How to Install RkHunter for Rootkit/Trojan Scanning

<div dir="ltr" style="text-align: left;" trbidi="on"> <h2 style="background-color: white; box-sizing: border-box; font-family: Raleway, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 30px; line-height: 1.1; margin-bottom: 10px; margin-top: 20px;"> <u><span style="color: #990000;">Install RkHunter for Rootkit/Trojan Scanning</span></u></h2> <div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. It does this by comparing SHA-1 hashes of important files with known good ones in online databases, searching for default directories (of rootkits), wrong permissions, hidden files, suspicious strings in kernel modules, and special tests for Linux and FreeBSD.</span></span></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9WmIkraUjyiCVITCByQUNHuPlfMMaExYHynuVl4zEqXtQ0SSuSZYJ_QsThdhHC1KG6Rk6aO6CcYLxVfUTgv8n_5qjC28-d4TR1k2nwb9G9JyKtggTwi7rZEAs4zGpA5Msw9HSrAton3cL/s1600/rkhunter_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9WmIkraUjyiCVITCByQUNHuPlfMMaExYHynuVl4zEqXtQ0SSuSZYJ_QsThdhHC1KG6Rk6aO6CcYLxVfUTgv8n_5qjC28-d4TR1k2nwb9G9JyKtggTwi7rZEAs4zGpA5Msw9HSrAton3cL/s1600/rkhunter_hackthesec.co.in.png" /></a></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">The tool has been written in Bourne shell, to allow for portability. It can run on almost all UNIX-derived systems.</span></span></div> </div> <div> <pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="font-size: 12px; line-height: 15.6px;">$ wget http://space.dl.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz $ cd rkhunter-1.3.8 $ sh installer.sh</span></span></pre> </div> <div> <span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">To see the list of commands which can be executed use: the command below:</span></span></div> <div> <pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="font-size: 12px; line-height: 15.6px;">$ rkhunter –help</span></span></pre> <pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace;"><span style="font-size: 12px; line-height: 15.6px;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></span></pre> </div> </div>

How to Install RkHunter for Rootkit/Trojan Scanning

Install RkHunter for Rootkit/Trojan Scanning rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and poss...

Read more »

