Article:		Mac Security: Identifying Changes to the File System
Subject:		Mac OS X Rootkits
Date:		2005-10-08 12:43:00
From:		macCompanion
See http://freaky.staticusers.net/ugboard/viewtopic.php?t=13891 And then there was Opener, but if folks updated their Mac OS X security updates, this one isn't or should not be, an issue: http://www.securityfocus.com/news/9796 Other Mac OS X Rootkits are; osxrk, Togroot and WeaponX, all of which probably can stil be found at http://www.rootkit.com And ClamXav finds them: http://www.clamxav.com/

Showing messages 1 through 2 of 2.

• Mac OS X Rootkits
  2005-10-09 06:21:54  peterhickman [Reply | View]
  
  
  To be honest I never thought that opener was a rootkit as it did very little to evade detection. The problem for OS X rootkits is that they all seem to require the the victim to install the devtools and run stuff as root.
  
  Can't quite work out why osxrk supplies a version of nc as it is already provided , at least in Tiger.
  
  To give a feel for the lack of development we have this from the Togroot README.
  
  Once loaded, Togroot will give you the ability to obtain root access simply by typing "/givemeroot" and typing "su", for example.
  ...
  cp -R /path/to/togroot.kext /system/library/extensions/togroot.kext
  Add sudo to the beginning if you are not currently root.
  
  So to install a rootkit to give you root access to a system you require root access, deeply flawed in my mind.
  
  One day there will be a credible rootkit for OS X, but today I am not too worried.
  

• Mac OS X Rootkits
  2005-10-09 05:39:39  yvesdec [Reply | View]
  
  
  It is a bit weird, they create scripts to hack systems but they have trouble downloading it and don't know how to compile a single c file :-\