Slashdot Mirror

← Back to Stories (view on slashdot.org)

MacScan Detects Spyware

Posted by pudge on from the thats-no-security-problem-thats-my-boss dept.

limpymac writes "MacScan public beta was announced to the public short minutes ago. MacScan will detect, isolate and remove spyware on the Macintosh. Currently it will detect trojan horses and keystroke loggers without a hitch. The application is for Mac OS and Mac OS X and is created by the folks at SecureMac.com. I found a keystroke recorder on my Macintosh I installed a year ago and forgot to remove; hah, I have a year's worth of logs!"

10 of 43 comments (clear)

  1. Ummm....spyware & Macintosh.... by Nipsy356 · · Score: 5, Funny

    Spyware...that's a Wintel thing isn't it?

  2. In other news... by psyconaut · · Score: 5, Funny

    Both CERT and SANS are warning of a new spyware package for MacOS [X] that masquerades as a spyware scanner! ;-)

    -psy

  3. Now all we need by mithras+the+prophet · · Score: 5, Funny

    is for someone to hurry up and port some spyware to the Mac, so this product will have something useful to do.

    --
    four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
    1. Re:Now all we need by alfaiomega · · Score: 5, Interesting

      Now all we need is for someone to hurry up and port some spyware to the Mac, so this product will have something useful to do.

      It is not so funny as it may sound. This is exactly my attitude when I installed Debian stable release few years ago and never minded checking security updates. I laughed at my Windows-using friends every time there was a new worm or virus, telling them that it's not fair that GNU/Linux is not supported by all of this malware, until someone exploited my old bind buffer overflow and installed a kernel level rootkit.

      Remember that Darwin, the base of Mac OS X, is based on FreeBSD. chkrootkit, a tool to locally check for signs of a rootkit, is constantly tested on FreeBSD 2.2.x, 3.x and 4.x, not without a reason.

      Read the paper Attacking FreeBSD with Kernel Modules: The System Call Approach written by pragmatic/THC on June 1999 to have some idea on how well those issues were understood three and a half years ago. This is only one paper, the first thing about FreeBSD rootkits I just found.

      So, of course it's funny what you said, of course your Mac is indeed much more secure than an average Wintel box out there, but it doesn't mean there's no spyware. Your Mac is not a toy, it's a powerful Unix box under the hood, which may mean that it's harder to exploit than Windows box, but it also means that when it's exploited, it's probably easier to write and install spyware there (like a simple kernel module which would intercept read syscall, for example). Never forget about that.

      --

      root@aio:~# nmap -sX -iR -p1- # Ho, ho, ho! Merry Xmas, everyone!

  4. May I suggest... by Hubert_Shrump · · Score: 5, Funny

    I found a keystroke recorder on my Macintosh I installed a year ago and forgot to remove; hah, I have a year's worth of logs!

    They may not actually be as interesting / immersive as the year of typing itself.

    --
    Keep your packets off my GNU/Girlfriend!
  5. Is it just me... by Triv · · Score: 5, Informative

    ...or is apple.slashdot.org mirroring macslash more and more recently? The interesting thing is that macslash usually beats slashdot to it, but the interesting discussions happen here. :)

    Triv

  6. Re:PC World desperately needs this by GeorgeH · · Score: 5, Informative

    The wintel world has something that can get Gator and friends out the door - AdAware from Lavasoft.

    --
    Why can't I moderate something "Wrong" or at least "Grossly Misinformed"?
  7. Blast from the past by MalleusEBHC · · Score: 5, Interesting

    I nearly shit myself when I saw that these guys were releasing a FAT binary. Hell, I haven't seen one of those in ages. I feel a sudden urge of nostalgia to find a computer running System 7.

  8. Re:PC World desperately needs this by kawika · · Score: 5, Informative

    Antivirus software just cannot detect it.
    That's because you gave permission to install it via some sneaky click-wrap license. You know, those ones you never read? AV companies have the technology, but they would probably get their pants sued off if they called another company's product malicious when it was merely annoying or nosy--and when the user supposedly consented to it being there.

    The wintel world (win9x) needs something that can get Gator and friends out the door.
    There are plenty of them already, like Pest Patrol, Spybot S&D, and Ad Aware.

    There's a lot of good information on spyware at Doxdesk and Spyware Info.

  9. Crashes by wazzzup · · Score: 5, Informative

    If I set it to scan everything from the root directory on down, it crashes without fail. Pretty beta so far.