The development of a proof-of-concept rootkit for Mac OS X reinforces the fact that security concerns aren't just for Windows users.

Thomas Claburn, Editor at Large, Enterprise Mobility

July 30, 2009

2 Min Read

At the Black Hat security conference on Wednesday, security researcher Dino Dai Zovi revealed a proof-of-concept rootkit that runs on Apple's Mac OS X operating system, underscoring the fact that all software has flaws.

Rootkit software is designed to covertly run code, typically malicious, on affected systems. It can be used to steal information or control a compromised system. Rootkits are typically installed by other malware.

Apple users have enjoyed a relatively malware-free existence, at least compared to Windows users, and Apple has made much of that fact in its television commercials. But there are holes to be found in Apple's software, too. There just aren't a lot of cybercriminals focused on a platform that's less than 10% of the market.

That's been changing slowly, with the spread of the OS X-based iPhone, and the popularity of iTunes among Windows users. Security vendors, eager to sell Mac users security software, suggest the situation is changing quickly.

Thanks to the work of Dai Zovi, author of The Mac Hacker's Handbook, and other security researchers focused on the Mac, like Charlie Miller, the vulnerabilities in Apple's software are better understood. In theory, such work makes computer users safer by encouraging companies to fix disclosed vulnerabilities.

Apple did not respond to a query about whether it had patched its software to block Dai Zovi's attack.

Dai Zovi's proof-of-concept rootkit is called Machiavelli, a reference to the Mach kernel that underpins Mac OS X.

"Machiavelli consists of a Mach proxy server on the local controlling host and a number of remote agent servers that run on remote compromised hosts," Dai Zovi explains in a technical paper that describes his work. "On the controlling host, rootkit management utilities obtain a proxy Mach port from the proxy server and use it just as a normal application would use a local Mach port."

With his presentation complete, Dai Zovi plans soon to release several Mac software tools related to his research on his Web site. These include: Inject Bundle, for data injection; iChatSpy, code for logging instant messages; SSLSpy, for logging SSL traffic; iSightSpy, for capturing a single frame from any Apple iSight camera; Machiavelli, for remotely controlling a compromised system; and Uncloak, a rootkit identification tool.

Black Hat is owned by TechWeb, which publishes InformationWeek.

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights