Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  • Is there known existence of rootkits for Mac OS X, and can you please provide examples?
  • What software would you recommend to detect rootkits on OS/X?
  • From a software developer's perspective, can you provide pointers on how to manually detect rootkits on OS/X? E.g., Is there any particular place in the kernel that I can look for? Are there any known functions or libraries within Cocoa that I can use for the purpose of scanning or validating the kernel? How would you go about writing a shell script, or native C/Obj-C code to scan for rootkits?
share|improve this question
add comment

2 Answers

There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both.

I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that.

The problem with a rootkit is there are many places it can go hide itself, plus they are often made to be very hard to detect. They can provide false process information.

I've never written one myself, but rkhunter is open-source so I suggest you start there.

Also if I'm not mistaking(but not sure), it makes MD5 hashes of your binaries and kernel modules and then checks this every so often. It notifies you what has changed. Might be that you did an update. If not then you might want to go look why that binary got changed.

share|improve this answer
2  
+1 - the Mach/BSD difference and its implications was featured at Blackhat USA - the presentation/code there might be of interest to the asker. –  user2213 Jan 18 '12 at 8:25
    
+1 Lucas, your answer provides some nice introductory info. +1 @Ninefingers for the link. Thanks both. –  amateur barista Jan 19 '12 at 22:32
add comment

This blog post from F-secure Jan 16: http://www.f-secure.com/weblog/archives/00002300.html

They do not name the 'backdoors' though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.