OS X: Zip archive remote exploit


The trojans are definitely coming. As many have probably noticed security researchers found a flaw in OS X that allows attackers to execute arbitrary code. The most popular way is to use Safari and take advantage of the “Open safe files after downloading” feature. The best write-up is from the SANS ISC:
Serious flaw on OS X
You can find the proof of concept exploit here, and a write-up of how it can be exploited via email here.
There is no patch available. In The mean time:

  • Disable “Open safe files after downloading”
  • Use firefox on OS X (Which does not appear to be vulnerable)
  • Be very careful about opening attachements in email and downloaded files

A good step to take if you are suspicious comes from the ISC write-up:

$ unzip
creating: __MACOSX/
inflating: __MACOSX/

The metadata file in this example is This is some binary file, but even running simple strings command on this file will reveal what the real utility used to open the main file is:

$ strings

A zip file could be masking malicious code, so be careful. Oh, and HD Moore has added this to metasploit, exploit here.

Paul Asadoorian

Paul Asadoorian is currently the Principal Security Evangelist for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more. Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable. In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. In 2020 Security Weekly was acquired by the Cyberrisk Alliance. Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python & telling everyone he uses Linux.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.