1

I'm investigating the state of my MacBook Pro which I know was compromised, and do not know if I removed the exploits completely (and I realize, technically will never know this). I'm trying to hone in on specific exploits, not expecting to prove they don't exist, but in any case I can prove that they do, that can help me decide on various courses of action from basic remediation to replacing the whole system in the most extreme.

Looking for briefest answers, here are some starting questions I have:

  • What are the common vectors for installing rootkits? (And if I understand correctly, this would include MBR as well as BIOS? So same question for each.)

  • How common are rootkits that survive OS reinstall (and are these limited to BIOS, or can MBR infections achieve this?)

  • How common are USB key infections? I know many government agencies have had policies for a few years now of not allowing employees to even use USB keys on their machines, but these are high security settings.

  • If there's a concern about attacks that are unknown to commercial AV tools, would commercial tools still be useful in detecting a rootkit from a fresh OS install? E.g. detecting unexpected network traffic as it tries to download additional malware?

  • On a previously compromised machine, is there really any hope of detecting a keylogger? I am suspecting not (unless a very poorly written keylogger, or already known to AV software.)

On all of these, I can post single questions for more detail; I'm just trying to figure out which things to explore first, and which are dead-ends.

  • 2
    Would the downvoter like to share their criticisms, rather than just providing abstract disagreement? – Polynomial Jul 25 '14 at 15:55
  • 1
    There was recently some talks at blackhat where a rootkit could be hidden in the battery, or a thunderbolt-to-ethernet adapter. You should define your threat model, as this isn't found in "off the shelf" malware, but could be in some targeted attack. – toasted_flakes Jul 25 '14 at 20:24
  • 1
    @toasted_flakes care to share that talk? – AK_ Jul 26 '14 at 0:53
  • @AK_ Couldn't find the battery one, but here's one on EFI + thunderbolt. Whitepaper – toasted_flakes Jul 26 '14 at 8:48
  • @toasted_flakes ah, I am guessing you mean USB battery charger? – AK_ Jul 26 '14 at 12:58
1
  • What are the common vectors for installing rootkits? (And if I understand correctly, this would include MBR as well as BIOS? So same question for each.)

Mainly by hooking the system calls. I suggest you read a book about this because I cannot cover it all here. I suggest: practical malware analysis and rootkit arsenal

  • How common are rootkits that survive OS reinstall (and are these limited to BIOS, or can MBR infections achieve this?)

Depends on the rootkit. Read rootkit arsenal for details

  • How common are USB key infections? I know many government agencies have had policies for a few years now of not allowing employees to even use USB keys on their machines, but these are high security settings.

Not every rootkit is delivered using USB. Some can use your email attachments, 0day vulnerability in your browsers, etc..

  • If there's a concern about attacks that are unknown to commercial AV tools, would commercial tools still be useful in detecting a rootkit from a fresh OS install? E.g. detecting unexpected network traffic as it tries to download additional malware?

They are called 0days exploits/vulnerabilities. Security engineers are working on detecting those using a technique called behavioral malware analysis. It is a mouse-cat game.

  • On a previously compromised machine, is there really any hope of detecting a keylogger? I am suspecting not (unless a very poorly written keylogger, or already known to AV software.)

A real hacker (not script kiddies) would make his/her attack persistent. First thing to do is kill any AV.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.