2

I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion.

Given the (not technically based) suspicion I have that my machine was compromised and that the compromise may have survived a complete HD wipe and OS reinstall, I'm wondering what steps I could take to determine if the machine is still compromised. I am not asking for help determining if I am being spied on personally, just trying to determine whether my laptop is secure. Please no comments explaining why it is unlikely that something is happening. I'm asking about technical steps I can take to increase confidence that no one is currently monitoring my laptop.

Steps I've taken so far:

  1. Manually inspected several areas of my disk using basic shell tools. Some files had been overwritten including binaries within specific application directories, and a rogue process that was identified as spyware which I was able to remove, prior to eventually wiping the hard drive and reinstalling OS X (over Air from another machine, since this is a MacBook).

  2. Installed Sophos AntiVirus (many months after OS reinstall). Full HD scan found no threats. Background process scan has yet to alert me of anything.

  3. Wireshark has found several suspicious (to me) network streams sending varying amounts of encrypted packets at regular intervals to several servers, including ones with no DNS entry, a few from *.nl or *.ch TLDs, and some that have turned out to be explained. (A process named SophosWeb is sending encrypted payloads every few seconds, rotating ports in the 5K range, back and forth from a server registered to Google. So, sounds legit...) Wireshark produces a lot of data.

On the last in particular, where the ultimate concern is spying on my activities or data, I don't know how to wade through the noise of frequent traffic between my laptop, the Verizon router, my phone... Some of this looks completely kosher, but then there are things like UPnP exchanges between my Apple laptop and the Verizon router, which are questionably secure at best, and hard to know how to turn off. If I close Chrome I can get traffic down to enough of a trickle to manually investigate each unknown server, but I don't know what to look for.

  • 3
    This question is all over the map. The technical aspects are a distraction from the core question, which seems to be "How can one know they have privacy?" That question has been answered in many ways here on this site. In short, you can't prove a negative (no one has seen my communication), but you can monitor the positive (what I am leaking). – schroeder Jul 22 '14 at 16:06
  • Traffic to *.nl and *.ch are perfectly valid if you live in those countries... – schroeder Jul 22 '14 at 16:07
  • That's true. I do not. – Jason Boyd Jul 22 '14 at 16:08
  • 1
    You are already doing what you need to do to determine what data is being sent from your computer: Wireshark. My guess is that you aren't sure how to derive relevancy from the data Wireshark is giving you, which is an understandable frustration. My advice is to keep working along the Wireshark path. – schroeder Jul 22 '14 at 16:15
  • 1
    Thanks. That is actually encouraging. Indeed I'm wondering how I can learn more about reducing the noise. As I have said, it's not so much traffic that I can't manually go through all of it, but I still need to know how to determine what's okay. I am more technically aware than people here may think, but not being in info sec, it's a complex matter to determine this. Unfortunately the solution cannot be to buy a new computer either. If I were currently infected, it would most likely be due to a rootkit that survived reinstall, in which case I believe network traffic is my only path, if that. – Jason Boyd Jul 22 '14 at 16:19
7

Reduce your exposure

within System Preferences > Sharing close everything you don't need.

To give you a practical example, in my case, everything is off.

Shut off netbios:

cd /System/Library/LaunchDaemons
/usr/bin/sudo launchctl unload -w com.apple.netbiosd.plist
ps ax | grep 'PID|netbiosd'

This might highly reduce network noise.

Scan for residual crapware

See How to scan a Mac for rootkits and other stealthy security hazards

Detect basic data leak

This isn't bullet proof, but will detect most known data leak and call back home to help you focus on serious problems.

Little Snitch 3

This is a fantastic tool. It won't detect everything but will help you to reduce the abnormal traffic to a very reduced one.

Hunt within a reduced traffic

And now to the core business, look at residual strange connections:

netstat -A
tcpdump -i en1
wireshark
  • 1
    Thanks, some great pointers. I'm wondering, in general, how a Dummy like me would start learning about security , without making it a full-time effort. I am at the level of anti-virus software, hidden wifi with WPA2 auth, generally practice safe browsing habits. All of which is insufficient for some types of intrusions, which is why I'm focusing on detection. As a specific example, I have never understood what netbios is, why I should not need it. The wikipedia page is spectactularly unhelpful in answering such questions. Maybe an info sec for dummies book, or is there a better starting point? – Jason Boyd Jul 22 '14 at 20:41
  • As a side note, I am a software developer with pretty good understanding of a lot of things techie, but my sense of security measures is average, and the threats have gotten more sophisticated since I last really paid attention years ago. – Jason Boyd Jul 22 '14 at 20:42
  • I guess, as coyly as I can put this, if the attacker is so skilled that they are able to bypass most defenses, should I waste more than zero time trying to detect the compromise? Again, this is not an invitation to question why I would think I'm targeted, or to discuss my situation further. I'm concerned with technical options, and inclined to think I should just give up thinking I can safeguard my personal and private data and communications. – Jason Boyd Jul 22 '14 at 21:02
  • 1
    You're already on a pretty good track. Stop considering you a dummy. You need: 1. Will to learn ✔, 2. Awareness ✔ (to have an anti-virus on a Mac is a positive point), 3. Reduce any problem to a simpler one to progess (here is the objective of my answer), 4. Analyse with solid tools (here is the objective of excellent Schroeder's answer): netstat, tcpdump, wireshark – dan Jul 22 '14 at 21:04
  • As long as you have a standalone installer of your OS (on an USB key that you can check sum on another "trustable" Mac), as long as you verified that your firmware was never tempered with, as long as you are using a system without too many "unpublished" holes, yes you can detect and block the best skilled attacker. And one day, you will be able to spy on him, trap him within a honey pot and track him back to his personnal computer :). – dan Jul 22 '14 at 21:20
5

We cannot comment on the possibility of a latent infection of your computer. We do not have enough information, and this is not an infection-removal forum. But, we can talk about your bigger questions.

To know if you have privacy is tricky. You can't prove a negative (no one has seen my communication, or everyone has seen none of my communication), but you can monitor the positive (the communication I am sending). You are already doing the latter by capturing your data packets and reviewing with Wireshark. I encourage you to keep working along this path.

There is a lot of data in a typical computer's packet stream, and it takes time and experience to wade through it all, but once you get a handle on it you will be a much better technologist. I can't tell you how many times I have been able to help a wide range of IT professionals by being able to interpret a packet trace where others could not or did not try.

Your answers are in that packet stream. The learning curve is steep, but the rewards are proportional to the effort. That is how you will know if your computer is communicating without your knowledge.

  • Thanks schroeder. That sounds like the correct answer. Unfortunately, while I may explore this a bit more, I don't have the resources to go through that steep curve and am realizing over time that the bottom line is, I cannot trust any of my devices moving forwards, and have to assume my privacy has been permanently removed. I can hope (indefinitely) that I'm no longer being watched, and hope that my personal data will not used in malicious ways by the same actors who already are violating the law to get access to it, but I can't justify spending so much time just to lock down one vector. sigh – Jason Boyd Jul 22 '14 at 17:05
  • One word: mitigation. There is no such thing as perfect security, but you can mitigate the risks. – schroeder Jul 22 '14 at 18:54
2

Long answer: Nothing you've described "post OS reinstall" sounds abnormal - with the borderless nature of the internet, it's not surprising that lots of your legitimate traffic seems to be going to servers in other countries (or without DNS entries). While applications which utilize UPnP to function may put you at higher risk for intrusion or exploitation than statically defined rules in a stateful packet filtering firewall, they aren't necessarily malicious in and of themselves. While sometimes these traffics do turn out to be malicious, you must also consider means and motive. The means to continually compromise / monitor your Macbook even through an OS reinstall are available to a (proportionally) small number of actors (state or otherwise), and I doubt they'd waste time or resources on you, unless you're important enough to be spied upon. What do you have worth spying on? If you actually had information worth compromising, you'd be going to persons who could actually help you in this situation...not Stack Exchange. Simply put, you're probably not worth spying on.

Short answer: badBIOS wasn't, and it doesn't sound like this is either.

  • Can't discuss some of your seemingly valid points. But my question was not "Am I being spied on?" but "How can I (or anyone) determine that they are not being spied on?" Dismissing traffic as typical or normal does not determine that that traffic is all innocuous. – Jason Boyd Jul 22 '14 at 15:42
  • 1
    "Can't discuss"? - "How can I (or anyone) determine that they are not being spied on?" - Are you serious? That's like asking "How do I prove this thing that you can't even really prove is or isn't happening, without discussing the problem?" The reason you think you're being spied upon is that your level of technical knowledge and industry experience do not permit you to realize that you aren't. – Panther Modern Jul 22 '14 at 15:45
  • Also, on a technical note, shouldn't it be possible, in theory, to turn off any applications or services that would seem to have any need of the internet, and see my network traffic go to almost zero (leaving things like pinging the router, devices in my house detecting each other)? I would like to achieve this. – Jason Boyd Jul 22 '14 at 15:46
  • 1
    No, I was asking how one would use technical means to determine their system is not sending data it shouldn't be over the network. If your answer is "that's impossible" then fine. But don't insult me for not understanding the question. – Jason Boyd Jul 22 '14 at 15:47
  • 1
    It might help for me to clarify: spying on a person is not the same thing as spying on their laptop. I'm asking for help with the latter, not about the former. – Jason Boyd Jul 22 '14 at 16:00
0

My most helpful unixoid command line tool to get through log files (any, but you can do with your network traffic as well, if you can pipe it to a line-based output) is inverse grep (grep -v). White-list and filter out whatever you know you don’t need to care about. Remains the intresting. Maybe this is even usable for permanent monitoring (though may produce much system load then, I didn’t try) − who knows if the malware is just silent at the moment, sending only when nobody is logged on?

  • I lack knowledge in the current context but vaguely remember a claim that there are software showing the addresses to which a PC has currently established connections. If that's the case, could someone name the software? – Mok-Kong Shen Dec 6 '16 at 10:50
0

If you suspect that your system is compromised, you should also assume that the attacker (person or malware) is taking steps to stay hidden. Or in other words: Do not trust the information you get from a potentially compromised system.

You should listen to the network traffic using another system. Checking the traffic was the right idea. Going through all the traffic you see to explain it and (hopefully not) end up with something that cannot be explained except as malicious, is going to be quite a bit of work, but as daniel already explained, shutting down services on the questionable machine will reduce it.

There are several tools for detecting a compromise, but again, as long as you run them on the potentially compromised system, their output is not trustworthy. Again, you can inspect the machine from another system - if your Mac can boot into target disk mode, you can mount it like an external drive.

Not the answer you're looking for? Browse other questions tagged or ask your own question.