Have been thinking from years that DLL Hijacking is just restricted to Windows only? Then let us make it clear, NO! It's nothing like that. Windows were found vulnerable to DLL Hijacking attacks years ago, but a latest research by a Security Firm research director, Patrick Wardle at Synack, revealed OS X are also similarly vulnerable to DLL Hijacking attacks.

Mac OS X Dll Hijacking

Patrick is going to show off this concept similar to Windows DLL Hijacking at CanSecWest Applied Security Conference in Vancouver from 18th March to 20th March, 2015. According to the researcher, this vulnerability can be leveraged to go around security features like Apple's Gatekeeper to infect vulnerable systems.

Patrick said, "In both cases, there exist situations where the OS loader will look for required dependent libraries in multiple places. If the legitimate library is not found in a primary location, e.g. the first directory the loader looks in, the attacker can then plant a malicious library there. From then on, whenever the application is launched - either by the OS or by the user - the loader will now find and blindly load the attacker's malicious library since the loader first looks in the location where the attacker planted they library."

Patrick has a plan to release a .PY (python) script and a UI Application that can be used to scan vulnerable apps, on which this attack is basically dependent upon. A private scan of his own system came out to be showing 150 vulnerable apps including both Apple Applications and third-party apps.

The famous anti-malware feature of Apple called Gatekeeper is the software around which the attack revolves. Gatekeeper, similar to Windows defender, allows users to restrict what sources they can install applications from in order to reduce the likelihood of being infected by a Trojan horse. The feature is included in OS X Lion 10.7.5, OS X Mountain Lion and later versions of the operating system.

Since, the attack is to be presented at the conference and hence, Patrick denied revealing much of the information but he said,

"However, I can summarize. There exists a situation where Gatekeeper does not validate everything that is downloaded as it should in a software package such as .dmg file. This opens up a scenario where an attacker can create a software package or infect a legitimate download that Gatekeeper will trust when the user opens it. So even if the user has set Gatekeeper to only allow code from the Mac App Store the attacker's malicious unsigned dylib will still be loaded and allowed to execute, thus infecting the user."

The attack vector is found to be very attractive as it abuses the anti-malware feature of the OS but it is very simple for attackers, as leveraging the apps is not that difficult.

"It can be used in attack scenarios such as persistence, load-time process injection, etc," he explained. "Other attacks that achieve similar goals are complex, and easily detected [and] prevented. Using this dylib hijack attack, an attacker can achieve the same goal by simply dropping a dylib bundle. That's it. That combined with the tools I'll be releasing make this a trivial, yet fairly devastating attack."