Mac OS X gets rootkit coding manual

Filling the void

By Dan Goodin, 20th July 2009

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Over the past decade, the world has seen advances in rootkits running on Windows and Unix operating systems that few would have thought possible. Now, it's Mac OS X's turn, as a security researcher plans to share a variety of techniques for developing the ultra-stealthy programs for the Apple platform.

At a talk titled Advanced Mac OS X rootkits at the Black Hat security conference in Las Vegas next week, researcher Dino Dai Zovi plans to discuss specific features in the OS that make it possible to write rootkits that are virtually impossible for untrained users to detect.

"Most of the existing research (into) rootkits for OS X essentially take older Unix-based ideas and port them to OS X," Dai Zovi told The Register. "Mine primarily uses the unique features of OS X and this makes it harder to detect the traditional tools and techniques."

As just another Mach-based operating system, OS X is chock full of instructions that make sneaky rootkits possible. And yet there's been little documentation, so far, of exactly what they are and how they can be used. Dai Zovi's talk aims to fill the vacuum by showing how to extend native Mach RPC mechanisms that communicate with the Mac kernel.

"It's not an inherent weakness in the system," said Dai Zovi, co-author of the Mac Hacker's Handbook. "It's just extending the flexibility of the microkernel-based design in a malicious direction."

Dai Zovi also plans to deliver a much shorter "turbo talk" discussing ways penetration testers can test the security of Macs using the Metasploit Project. ®

Agentless Backup is Not a Myth

COMMENTS

House Rules Send Corrections

All Reader Comments (30)

Latest Comments

Posted Wednesday 22nd July 2009 08:40 GMT

Alan W. Rateliff, II

@Aaron 10, others

Legitimate companies using root-kits is not necessarily the problem. :)

In any case, as far as security of ANY system is concerned, and idiot is an idiot whether it sits in front of Mac, Windows, Linux, Amiga, or whatever. Windows does NOT have an exclusive license on idiots.

(And by idiots, I mean the moronic, click-happy, impatient people who absolutely refuse to learn anything, insisting on the fact that they are "computer illiterate, and just need to use the damned thing." I certainly do not mean the uneducated who got soaked on a sex-core system with 16GB of PC9900 SDRAM for browsing and email, and have the ability and real desire to learn. Hi, Grandma!)

Paris, getting soaked with something or other.

Posted Wednesday 22nd July 2009 08:40 GMT

Jeffrey Nonken

@Auto Login Blues??

"Erm... Windows requires a password to login by default, AC."

Nope. I call bullshit on this one. Just did several XP Home re-installs recently (to solve bitrot issues and clean up problems left by a virus that we just can't seem to get rid of) and every last one of them defaulted to auto log-in.

I suspect that passwording the account will change that behavior, but I also note that the default install doesn't ask you to set one.

Has this changed with Vista or Windows 7? Is it true for all versions of XP? No clue. And I know it wasn't true for many older versions of Windows. But the (currently) most popular -- no, that's a guess, I don't have statistics to back it up -- version of Windows doesn't install requiring a login by default.

@alien anthropologist:

"We. Just. Don't. Care."

Then STFU and go away. Obviously you care enough to read the article and waste time commenting. Liar or hypocrite? You choose.

@security-by-obscurity proponents:

"Just what all the malware writers need, a nicely put together guide on breaking into an operating system."

Yeah, much better to hide the information and just hope and pray nobody else is clever enough to figure it out who is interested in using the information for anti-social purposes. Bzzzzt! Wrong answer. The emperor has no clothes.

Hey, know what? No OS is perfect. Windows has a pathetic track record and several recent articles have been trumpeting some major exploit in Linux. Not that we haven't seen Linux issues before.

Best way to deal with it is get the info out to the white hats and get it fixed pronto.

Security by obscurity. Windows has been trying that for decades. How often has Microsoft claimed that they're secure because nobody has the source code? See how well that's worked.

Posted Tuesday 21st July 2009 19:26 GMT

Aaron 10