5

I'm looking at buying a second-hand Mac, probably one that does not include an OS installation disk. How can I scan it to make sure that it has not had security threats installed on it? Is there a CD or DVD image I can boot it up with to perform this scan offline?

Edit: prospective machine would be a 2011- or 2012-vintage MacBook Pro.

Also note that I don't have reliable access to high-speed internet, so solutions that involve downloading 5GB over the Internet are not ideal. For others, though, this guide to creating a bootable Mavericks install medium may be helpful.

  • 2
    The steps vary based on the OS level on the Mac. You can pick one now and edit the question or come back with those details once you have your Mac. There are ways to securely erase and reinstall all Mac hardware and the model of Mac also gives more or less options based on what storage is inside. – bmike Jun 26 '14 at 21:53
  • 3
    Depending on what model you get, remember that Mavericks is free for all users now, so if it's a Mavericks-capable machine, it's easy to do a clean, full reinstall on your own. You would want to do this anyway, to be honest. If it's not a Mavericks capable machine, you could look on eBay for a set of restore discs, or if you have any Mac friends, you may be able to borrow an OS install disc - just make sure it's the version that came with the machine; any newer version could be illegal unless you buy it. Try MacTracker to find out what OS the machine came with. – fdmillion Jun 27 '14 at 0:45
  • 2
    I second what fdmillion said. It's much easier to do a clean install than it is to scan the computer; besides, it's best to wipe it anyway in case the previous user left junk on it. A scan would only be needed if you did not have access to OS installation media. – sudo Jun 27 '14 at 1:44
  • So.. If I don't have access to installation media... how would I go about scanning for problems? – intuited Jun 27 '14 at 21:53
5

I ended up using a second Mac to do a scan with the questionable machine booted into target disk mode.

My actual scanning procedure was

0) (done before using target disk mode) update system and apps on both machines to current versions

1) compare files on both machines using this script:

DIRS=(Applications Library mach_kernel bin "private/etc" sbin usr);
# leaving out /opt as it seems to just contain MacPorts stuff

for dir in "${DIRS[@]}"; do
  # diff: recursive, just output whether files differ
  diff -r -q --speed-large-files "$1/$dir" "$2/$dir";
done;

1.1) I used a high-powered text editor (vim) to make sense of the output. My basic strategy was to just organize the lines of output by the first couple of levels of the directory structure using indent-based code folding. This technique does require some general and POSIX-ish-specific computing knowledge, in particular to differentiate "okay" differences from potentially dangerous differences.

2) I ran chkrootkit using the command

sudo ./chkrootkit -q -r /Volumes/system/

2.1) chkrootkit came up with the following output. These indications seem to be due to running the scan on a target disk and/or due to differences between the various operating systems that chkrootkit supports.

error: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/strings: can't map file: /Volumes/system/ (Invalid argument)
error: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/strings: can't map file: /Volumes/system/ (Invalid argument)
not tested
not tested
unable to open wtmp-file /Volumes/system/wtmp
not tested: not found wtmp and/or lastlog file

2.2) In order to get chkrootkit to compile, I had to uncomment a line in the Makefile. It's clearly indicated in the Makefile. See here for more info.

SUMMARY

I feel pretty confident that this was an effective scan (given the clean state of the scanning system). However, there are a few downsides to this method:

  • It assumes that the scanning computer is clean
  • It requires another Mac (obviously)
  • It can be painfully difficult to find a 9-pin-to-9-pin Firewire cable

In case you don't have an extra Mac available, here are a couple of alternatives to this approach:

  • It's possible to put a clean install of OSX onto a USB drive. To do this, you boot the machine while holding down command-option-R to do an Internet Recovery. This bypasses the disk contents and uses firmware code to install OSX from Apple's servers. Apparently you can just plug a USB drive in and choose this as the installation target; afterwards you can boot the machine from the USB drive and run scans on the system drive. Downside here is that this is a >5GB download, so you'd better have a fast Internet connection (or some patience).

  • I could have also pulled the drive out of the machine and put it into a hard drive enclosure. The advantages here are that I wouldn't have had to use a Mac to scan it, and that I wouldn't have had to find a 9-pin-to-9-pin Firewire cable. Of course, if I didn't use a Mac to scan it, I wouldn't have been able to use my first scanning method (the diff).

  • 2
    chkrootkit may be used on a mounted Mac as target disk. If the mounted file system to test is named /Volumes/My Mac to test, then use it this way: /usr/bin/sudo /opt/local/bin/chkrootkit -r '/Volumes/My Mac to test' . – daniel Azuelos Jun 29 '14 at 12:43
  • 2
    You can also run clamscan from a "safer" Mac on a remotely or target disk mode mounted suspicious Mac. – daniel Azuelos Jun 29 '14 at 12:47
  • Who has reviewed the source code for all of the chkrootkit C programs, especially the script “chkrootkit”, to ensure that they aren’t infecting our computers with rootkits or key loggers? – Curt May 28 '17 at 13:39
2

Here is a receipe for someone already knowing Macports or willing to start with:

  1. Create a brand new admin user, and login with it
  2. Install the latest C compiler through Xcode
  3. Install MacPorts: https://www.macports.org/ (2.3.0)
  4. Install clamav (0.98.3) and chkrootkit (0.49)
  5. Run both tools:

    /usr/bin/sudo /opt/local/bin/clamscan --bell -l ~/tmp/clam.`date +%d-%m-%Y`.log -r /
    /usr/bin/sudo /opt/local/bin/chkrootkit
    

    (When you don't know on which ice you are walking, it is safer to use explicit pathes).

  • 2
    I don't feel like making a new user is likely to work super well, since a security issue is probably present at the system level, and well obscured. I'd much prefer to do an offline scan of some variety. – intuited Jun 28 '14 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .