Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've never really tried to understand rootkit enough, I'm too much paranoid...

I recently reinstalled mountain lion, but my EFI might be infected.

I have a macbook pro, it was really slow at some point that week, I could not manage to make an Apple Hardware test, it was weird since I have mountain lion.

Are there known false positives for rkhunter ?

Oddly downloading chkrootkit brings a "Unable to connect" error in firefox, I'm a little worried.

Here are some selected lines from the rkhunter log

Performing file properties checks
  Checking for prerequisites                               [ Warning ]
  /usr/bin/fuser                                           [ Warning ]
  /usr/bin/whatis                                          [ Warning ]
  /usr/bin/shasum                                          [ Warning ]

Performing check of known rootkit files and directories
  Dica-Kit Rootkit                                         [ Warning ]

Performing additional rootkit checks
  Checking for possible rootkit strings                    [ Warning ]

Performing system boot checks
  Checking for system startup files                        [ Warning ]

Performing system configuration file checks
  Checking if SSH root access is allowed                   [ Warning ]
  Checking if SSH protocol v1 is allowed                   [ Warning ]

Performing filesystem checks
  Checking for hidden files and directories                [ Warning ]

Here is the full log http://pastebin.com/x0A2XVFi

PS: I would kind if an OS X user could run rkhunter on his machine to check if there also are false positives...

share|improve this question
add comment

1 Answer

rkhunter is pretty old and you should pay people to perform security analysis on your systems. Try running it against a fresh install, and diff the results with your run. That being said, this is still no guarantee that you are safe. If you suspect you have been rootkit'ed then you should reinstall OSX.

share|improve this answer
1  
I agree, if you have any doubt about your system, start it over, why taking any risk? –  happy Dec 30 '12 at 7:36
    
I already did reinstall OSX. What do you mean by running it against a fresh install ? –  jokoon Jan 4 '13 at 19:36
    
Format the drive and start with a fresh installation of OSX. –  g3k Jan 4 '13 at 21:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.