Apple's Mac OS X Still Open to Malware, Thanks Gatekeeper

<div dir="ltr" style="text-align: left;" trbidi="on"> <span style="color: blue; font-family: Georgia, Times New Roman, serif; font-size: large;"><b><u>Apple's Mac OS X Still Open to Malware, Thanks Gatekeeper</u></b></span><br /> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> Apple Mac Computers are considered to be much safer than Windows computers at keeping out the viruses and malware, but the new Exploit discovered by researchers again proves it indeed quite false.</div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmyIr2jdRXABJDiCd3GMiI5z0y81TEg608O3SSNDXj_0sr0EwhXG4_zyK2H446EXewAv1BA_EQEuemvunijHZMBQ0kJXnDTsFEbVfVyKQo1dml3_Tmc8lGmoQBl6VbY12GrMAkPU7RTdk/s1600/mac-os-x-gatekeeper-hack_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmyIr2jdRXABJDiCd3GMiI5z0y81TEg608O3SSNDXj_0sr0EwhXG4_zyK2H446EXewAv1BA_EQEuemvunijHZMBQ0kJXnDTsFEbVfVyKQo1dml3_Tmc8lGmoQBl6VbY12GrMAkPU7RTdk/s640/mac-os-x-gatekeeper-hack_www.hackthesec.co.in.png" width="640" /></a></div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> Last year, The Hacker News reported a deadly simple exploit that completely bypassed one of the core security features in Mac OS X known as <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Gatekeeper</b>.</div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> Apple released a patch in November, but now the same security researcher who discovered the original Gatekeeper bypass vulnerability said he found an equally obvious workaround.</div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> Patrick Wardle, ex-NSA staffer and head of research at security intelligence firm Synack, said the security patch released by Apple was "<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">incredibly weak</b>" and that the update was "<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">easy to bypass</b>" in minutes.</div> <div style="background-color: white; border: 0px; color: #222222; font-family: 'Open Sans', arial, Helvetica, sans-serif; font-size: 16px; font-stretch: inherit; line-height: 31px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;"> <h3 style="border: 0px; font-size: 1.4em; font-stretch: inherit; line-height: 35px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> Gatekeeper's Failure Once Again</h3> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> Introduced in July of 2012, Gatekeeper is Apple's anti-malware feature designed to block untrusted, dodgy apps from running, keeping Mac OS X systems safe from malware.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> However, the reality is slightly different, according to Wardle. Hackers can install malicious software on Mac computers, even when Gatekeeper is set to its most restrictive setting.</div> <blockquote class="tr_bq" style="border-left-color: rgb(232, 232, 232); border-left-style: solid; border-width: 0px 0px 0px 5px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 10px; quotes: none; vertical-align: baseline;"> <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"Even on a fully-patched OS X 10.11.2 system, Gatekeeper is trivial to bypass," </i>Wardle wrote in a <a href="https://www.synack.com/2016/01/15/synack-s-shmoocon/" rel="nofollow" style="border: 0px; color: #1177b8; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">blog post</a>. <i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">"So hackers can (re)start their trojan distributions while nation states can get back to MitM’ing HTTP downloads from the internet."</i></blockquote> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> In September, Wardle realized that before allowing any apps to execute on an OS X machine, Gatekeeper performs a number of checks, such as:</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> </div> <ul style="border: 0px; font-stretch: inherit; margin: 20px 20px 20px 35px; outline: 0px; padding: 0px 0px 0px 5px; vertical-align: baseline;"> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Checking the initial digital certificate of a downloaded app</li> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Ensuring the app has been signed with an Apple-recognized developer certificate</li> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Ensuring the app has been originated from the official App Store</li> </ul> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> But, what Gatekeeper fails to check is – whether the app already trusted by OS X runs or loads other files from the same folder.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> However, in the name of a security patch, all Apple did was simply blacklist the signed apps Wardle was abusing to bypass Gatekeeper, rather than fixing the underlying problem.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <h3 style="border: 0px; font-family: inherit; font-size: 1.4em; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 35px; margin: 0px; outline: 0px; padding: 0px; text-align: left !important; vertical-align: baseline;"> How to Bypass Gatekeeper in OS X?</h3> </div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> This was not effective in preventing attacks. Wardle found a new Apple-signed file that allow him to do the same. Notably, the file was offered by the popular anti-virus firm Kaspersky Labs.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> All Wardle has done is:</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /><ul style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 20px 20px 20px 35px; outline: 0px; padding: 0px 0px 0px 5px; vertical-align: baseline;"> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Identified an already-signed binary file (<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Binary A</b>) that runs a separate app (<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Binary B</b>) located in the same folder</li> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Renamed <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Binary A</b></li> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Swapped out the legitimate <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Binary B</b> with a malicious one</li> <li style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Then bundled malicious file in the same folder under the same file name, <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Binary B</b></li> </ul> </div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> Now, Binary B needs no digital certificate or Apple developer certificate to run, so it can be used to install anything the attacker wants, completely bypassing Gatekeeper.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> Wardle notified Apple about his latest finding, and the company rolled out an update blocking the new files Wardle privately reported it, which is not a right approach. Apple should come up with a more comprehensive fix to address the issue.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <h3 style="border: 0px; font-family: inherit; font-size: 1.4em; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: 35px; margin: 0px; outline: 0px; padding: 0px; text-align: left !important; vertical-align: baseline;"> How to Protect Yourself?</h3> </div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> In the meantime, Wardle suggested Mac users to only download software from the Mac App Store and be more careful while downloading apps from the internet.</div> <div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> <br style="content: ' '; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div> Wardle will be presenting his findings at the<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> Shmoocon conference in Washington D.C </i>this weekend. He also released a complementary tool for Gatekeeper on Friday, a free tool dubbed<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><a href="https://objective-see.com/products/ostiarius.html" rel="nofollow" style="border: 0px; color: #1177b8; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">Ostiarius</a></b>, that checks all file executions and blocks untrusted, unsigned code originating from the Web. </div> </div>

Apple's Mac OS X Still Open to Malware, Thanks Gatekeeper

Apple's Mac OS X Still Open to Malware, Thanks Gatekeeper Apple Mac Computers are considered to be much safer than Windows computers ...

Read more »