Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

there was some arbitrary code execution that occurred on my os x 10.5 system.
this came as a result of opening an xls file with excel for mac.
the vnc type program that came with office for mac was being used to loot around, but i think the damage was minimized because of needing the admin password for most things.
i noticed the activity but was unsure of how to solve it, ended up leaving a threatening text file on the desktop addressing the individual, who i had done some work for through craigslist (lets just say a background in creative writing comes in handy), and whattya guess, the next morning there were a bunch of xml files in the trash.
i guess he got scared and wanted to make it apparent he was rectifying the situation.
however, i am not so sure that the problem is fixed.
i deleted the programs that allow for vnc type connections, but am still curious if anything could remain.
i am not even sure how xml exploits would translate into real world activity.
what would be a good way of determining if OS X has any kind of remnants of hijackery?

share|improve this question
There are not many ready-made exploits for max excel out there, at least not in non-commercial exploit packs. Which version of office do you have? – john May 31 '11 at 13:23
@john: 14.0.2, from what i read about, the problem might have been just opening the xls file that was emailed to me. I didnt prevent the VBA scripts functionality from 'phoning out' and just opened the file because i trusted the sender. – bboyreason May 31 '11 at 13:34
@john: maybe you could clarify for me, is it the program that would be exploited, via either its own xml libraries or other software flaw; or the xls file simply runs a VBA script, for instance, attached to a cell that makes changes to xml libraries somewhere else on the system? – bboyreason May 31 '11 at 17:20
1  
why do you keep calling it xml, but you're talking about an XLS file, no? I don't think that matters - it's either the VBA scripts (do these work on mac?), or a generic trojan / malware. – AviD♦ Jun 5 '11 at 19:53
@avid: the reason I thought XML libraries were involved was because the files that were remotely put in my 'trash can' were all XML files that looked liked they had a few structs or something defined in them and werent just single scripts. I am not sure what the connection would be from those files to the infection process. But isnt XLS just a form of XML? – bboyreason Jun 5 '11 at 22:50

1 Answer

up vote 7 down vote accepted

The computer is not yours anymore, it is probably his.

You cannot trust that he did not actually compromise your box further than you currently know about.

He could have compromised the kernel, binaries or virus scanner on your box and you would never know.

I would recommend wiping and re-installing from known good media.

Then scan your current hard drive and all network drives for compromises (but you can never know that your virus/malware scanner will recognise the specific compromise left behind). Then take off the content you must from your old media.

If you wish to contact the police about it, you will need to supply them with your computer (or at the least your hard drive) so think carefully before you do the irrevocable step of wiping the old media or trashing anything else on it.

But I am Not a Lawyer, I only read Groklaw.

share|improve this answer
that is what i was hoping was not true, but felt it might be. Thanks for clearing that up. Happen to know how good an archive reinstall is on OS X (keeps the same 'home' folder) for this purpose? – bboyreason Jun 1 '11 at 12:47
I have no idea @bboyreason. – Andrew Russell Jun 2 '11 at 8:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.