1

Is there a way to identify kernel modules that shouldn't be there out of a panic report? For example, looking at this discussion https://discussions.apple.com/thread/2778885, there it was pretty obvious as "elmedia" was easily identifiable. However, when looking at mine, there are some things which seem fairly common but I don't seem to be able to find any information about them in internet. For example, in my report I have a couple of (suspicious?) national instrument drivers called ni488k.

I think these logs give a good insight to detecting possible malware. The question is, how can I know which kernel modules should be there and which ones shouldn't?

  • Could you post the logs with all personal info removed? – PoisonNinja Aug 13 '14 at 22:40
2

A panic report isn't the right tool to investigate malware.

  1. Many crashes are coming from commercial and not evil conceived pieces of software. Some of them are coming from MacOS X directly. Crash doesn't mean malware.

  2. Most of the time you can't reproduce these crashes at will.

  3. To hide their tracks, most crapware will change their name as soon as activated.

  4. If the crapware wasn't active at the time of crash, their won't be any usefull information in a crash report.


The right tools to investigate for malware are :

  1. Tools to detect any system abnormal activity:

    Activity Monitor

    top

    netstat

    Little Snitch

    This command will show any program which might attempt to penetrate your firewall:

    tail -f /var/log/appfirewall.log

    ...

  2. Tools to detect abnormal components of the system:

    kextstat

    this command searches for all recent setuid bit files:

    find / -mtime -7 -perm +04000 -ls

    tripwire

    clamav, ClamXav

    chkrootkit

    ...


If finally you think something is suspicious within a panic report, try to investigate it with the above methods on the system alive. To check which modules should be there use kextstat. Save a copy of its output, check another day, check when you install a software asking you for your admin password, check when you notice an abnormal slow down.

1

Short answer is no — you have no guarantee that the malware hasn't removed a seldom-used genuine Apple kernel module and given itself the same name.

Malware is very good at hiding — often compromised Unix systems (such as OS X) get custom versions of system utilities that won't show the malware (see slides 39-41 here).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .