0

(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the network?

1) When a cracker crack an app (OSX context), he breaks the code-sign certificate (even if he does not attach any malicious software to it, and just crack it), so basically when trying to install, the user would still be prompted for "Are you sure you want to open? it comes from an unknown developer" message. —› There is no way for the user (during the installation process) to detect something like that, right? Of course later it can be detected on a network level with something like LittleSnitch.

2) Also, how can be accomplished something like that? Is it enough to just add the required assembly instructions with IDA Pro for example? Does program like that has security systems that prevent Control Flow to be altered? If yes, can those be circumvented?

3) Is there any precedent in the Infosec history? Even if not applied to password manager software, has ever happened that a cracked app carried malicious code for "itself"? Of course it is well known that cracked apps (especially on Windows) carry viruses, but is there any precedent of a crafted app that does something bad related to its intended use (f.i. sending password stored by itself)?

P.S. By password manager app I'm referring to the desktop versions of like 1Password or OneSafe, etc. (server side app, or browser extensions is something different i think)

Thanks as always

1

Yes, of course this is possible.

The detection difficulty depends heavily on the implementation (more to that later)

How this can be achieved. Example: By simply changing the API endpoints to a server that you control and putting NOPs on the instructions that do the actual encryption (hopefully there is some).

The difficulty relies heavily on the target app. Obfuscation for example makes the process painfully slow. But the scenario includes an attacker that has the skill to bypass some security mechanisms and the most well-thought ones - the crack detection.

About the detection, if you just skip 2-3 instructions (enc/decryption) it’s REALLY hard to detect it. Suspiciousness is mostly raised by network connected things, so a weird domain, would some day, hopefully hit an eye. Maybe.

But if for example you buy 1.password.com or 1-password.com and do no command and control stuff and you just leak passwords over secure SSL, I’d bet that you would have some fun for a couple of years

Unfortunately I have no information on such precedent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.