Rootkits on Mac OS X

Question

• Is there known existence of rootkits for Mac OS X, and can you please provide examples?
• What software would you recommend to detect rootkits on OS/X?
• From a software developer's perspective, can you provide pointers on how to manually detect rootkits on OS/X? E.g., Is there any particular place in the kernel that I can look for? Are there any known functions or libraries within Cocoa that I can use for the purpose of scanning or validating the kernel? How would you go about writing a shell script, or native C/Obj-C code to scan for rootkits?

Answer 1

There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both.

I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that.

The problem with a rootkit is there are many places it can go hide itself, plus they are often made to be very hard to detect. They can provide false process information.

I've never written one myself, but rkhunter is open-source so I suggest you start there.

Also if I'm not mistaking(but not sure), it makes MD5 hashes of your binaries and kernel modules and then checks this every so often. It notifies you what has changed. Might be that you did an update. If not then you might want to go look why that binary got changed.

Answer 2

This blog post from F-secure Jan 16: http://www.f-secure.com/weblog/archives/00002300.html

They do not name the 'backdoors' though.