- Is there known existence of rootkits for Mac OS X, and can you please provide examples?
- What software would you recommend to detect rootkits on OS/X?
- From a software developer's perspective, can you provide pointers on how to manually detect rootkits on OS/X? E.g., Is there any particular place in the kernel that I can look for? Are there any known functions or libraries within Cocoa that I can use for the purpose of scanning or validating the kernel? How would you go about writing a shell script, or native C/Obj-C code to scan for rootkits?
Add a comment
|
2 Answers
There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both.
I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that.
The problem with a rootkit is there are many places it can go hide itself, plus they are often made to be very hard to detect. They can provide false process information.
I've never written one myself, but rkhunter is open-source so I suggest you start there.
Also if I'm not mistaking(but not sure), it makes MD5 hashes of your binaries and kernel modules and then checks this every so often. It notifies you what has changed. Might be that you did an update. If not then you might want to go look why that binary got changed.
answered Jan 17, 2012 at 9:01
-
2+1 - the Mach/BSD difference and its implications was featured at Blackhat USA - the presentation/code there might be of interest to the asker.– user2213Commented Jan 18, 2012 at 8:25
-
+1 Lucas, your answer provides some nice introductory info. +1 @Ninefingers for the link. Thanks both. Commented Jan 19, 2012 at 22:32
This blog post from F-secure Jan 16: http://www.f-secure.com/weblog/archives/00002300.html
They do not name the 'backdoors' though.
answered Jan 19, 2012 at 20:09
