Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Mac OS X computer and I want to know if it has installed a Keylogger or something that control what I'm doing: when I switch on/off the computer, what I install on it, etc.

How can I know that? How can I uninstall all?

share|improve this question
    
Is it your machine, or is it company owned? That won't necessarily inform the response, but may limit what you can do about it. –  Bob Watson Feb 12 '13 at 7:21
    
it is company owned. –  VansFannel Feb 12 '13 at 7:35
    
Question title was modified in sense. Please ask another question if the meaning differ! –  F. Hauri Feb 13 '13 at 10:31
    
As malwares/keylogger/trojan also can infect a Mac system. Probably you need an security product ( For instance www.quickheal.com/qhmac‎ ). [ I am not associated with the product ] –  Novice User Oct 1 '13 at 7:07
    
→ Vans: Could you reply the 2nd key question asked by Bob? Better, could you add the answers to his 2 first questions? These are questions everyone will ask you before being able to answer you cleverly. Your answers will determine in which field we are helping you with a security problem: technically, legally, capability. –  daniel Azuelos Nov 25 '13 at 16:56

3 Answers 3

A lot depends on the relationship between you and the machine - is it your own? Do you have administrator access to it? Since you mention that it's corporate owned, do you have an administrator that has ok'd a keylogger (for whatever reason)? It's possible (or, in fact, likely) you won't be able to remove it without drastic steps - specifically without re-imaging the machine with a known-good OS install. I don't know of any corporate environments where they'd let you do that.

Unfortunately, with a corporate owned machine, they're likely allowed to install whatever they want, and any measures you take to circumvent the logger may well get you fired.

Some things that you may be comfortable trying though:

  • It may be worth installing an anti-malware tool of some sort - from any of the big vendors Norton, McAfee, etc. - and seeing what turns up. You may be able to sell this to your administrator by pointing out that Macs get malware too, and that you'd like to be protected.
  • See if you can get chkrootkit to run, as most keyloggers are rootkits.
  • See if you can get Little Snitch installed; keep an eye out for anything suspicious. Any keylogger is only useful to an attacker if they can get that info out somehow.

Unfortunately, since a keylogger is likely to have revealed your passwords, etc. to an attacker, and is generally a sign of a relatively sophisticated attack - it's very likely that the logger itself has managed to get itself installed as a kernel module or rootkit and so even a clean AV sweep isn't an indication you're clear. You really need to consider that just wiping it may be your only option; start fresh and if you're worried about people you know breaking in, keep a close eye on the machine, keep it locked when you're away and keep your passwords complex and secret.

share|improve this answer
    
I only want to know if there is a keylogger or rootkits installed on the computer. –  VansFannel Feb 12 '13 at 14:09
    
"Unfortunately, with a corporate owned machine...". Why exactly is this "unfortunate"? They own the machine, they are nice enough to let you use it for work, and that's it. There's nothing unfortunate about a company wanting to control how its computers are used. –  Moshe Katz Oct 30 '13 at 2:12
    
→ Ramhound: isn't this exactly what Vans is looking for here ☺? –  daniel Azuelos Nov 25 '13 at 18:26

This may vary across a lot of different consideration

  • Who's the owner of the machine
  • Who's the owner of your work time
  • Locals and country laws about privacy protection
  • Enterprise contracts who may precise limit of employee privacy

At all, I think trusting is needed for good work.

Nota: As keylogger act like a virus, first thing he do is to hide himself, so whithout strong computer knowledge and full access right to the machine, you can't obtain reliable information (whithout installing strongs tools in a computer that's not your...).

About what to do:

  • Ask your boss!
  • Trust your boss!
  • If really in doubt, without strong computer knowledge, don't try anything! If you're not the owner of material, everything you do could be reproach to you!!
  • If you think your boss lie and do illegal things, refer to police or syndicates...

Three possibilities anyway:

Warning: This may by called spying or reverse engeenering! Both is illegal in many countries and could send you and your accomplice to jail!!

Keep in mind: If it's not your, you don't have right to alter them anyway!

  • Install a linux bridge between your network connection and your Mac, dump all network traffic and submit the dump to a trusted friend.
  • Boot you Mac with a read-only live system which you can use for scanning your hard drive against rootkits and keyloggers.
  • Begin to search for another job...
share|improve this answer
    
Ok. I only want to know if there is a keylogger or rootkits installed on the computer. –  VansFannel Feb 12 '13 at 9:24
    
As keylogger act like a virus, first thing he do is to hide himself, so whithout strong computer knowledge you can't obtain reliable information (whithout installing strongs tools in a computer that's not your...). –  F. Hauri Feb 12 '13 at 10:38
1  
Ask you boss, if he lie, this come to be another story... –  F. Hauri Feb 12 '13 at 10:42
    
I only want to know if there is a keylogger or rootkits installed on the computer. –  VansFannel Feb 12 '13 at 14:08
    
@VansFannel I rightly understand, but unfortunately, you can't, without having to do discutable things. –  F. Hauri Feb 12 '13 at 14:28

How can I know that? How can I uninstall all?

The only real answer to both of these is to wipe the machine and re-install OS X. Technically, there could be some kind of hardware device recording your actions, but that is not very plausible unless you have highly valued assets (or unless you are a highly valued asset yourself).

share|improve this answer

protected by Community Oct 30 '13 at 14:03

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.