(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the network?
1) When a cracker crack an app (OSX context), he breaks the code-sign certificate (even if he does not attach any malicious software to it, and just crack it), so basically when trying to install, the user would still be prompted for
"Are you sure you want to open? it comes from an unknown developer" message. —› There is no way for the user (during the installation process) to detect something like that, right? Of course later it can be detected on a network level with something like LittleSnitch.
2) Also, how can be accomplished something like that? Is it enough to just add the required assembly instructions with IDA Pro for example? Does program like that has security systems that prevent Control Flow to be altered? If yes, can those be circumvented?
3) Is there any precedent in the Infosec history? Even if not applied to password manager software, has ever happened that a cracked app carried malicious code for "itself"? Of course it is well known that cracked apps (especially on Windows) carry viruses, but is there any precedent of a crafted app that does something bad related to its intended use (f.i. sending password stored by itself)?
P.S. By password manager app I'm referring to the desktop versions of like 1Password or OneSafe, etc. (server side app, or browser extensions is something different i think)
Thanks as always