original post
   

   View Slide

5. osx | initial infection
   start.sh
   unzip FontMap1.cfg
   deploy machook in /usr/local/machook
   create LaunchDaemon to persist
   

   View Slide

6. osx | machook
   64 bits binary only
   use libimobiledevice to detect when an iOS device is plugged-in
   com.apple.afc
   ProductVersion
   SerialNumber
   list of installed Apps
   

   View Slide

7. osx | machook
   

   View Slide

8. osx | machook
   starts com.apple.afc2
   if worked (jailbroken device ) copy
   [OSX]/usr/local/machook/sfbase.dylib
   [iOS]Library/MobileSubstrate/DynamicLibraries/sfbase.dylib
   download signed IPA and push it as well using com.apple.mobile.installation_proxy
   URL stored in SQLite DB: foundation
   Enterprise cert means that first execution will bring validation pop-up
   code not encrypted as not from AppStore
   globalupdate : loop to check for updates
   

   View Slide

9. osx | machook
   

   View Slide

10. osx | machook
    

    View Slide

11. osx | machook
    

    View Slide

12. iOS | sfbase.dylib
    not signed
    MobileSubstrate to hook [UIWindow sendEvent] in
    MobileStorageMounter
    MobileSafari
    MobilePhone
    MobileSMS
    Preferences
    also checks for updates
    

    View Slide

13. iOS | sfbase.dylib
    if event is applicationWillResignActive, kill applications
    What??? Maybe I don’t have the latest version
    also, dead code to query URL and hide it
    retrieve some files
    SMS.db
    AddressBook.sqlitedb
    UDID
    post to saveinfo.php
    

    View Slide

14. iOS | sfbase.dylib
    

    View Slide

15. iOS | sfbase.dylib
    

    View Slide

16. conclusion | maybe not that “new era”
    did not look at the signed binary for the moment
    possibilities too limited
    except if privileges escalation is possible…
    hooking methods but does not use it
    targeted at Chinese market but logs in english
    still some nice functionalities
    update functionality
    OSX —> iOS, but already seen in the wild
    

    View Slide