{"id":1025,"date":"2009-08-13T09:07:42","date_gmt":"2009-08-13T08:07:42","guid":{"rendered":"http:\/\/blog.intego.com\/?p=1025"},"modified":"2009-08-13T09:07:42","modified_gmt":"2009-08-13T08:07:42","slug":"mac-os-x-rootkit-tools-released","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/mac-os-x-rootkit-tools-released\/","title":{"rendered":"Mac OS X Rootkit Tools Released"},"content":{"rendered":"

Security researcher Dino Dai Zovi has released<\/a> a set of advanced rootkit tools for Mac OS X. This follows his recent presentation at Black Hat, which, “covered a number of Mach-based rootkit tools and techniques including user-mode Mach-O bundle injection, Mach RPC proxying, in-kernel RPC server injection\/modification, and kernel rootkit detection.”<\/p>\n

Dai Zovi says, “These tools are deliberately released as \u2018non-hostile\u2019\u00a0proof-of-concept tools that meant to demonstrate techniques and are\u00a0not suitable for use in actual rootkits or attack tools.\u00a0The IM and\u00a0SSL logging bundles log to the local system\u2019s disk in an obvious\u00a0fashion and Machiavelli opens up the controlling host to some obvious\u00a0attacks.\u00a0The non-Machiavelli version of inject-bundle, however, is\u00a0fully functional and useful for a variety of system-level tasks.\u00a0Using the other tools outside of a closed network or test virtual\u00a0machine is not recommended.” <\/p>\n

While this is true, in the wrong hands such tools can be used for malicious purposes. As is often the case with such “proof-of-concept” tools, you don’t need to go very far to find users who have different goals. We’ll be keeping a close eye on this.<\/p>\n","protected":false},"excerpt":{"rendered":"

Security researcher Dino Dai Zovi<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n