OS X Coming Under Increased Researcher Scrutiny

While it is still a less-targeted platform, Apple's OS X operating system has seen some interesting Information Research published in recent months.

In February, Vincenzo Iozzo presented at Black Hat 09 a method for injection of code directly into the memory of another application, while it is running. This takes place completely in memory (which separates it from previous vulnerabilities of this style) and disappearing when the application is terminated. It could be argued that this presents an epipyhtic rather than a parasitic attack route, given that there is no reliance on the host system to store any part of it (other than active memory), it attaches into an existing application, and disappears cleanly at the end.

This method still has to rely upon somehow getting the code launched in the first place, but it means that once launched it is going to be hidden from sight and not show up as a running process. Getting the user to launch an arbitrary application is more of a social weakness than a technical one, as the mountains of malware and infected Windows systems can attest.