Slashdot Mirror
MacScan Detects Spyware
limpymac writes "MacScan public beta was announced to the public short minutes ago. MacScan will detect, isolate and remove spyware on the Macintosh. Currently it will detect trojan horses and keystroke loggers without a hitch. The application is for Mac OS and Mac OS X and is created by the folks at SecureMac.com. I found a keystroke recorder on my Macintosh I installed a year ago and forgot to remove; hah, I have a year's worth of logs!"
MacScan Spyware Detection
posted by AcaBen on Friday December 13, @07:40AM
from the undboubtetdly-more-coming-for-x dept.
On MacSlash
Spyware...that's a Wintel thing isn't it?
Both CERT and SANS are warning of a new spyware package for MacOS [X] that masquerades as a spyware scanner! ;-)
-psy
is for someone to hurry up and port some spyware to the Mac, so this product will have something useful to do.
four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
I found a keystroke recorder on my Macintosh I installed a year ago and forgot to remove; hah, I have a year's worth of logs!
They may not actually be as interesting / immersive as the year of typing itself.
Keep your packets off my GNU/Girlfriend!
...or is apple.slashdot.org mirroring macslash more and more recently? The interesting thing is that macslash usually beats slashdot to it, but the interesting discussions happen here. :)
Triv
Be nice to your friends and let them spy at you :-)
Doesnt that make you feel special. Nobody would spy at ordinary people....
My company is called MacScan Ltd. Although it is nowt to do with this product, scanning or macs.
It comes from Macdonald and Scanlon.
per mere, per terras
The wintel world (win9x) needs something that can get Gator and friends out the door. Ive had Gator, Netdotdomains, and a hoard of other spyware install itself, take the free system resources from 95% to 65%, and not get out. Anitivirus software just cannot detect it.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
I nearly shit myself when I saw that these guys were releasing a FAT binary. Hell, I haven't seen one of those in ages. I feel a sudden urge of nostalgia to find a computer running System 7.
... now can I get the girl on the front page to come to my house and scan me while the software is scanning my computer?
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
you truely are a hacker!
Seriously, REALbasic is kludgy as all hell. I would bet that this program really IS spyware.
"NO!!! Don't mix the red and gree- *KABOOM!!!*
"George, I told you to put that stuff away. What's that, the third model we've killed? Well, see if we at least snapped the photo in time."
c-hack.com |
If I set it to scan everything from the root directory on down, it crashes without fail. Pretty beta so far.
I don't have access to any OSX system, however, according to the FAQ: 'chkrootkit looks for known "signatures" in trojaned system binaries. For example, some trojaned versions of ps have "/dev/ptyp" inside them.'
Try running "chkrootkit -x passwd" to run only passwd test in expert mode. It will show any text strings inside your /usr/bin/passwd binary.
(It may be a lot of text, so you'll probably need to run "chkrootkit -x passwd | less" or "chkrootkit -x passwd | more" or "chkrootkit -x passwd > some_file.txt")
"chkrootkit -x passwd | grep ^/" will show you files, which are harcoded into your passwd binary, this is what I got on my Debian GNU/Linux box:
/lib/ld-linux.so.2
/usr/share/locale
/var/run/nscd.pid
/etc/passwd
/etc/shadow
(grep / instead of ^/ will show every line including slash, not only those beginning with slash, it may show more files, but it'll also show other text besides file paths.)
If you see something suspicious there then---OK, forget about it. I see lots of suspicious strings inside my own passwd binary, like "adlqr:uSekn:x:i:w:" which could be a backdoor password or something. Besides, I have to tell you that I (and I'm not experienced in something like that) could manually trojan your /usr/bin/passwd in a way which
wouldn't be detected by chkrootkit
(until they add my trojan binary, which is unlikely if I do it manually, every time in a different way)
and it won't show anything suspicious looking for strings in the binary.
So just check if your /usr/bin/passwd is the same as some version you know is original (like on the CD, or on the freshly installed system, etc.)
The best you can do is probably check md5 hash (run "md5sum /usr/bin/passwd" or "md5 /usr/bin/passwd" -- I don't know what's the command on MacOS X) and compare it with md5 hash of /usr/bin/passwd you know is clean.
But in the situation I described my /usr/bin/passwd was changed, but also
my /usr/bin/md5sum! So I couldn't trust anything.
You have to boot from the read-only media (like CD-ROM
or a floppy which has been write-protected after it has been prepared using a clean system)
and check your hard drive using only software on the CD.
This is the only way you'll know that at least your md5sum or ls don't lie to you
(because when you find out that your passwd, md5sum, ls, ps, who, netstat and everything important has been changed by someone,
it's not a nice feeling, trust me).
root@aio:~# nmap -sX -iR -p1- # Ho, ho, ho! Merry Xmas, everyone!
I just compiled this too and got the same result. Everything else checks out OK. Perhaps this has something to do with the way OS X writes to /etc/passwd. I don't really understand the output from running chkrootkit -x passwd, but it does seem consistent with the view that it has to do with something specific OS X is doing. It might be worth emailing the fink people about putting chkrootkit into fink and writing a version that doesn't have this error. Assuming it is an error; the alternative is, both of us have been rooted!
MacScan b2 is available from http://macscan.securemac.com/ which fixes many of the issues discussed here.