Xcode中毒，XCSSET Malware

最新推荐文章于 2023-07-08 19:40:16 发布

代码混淆马甲包

最新推荐文章于 2023-07-08 19:40:16 发布

阅读量799

点赞数

文章标签： macos ios 反病毒

本文链接：https://blog.csdn.net/qq_34644704/article/details/114459976

版权

背景

前两周（2021年2月末），突然我的电脑（MacBook Pro v10.15.7）打开不了Safari，重启之后又可以了。一开始没在意，后面每次重启电脑之后及时打开Safari，中间似乎莫名其妙被强制退出，中间咨询Apple客服，回答模棱两可（1.重置硬件SMC、安全启动）似乎都没效果。后面异常问题逐渐凸显，最终锁定是'[XCSSET Malware]'。

XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits - TrendLabs Security Intelligence Blog

事件经过

从问题开始到最终确定原因，大致花了半个月，以下是我个人的事件经过：

Safari异常

Safari无故被强退，重新打开后，没法同步ITunes账号信息，导致Safari的个人收藏无法显示。同时程序坞出现两个Safari图标，一个可以点击，另外一个无效

系统异常

系统的隐私多出很多com.net.core.xxx.app的异常APP程序，例如：/Users/yjs/Library/Application Scripts/com.apple.AddressBook.Shared

开机自启动的进程，强制删除这些进程，Safari可以正常打开

在“活动监视器”>“信息”>“打开文件和端口”中检查

cwd
/
txt
/Applications/Finder.app/Contents/MacOS/com.net.core.cputime.app/Contents/MacOS/applet
txt
/Library/Preferences/Logging/.plist-cache.r65cTIFH
txt
/usr/share/icu/icudt64l.dat
txt
/System/Library/Components/AppleScript.component/Contents/MacOS/AppleScript
txt
/Library/Application Support/CrashReporter/SubmitDiagInfo.domains
txt
/private/var/db/analyticsd/events.whitelist
txt
/private/var/db/timezone/tz/2021a.1.0/icutz/icutz44l.dat
txt
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/SystemAppearance.car
txt
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/DarkAquaAppearance.car
txt
/private/var/folders/h2/9pg_fk2x7sjbnskd5kn65xq40000gn/0/com.apple.LaunchServices.dv/com.apple.LaunchServices-1082-v2.csstore
txt
/usr/lib/libobjc-trampolines.dylib
txt
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/Assets.car
txt
/System/Library/Fonts/SFNS.ttf
txt
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/HIToolbox.rsrc
txt
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/zh_CN.lproj/Localized.rsrc
txt
/private/var/folders/h2/9pg_fk2x7sjbnskd5kn65xq40000gn/C/com.apple.IntlDataCache.le.kbdx
txt
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/FunctionRowAppearance.car
txt
/private/var/db/mds/messages/501/se_SecurityMessages
txt
/private/var/folders/h2/9pg_fk2x7sjbnskd5kn65xq40000gn/C/com.apple.scriptmanager2.le.cache
txt
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/DarkAppearance.car
txt
/System/Library/Fonts/PingFang.ttc
txt
/System/Library/Fonts/Helvetica.ttc
txt
/System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Resources/AppleKeyboardLayouts-L.dat
txt
/System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/MacOS/StandardAdditions
txt
/usr/lib/dyld
0
/dev/null
1
/dev/null
2
/dev/null
3
/Library/Application Support/CrashReporter/SubmitDiagInfo.domains
4
/Applications/Finder.app/Contents/MacOS/com.net.core.cputime.app/Contents/Resources/applet.rsrc
5
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/HIToolbox.rsrc
6
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/zh_CN.lproj/Localized.rsrc

对应打开的/Users/yjs/Library/Containers/com.apple.routerd/Containers/

还会隐藏在其他常见的APP，例如微信

同时还会伪装成Finder.app在/Applications/Finder.app（实际位置：/System/Library/CoreServices/Finder.app）

开机启动自动弹出对应的脚本程序对话框

Xcode异常

刚好自己最近和小伙伴在开发一个Xcode项目（iOS混淆工具），前一阵子逐渐发现异样。

项目build之后工程文件下会莫名其妙出现：
xcuserdata/.xcassets/Assets.xcassets

以及confuse_test.xcodeproj->project.pbxproj文件出现看似‘正常的Build Phase’

删除又会报错误：
xcuserdata/.xcassets/Asset.xcasset: No such file or directory