Mac OS X gets rootkit coding manual

Needs to be asked...

... who cares about OS/X root kits?

Macbois believe their beloved o/s invulnerable and are not interested in counter revolutionaries and their black OS/X propaganda.

The rest of us already have our fair share issues with Windows and Linux. And we sure as hell do give a job's liver about OS/X either.

Rootkits for OS/X..? yawn.. fart.. belch..

We. Just. Don't. Care. (unless there are some half naked women involved, or beer, Paris, aliens, or more Soviet Brittan exposé or any combination thereof)

Great, thanks

Just what all the malware writers need, a nicely put together guide on breaking into an operating system. Will this moron take responsibility for malware developed using his information?

Anonymous Coward @04:28 is correct though, the biggest weakness in an OS is the user.

Ridiculous

This is ridiculous! I understand the right to free speech and so on, but who in their right mind thinks that explaining how to exploit another person's computer system is a good idea? What good could possibly come from this? The guy admitted they're not vulnerabilities, so can't be fixed, so other than getting himself some script kiddie kudos, what is his reason for "sharing" this information?

@AC Shouldn't be hard!

+1 all round. I am also a Mac user, but only because I'm in charge and have a clue. Sure I like Finder's default behaviour but it ought to be UI-changeable. And security -- all it takes is a rootkit with built-in privilege escalation, just like the ones Linux has once every other full moon, and we're about done with the Mac complacency camp.

Although the Mac is inherently better and more secure than Windows, and has perhaps better safeguards against security trouble, they only go as far as user stupidity. And Windows, that's highly dependent on what holes Microsoft introduce this month in network services, many of which shouldn't be on, etc, etc. Mind/marketshare notwithstanding, I vote OS X and OSS with my mind and wallet, and think everybody else should as well.

Cheers,

Sabahattin

Following on from AC 04:28

"Mac security has the potential to be a bigger headache than Windows security because Mac users are less inclined to get their hands dirty fixing / patching / dealing with an issue."

Discuss.

(Note: I have no particular view on this, but the grenade icon was the closest I could get to a timebomb)

Gasp @James Greenhalgh

Oh look, anti-Mac 'tards who comment on what they don't know about. I'm so shocked.

All those hippies probably don't take your opinion seriously, fortunately.

Security by Obscurity

I for one welcome any information which can highlight weaknesses in the beloved, most holy of holys, gospel according to the man with no liver. The end goal being to fix and improve, not to

to point fingers and laugh.

For too long now Apple's approach of 'security through obscurity' has frankly been insulting. MS were the same until, iirc, the blaster worm era of the early 2000's. The coffee was smelt, and technet developed into a great resource.

Is it going to take a major issue for Apple to learn and start communicating with IT professionals? they should learn form MS mistakes.

If they can sort their attitude out, Apple may find themselves being taken a little more seriously by IT pros and start to increase their foothld in the corporate world.

And the f'ing complacency of the muppets who buy these things really does have to stop. "we don't need antivirus, we don't need a firewall, we don't need patching, we are invincible." Pisses me right off - not on MY network sonny jim!

If i hear "well macs have never had viruses before, therefore they won't get them in the future' one more time i am going to take this silly little overpriced bit of white plastic and shove it where the sun don't shine.

One of humanity's greatest traits is to learn from others mistakes - therefore progress. Apple need to wisen up imvvvho.

I bet £0.50 to the author that 95% of the commenters above don't know shit all

"OS X is inherently stable"

"Mac is not stable at all it's the same as windows only less people use it"

"Your mum is not stable"

Who gives a shit? Are you a neutral security researcher? Or are you repeating previous internet commenters' comments with a dash of you own opinion?

I'm guessing the latter.

The news is that someone is going to give a talk on OS X rootkits. We don't even know what is in the talk.

Command Line? LOL

@AC - Sebby and Wonko

"Sure I like Finder's default behaviour but it ought to be UI-changeable."

OK guys - it's real easy (especially in Leopard). Select Finder menu, Preferences, Advanced and check the box that says 'Show all file extensions'.

Paris? Because I'm sure she could extend something...

Auto Login Blues?

@Steven Hunter

"Given that 90% of Mac users leave OSX in auto-login mode"

Well - 100% of Mac users in this household logon using a username and password - which is more than I can say for the default behavior of Windows where you get an auto-logon until you either:

1. Join a Domain

2. Change the Welcome screen preferences

3. Edit the local security policy of the machine to force a CTRL-ALT-DEL

None of the above are overly simple or easy to find - especially for the home user, and only when they know what they are doing.

At the end of the day, those in the know, who realise the value of security, will ensure that their machine(s) are not open to these kinds of attacks. Those who don't - well, you do see spam, don't you?

Paris? Because she knows how to secure her video files.

Are rootkits still a problem?

Are "legitimate" companies, such as Sony, using rootkits? Will this affect anyone outside of downloaders of illegal software?

Paris, because she wants to know her MacBook is safe...

@AC 15:18

No no no, Hidden *files* , not filename extensions.

Auto Login Blues??

Erm... Windows requires a password to login by default, AC.

@Aaron 10, others

Legitimate companies using root-kits is not necessarily the problem. :)

In any case, as far as security of ANY system is concerned, and idiot is an idiot whether it sits in front of Mac, Windows, Linux, Amiga, or whatever. Windows does NOT have an exclusive license on idiots.

(And by idiots, I mean the moronic, click-happy, impatient people who absolutely refuse to learn anything, insisting on the fact that they are "computer illiterate, and just need to use the damned thing." I certainly do not mean the uneducated who got soaked on a sex-core system with 16GB of PC9900 SDRAM for browsing and email, and have the ability and real desire to learn. Hi, Grandma!)

Paris, getting soaked with something or other.

@Auto Login Blues??

"Erm... Windows requires a password to login by default, AC."

Nope. I call bullshit on this one. Just did several XP Home re-installs recently (to solve bitrot issues and clean up problems left by a virus that we just can't seem to get rid of) and every last one of them defaulted to auto log-in.

I suspect that passwording the account will change that behavior, but I also note that the default install doesn't ask you to set one.

Has this changed with Vista or Windows 7? Is it true for all versions of XP? No clue. And I know it wasn't true for many older versions of Windows. But the (currently) most popular -- no, that's a guess, I don't have statistics to back it up -- version of Windows doesn't install requiring a login by default.

@alien anthropologist:

"We. Just. Don't. Care."

Then STFU and go away. Obviously you care enough to read the article and waste time commenting. Liar or hypocrite? You choose.

@security-by-obscurity proponents:

"Just what all the malware writers need, a nicely put together guide on breaking into an operating system."

Yeah, much better to hide the information and just hope and pray nobody else is clever enough to figure it out who is interested in using the information for anti-social purposes. Bzzzzt! Wrong answer. The emperor has no clothes.

Hey, know what? No OS is perfect. Windows has a pathetic track record and several recent articles have been trumpeting some major exploit in Linux. Not that we haven't seen Linux issues before.

Best way to deal with it is get the info out to the white hats and get it fixed pronto.

Security by obscurity. Windows has been trying that for decades. How often has Microsoft claimed that they're secure because nobody has the source code? See how well that's worked.