Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some serious suspition that my boss installed some kind of spy software. Maybe a keylogger, screen capture or something to know what I do when he's not at the office.

I have nothing to hide so I don't know if he doesn't tell me anything because he didn't find anything out of place or because I'm being paranoid and he's not spying me.

Either way I want to be sure if I'm being spied because:

  1. I don't want to work for someone he doesn't trust me me
  2. It's illegal and I won't allow anyone to store my passwords (I do access my personal email, homebanking and Facebook account during lunch breaks) and personal information.

So... how can I detect spy software in a iMac running OS X 10.6.8? I have full admin permissions know it.

I tried scanning all folders in my user's and system Library but nothing rang any bell but since I think any of this software would hide the folder (either by location or name) I don't think I'll find a folder named Employeee Spy Data

I also looked all the processes running at different moments with Activity Monitor but again... it's not like the process would be called SpyAgent Helper

Is there a list of known possible folders / processes to look for?

Any other way to detect?

share|improve this question
3  
This is your boss. Come see me tomorrow. Nah, just kidding. Depending on how skilled he is, you could start by checking the available software of that type for Mac OS X and trying e.g. keystrokes that activate it. Also, I have not found a commercial solution offering password capturing. – Harold Cavendish Jul 31 '12 at 17:55
1  
It is not necessarily illegal but depends on what your employment contract says and I suspect could be legal just becuse you are using equipment owned by the company – Mark Jul 31 '12 at 21:04
1  
A similar question at Super User. You could also try monitoring network traffic with an application like Little Snitch. – user495470 Aug 1 '12 at 11:31

If you've been hacked, the keylogger has to report. It can do this either immediately, or store locally and periodically spew it to some network destination.

Your best bet is to scrounge an old laptop, ideally with 2 ethernet ports, or, failing that with a PCMCIA network card. Install a BSD or Linux system on it. (I would recommend OpenBSD, then FreeBSD just because of easier management)

Set up the laptop to act as a bridge -- all packets are passed through. Run tcpdump on the traffic back and forth. Write everything to a flash drive. Periodically change the drive, take the filled drive home and use ethereal or snort or similar to go through the dump file and see if you find anything odd.

You are looking for traffic to an unusual ip/port combination. This is tough. Don't know of any good tools to help winnow out the chaff.

There is a possibility that the spyware writes to the local disk covering its tracks. You can check for this by booting from another machine, boot your mac in target mode (it acts like a firewire device) Scan the volume, grabbing all the detail you can.

Compare two runs of this on separate days using diff. This eliminates the file that are the same on both runs. This won't find everything. E.g. A Blackhat app can create a disk volume as a file. This won't change much if the Black app can arrange for the dates to not change.

Software can help: http://aide.sourceforge.net/ AIDE Advanced Intrusion Detection Environment. Useful for watching for changed files/permissions. Aimed at *ix, not sure how it handles extended attributes.

Hope this helps.

share|improve this answer

I'll make the hypothesis you have already thoroughly checked all the most common RAT are off or dead (all sharings, ARD, Skype, VNC…).

  1. On an external and fully trustable Mac running also 10.6.8, install one (or both) of these 2 rootkits detectors:

    1. rkhunter this is a traditionnal tgz to build & install
    2. chkrootkit which you may install through brew or macports, for example:

      port install chkrootkit

  2. Test them on this trustable Mac.

  3. Save them on an USB key.

  4. Plug your key on your suspected system running in normal mode with everything as usual and run them.

share|improve this answer
1  
If the rootkit can detect the operation of an executable on a flash, it may be able to hide it's actions. Better, to boot the suspect mac in target mode, then scan from the trusted mac. – Sherwood Botsford Jan 25 at 3:02

To detect and delete apps you can use any uninstall software for Macintosh (like CleanMyMac or MacKeeper).

share|improve this answer
    
How would this person find the spyware in the first place (before using the uninstallation app)? – M K Nov 27 '13 at 14:05
    
mackeeper is the worst software ever – Juan Jan 25 at 4:56

Any kind of rootkit worth its salt is going to be nearly undetectable on a running system because they hook into the kernel and/or replace system binaries to hide itself. Basically what you're seeing cannot be trusted because the system cannot be trusted. What you need to do is turn off the system, connect an external boot drive (don't connect it to the running system) and then boot the system from an external disk and look for suspicious programs.

share|improve this answer

One definite way to see if anything suspicious is running is to open the Activity Monitor app, which you can open with Spotlight or go to Applications > Utilities > Activity Monitor. An app can hide from plain sight, but if it's running on the machine, it will definitely show up in Activity Monitor. Some things on there will have funny names, but they are supposed to be running; so if you aren't sure what it is, maybe Google it before you click Quit Process, or you could turn off something important.

share|improve this answer
1  
Some software can patch the process table routines and hide themselves. Simple programs and ones intended to be more reliable (since a modification of that low level of the system can cause issues) won't hide the processes or files that it leaves behind. However to categorically say all apps definitely show up isn't a good statement since it's trivial to patch Activity Monitor or the process table itself with some light engineering work. – bmike Nov 26 '13 at 21:56
    
This is a risky trust on a known application (Activity Monitor) not too hard to make lie. – daniel Azuelos Dec 7 '13 at 15:08

protected by Community Apr 14 '15 at 8:23

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.