Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sophisticated OS X Backdoor Discovered

securelist.com

Post reply on HN
Print view View original

41–50 of 155 posts

Re: Sophisticated OS X Backdoor Discovered

#41

Post by commenter23 »

jdmichal wrote: post #27
DrJokepu wrote: post #24

Earlier quoted context omitted.

I don't know much about security, but I had the impression that a "third-party" developed and installed backdoor is called a rootkit.

A rootkit is a different beast. A backdoor is simply a (covert) way to gain remote access to a system. A rootkit involves being able to elevate user permissions such that you have full control over the computer. Rootkits also typically use such permissions to hide themselves from normal user accounts. I guess in a way you could see them as related, in that they both are access tools. A backdoor gets you remote access…

No, that's wrong.

A rootkit is the thing you install once you have root - not a way to get root initially. It usually gives the attacker a means to access the machine in the future, even if the vulnerability she used is fixed in the future.

Rootkits are designed to hide themselves. They are essentially attacker installed backdooors.

A backdoor is basically a rootkit that is part of the original software as written by the original developer. The words have different connotations (rootkit is extremely negative, backdoors slightly less).

Re: Sophisticated OS X Backdoor Discovered

#43

Post by throwaway76543 »

linkregister wrote: post #28
vemv wrote: post #20

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."

No, Kaspersky Labs is using correct terminology.

Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor.

The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only a backdoor. Not a rootkit.

Re: Sophisticated OS X Backdoor Discovered

#44

Post by toyg »

That list of directories is really weird. On my machine, none of them exists, neither in ~/Library nor /Library. And I do run most of that software (Dropbox, Skype, Firefox, Chrome in the past...).

Either the malware targeted very old versions of such software and/or OSX, or somebody between the malware author and the blog writer f###ed up.

Re: Sophisticated OS X Backdoor Discovered

#45

Post by mhurron »

DrJokepu wrote: post #24
mhurron wrote: post #21

Earlier quoted context omitted.

Backdoors can be installed after the fact. The vendor putting in a back door is only one way for it to be present. This would be malware inserting a back door for further exploitation.

I don't know much about security, but I had the impression that a "third-party" developed and installed backdoor is called a rootkit.

http://www.sqasolar.org.uk/solar/material/IS01CGCD/page_19.h...

A rootkit can implement backdoor functionality, but not all rootkits are backdoors, and not all backdoors are rootkits.

Re: Sophisticated OS X Backdoor Discovered

#46

Post by richardwhiuk »

toyg wrote: post #44

That list of directories is really weird. On my machine, none of them exists, neither in ~/Library nor /Library. And I do run most of that software (Dropbox, Skype, Firefox, Chrome in the past...). Either the malware targeted very old versions of such software and/or OSX, or somebody between the malware author and the blog writer f###ed up.

The aim is to look legitimate, but not clobber applications - merely to look like something the user shouldn't delete.

Re: Sophisticated OS X Backdoor Discovered

#47

Post by mordocai »

commenter23 wrote: post #41
jdmichal wrote: post #27

Earlier quoted context omitted.

A rootkit is a different beast. A backdoor is simply a (covert) way to gain remote access to a system. A rootkit involves being able to elevate user permissions such that you have full control over the computer. Rootkits also typically use such permissions to hide themselves from normal user accounts. I guess in a way you could see them as related, in that they both are access tools. A backdoor gets you remote access…

No, that's wrong. A rootkit is the thing you install once you have root - not a way to get root initially. It usually gives the attacker a means to access the machine in the future, even if the vulnerability she used is fixed in the future. Rootkits are designed to hide themselves. They are essentially attacker installed backdooors. A backdoor is basically a rootkit that is part of the original software as written by…

No, that's wrong. Wikipedia has definitions that match my own knowledge, so i'll link and quote those.

https://en.wikipedia.org/wiki/Rootkit

"A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) while at the same time masking its existence or the existence of other software."

https://en.wikipedia.org/wiki/Backdoor_(computing)

"A backdoor is a method, often secret, of bypassing normal authentication in a product, computer system, cryptosystem or algorithm etc. Backdoors are often used for securing unauthorized remote access to a computer, or obtaining access to plaintext in cryptographic systems.

A backdoor may take the form of a hidden part of a program,[1] a separate program (e.g. Back Orifice may subvert the system through a rootkit), or may be a hardware feature.[2] Although normally surreptitiously installed, in some cases backdoors are deliberate and widely known. These kinds of backdoors might have "legitimate" uses such as providing the manufacturer with a way to restore user passwords."

Re: Sophisticated OS X Backdoor Discovered

#48

Post by clinton_sf »

saosebastiao wrote: post #33

Is there any diagnostic tool out there to determine if you've been infected?

> Is there any diagnostic tool out there to determine if you've been infected?

From what I can tell, they posted the SHA256 of the offending binary under the IOCs section of that web page. So you should be able to do this in the root of your home directory to detect if such a file exists:

# find . -type f -print0 | xargs -0 shasum -a 256 | grep 664e0a048f61a76145b55d1f1a5714606953d69edccec5228017eb546049dc8c

Re: Sophisticated OS X Backdoor Discovered

#50

Post by walrus01 »

commentzz wrote: post #38

I feel the use of 'backdoor' here is misleading. The software described would usually be classified as an Advanced Persistent Threat [1] or Rootkit [2] Backdoor [3] usually refers to methods to sidestep authentication added by the vendor. 1: https://en.wikipedia.org/wiki/Advanced_persistent_threat 2: https://en.wikipedia.org/wiki/Rootkit 3: https://en.wikipedia.org/wiki/Backdoor_(computing)

Many commenters are pointing out that one possible definition of a rootkit is something that elevates privilege, but does not necessarily have network communications functions or a command and control server. But in recent times, almost all modern rootkits seen in the wild have some form of network control functionality.
Post reply on HN