ESET Rootkit Detector is an application that will scan your Mac running OS X for rogue kernel extensions that exploit vulnerabilities that might be used to change system behavior. It allows you to check your Mac for rootkits in one click. What is a rootkit?
ESET Rootkit Detector verifies that your operating system is functioning normally and checks for evidence of potentially malicious changes to the kernel.
2009: The proof-of-concept Machiavelli rootkit targets macOS (then called Mac OS X), demonstrating that Macs are vulnerable to rootkits too. 2010: The Stuxnet worm, allegedly co-developed by the US and Israel, uses a rootkit to conceal its presence as it is unleashed on Iran’s nuclear program. Your computer’s bootloader is an important tool. It loads your computer’s operating system when you turn the machine on. A bootloader toolkit, then, attacks this system, replacing your computer’s legitimate bootloader with a hacked one. This means that this rootkit is activated even before your computer’s operating system turns on.
The number of rootkits targeting OS X has increased noticeably in the last year. One example of this is OSX/Crisis (OSX/Morecut). This rootkit is used to spy on and steal information from Mac OS X machines. Although these threats exist, there has not been a way for users to protect themselves from threats for which a virus signature does not exist. ESET Rootkit Detector provides a user-friendly way to check the integrity of the kernel memory and informs you of any potential problems.
OS X Snow Leopard (10.6.0) through Mountain Lion (10.8.x) are supported by ESET Rootkit Detector. The application works on Intel 32-bit and 64-bit processors.
OS X Mavericks (10.9) is not currently supported.
Download the ESET Rootkit Detector
Rootkits are malicious software that gives hackers the full administrator rights of your PC. It helps hackers in changing or altering the system settings or files the way an administrator could do. It creates a backdoor for other users to log in and provides full access to the system.
The rootkit is derived from two words Root and Kit. The Root is referred to as a full access user account in the Unix based operating systems. While the Kit word represents as a collection of tools. Meaning a collection of tools to access the root account.
Initially, the rootkit was developed as legitimate software. The developers of the operating system intended to use it as backdoor access to fix the software issues at a later stage. Unfortunately, now the rootkit is primarily used for illicit activities such as hacking.
The attackers could plant the rootkit in fake software to enter in your system, or they can directly attack the operating system and install the rootkit after getting access to the administrator account. Their primary objective is to get the access of the system without locking it down and getting detected. Rootkit help them to do that.
Rootkit gives the full access rights meaning they could even alter the program that is supposed to catch it so that it can hide in the plain sight. Your antivirus will tell you everything is Okay, while the hackers could access your system.
The first rootkit is believed written in 1990 by Lane Davis and Riley Dake. It was written for the Sun operating system which was based on Unix architecture. The first public Windows rootkit was NTRootkit appeared in 1999 written by Greg Hoglund. The first rootkit on the Mac OS appeared in 2009.
Since the first rootkit, there have been several advanced rootkits developed.
A rootkit is primarily used for malicious activities like stealing confidential information such as password and credit card information. It is also used to enhance the security of the computer system by the users.
There are several types of rootkits that have different purposes.
Such rootkits operate on the application level. They are intended to replace the files of the application to modify them. It could also inject the code in the applications to change their behavior.
Such rootkits operate with the highest system privileges. They could add or replace the core system files. Such rootkits are difficult to detect as they can change almost anything to avoid detection.
It changes the startup of the operating system by modifying MBR, VBR, or boot sector. The Bootkit is used to load the rootkit before the operating system start. It also operates at the kernel level and can be used to access the full disk encryption devices.
Memory rootkits operate from system memory. Such rootkits perform the payload from the RAM and hide there to avoid the detection.
Such rootkits use the firmware or the hardware to attack. It could be in the BIOS, network card, or in the router. Firmware codes are not usually checked for infections, and that’s how they avoid the detection. Such rootkits are hard to remove as they come back even after re-installing the operating system. Only, detecting the hardware and replacing it is a solution.
Rootkits use several strategies to enter in your system. The attacker could exploit a system vulnerability, or lure you with fake software, or can install rootkits physically.
Hackers take advantage of the security vulnerability to infect the user’s computer. This vulnerability could be in the operating system or the applications. To protect yourself always install the security patches and updates to your OS and applications.
Attackers could use the trojan horse to infiltrate your system. They could decoy the rootkit as a legitimate software that has unique benefits. Hackers use social engineering methods to infect users with this method. To avoid getting infected, we should not install software from untrusted sources.
Attackers could infect your computer with rootkits, in case they have physical access to your device. Such methods are used to deploy the kernel rootkits and bootkit.
In some cases, the owner itself install rootkits in their device to obtain some task like monitoring the employees.
Since the detection of rootkits is not easy, several techniques can be used all together to catch the culprit.
In this method, the behavior of programs are analyzed, and if they take actions like rootkits, they are detected. The action depicts when there is a change in system files, differences in the timing and frequency of API calls, or considering the overall CPU utilization.
Antivirus analyses the signature of the programs and detects the rootkits if its signature matches from the database. This strategy is beneficial catching known and well-published rootkits but won’t work in case if the rootkit is new and custom made.
In this method, the difference in the data returned by an API is calculated. It checks the difference between trusted raw data and tainted content. Such a mechanism was used by Russinovich’s RootkitRevealer tool. It was used to detect the Sony DRM Rootkit.
This method checks the system files for modifications since the installation. A cryptographic hash function can be used to create the fingerprint at the installation time, and it helps to know when a system change occurs. The fingerprint should be recreated in case of a system update.
This method of detection is reliable in case of kernel rootkits that gets loads up before the operating system loads. It is done by booting from a different medium and then analyzing the storage for rootkits. This method works excellent because rootkits couldn’t hide if it is not running.
Below are some easy to use rootkit removal tools.
Malwarebytes Anti-rootkit beta is a specially designed tool for removing the rootkits. It removes the rootkits and also repairs the damage. It works amazing and removes the deeply embedded rootkits.
TDSSKiller is a free tool developed by famous Kaspersky lab. This tool only detects and removes the rootkits. It won’t work in removing other malware. TDSSKiller removes bootkits, Win32.TDSS malware, and several other rootkits.
chkrootkit is an anti-rootkit tool for the Linux operating system. It has several tools that check the presence of rootkit in the system locally.
MalwareFox antimalware works on signature and behavioural analysis method to detect malware including rootkits. It is a lightweight and easy to use antimalware.