4 ms·
Download what, exactly? Downloading the zip file linked to by the OP gives me a folder full of source code, not an "iTunes plugin". Even if it did give me a bu
by nknighthb 13y ago
Download what, exactly?
Downloading the zip file linked to by the OP gives me a folder full of source code, not an "iTunes plugin". Even if it did give me a built plugin, I wouldn't have a clue what to do with it absent further instructions. This is a very poor demonstration of whatever they're trying to prove.
The README says "Copy to ~/Library/iTunes/iTunes Plug-ins to install."
So, they're expecting the "casual user" to copy a file to a hidden directory? Good luck with that.
I did a quick search for iTunes plugins. They all seem to come in some sort of executable installer, thus being subject to the ordinary warnings. The OP even suggests as much, with "a trojan dropper can easily load a malicious plugin". How does that "trojan dropper" get on the system?
This isn't a security hole, it's a wannabe scriptkiddy who wants to make noise.
- Sanddancer 13y agoIt's a proof of concept showing a flaw in a core, non-sandboxed application. Someone with better social engineering and/or or someone interested in targeting specific people could turn this into something rather nasty
- nknighthb 13y agoNo, it's demonstrating (poorly) the ordinary functionality of application plugins. The most iTunes could possibly do is display a warning dialog on unsigned plugins. Not a bad idea, perhaps, but its absence is hardly a flaw. You're already postulating sufficient social engineering that I can't believe the warning would stop anyone.
- lstamour 13y agoSo you're saying that a malicious iTunes visualizer plugin won't get installed and get past antivirus? Or maybe that your visualizer/screensaver plugins should have access to your credit cards? Worries the crap out of me, personally. :)
- nknighthb 13y agoI'm saying once you download and run arbitrary native code, all bets are off. Hell, I just kind of assume any such code has full root access no matter what user it's started as, given the commonality of privilege escalation vulnerabilities.
- _fG_ 13y agoI was really tempted to ignore all your bullshit but can't resist. Honestly you have no fucking idea what you are talking about. Arbitrary code is any application that you download and run in your computer. You don't download applications? Cool, your browser is also a great target. Any application can easy pack an evil plugin and unpack and own your iTunes data. Easy as that. Want better? If you use Carbon Copy Cloner any other application can own you the moment you start your backup. Sandbox and AppStore? LOL Go read that Evil ROP paper into the Appstore. Conclusion: comment when you know wtf you talk about. Bye
- _fG_ 13y agoNo you dumb ass, I am expecting a malware dropper to copy it. Where malware dropper can be any application that you download. Now go reverse CoinThief different samples and learn a thing or two.