Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor.
The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only a backdoor. Not a rootkit.
This would be malware inserting a back door for further exploitation.
In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They should have just said "malware".
Although I also assumed at first that it was vendor placed, even though I was familiar with backdoors from the past (Back Orifice, Sub7 etc)
As far as I can read from the article they discuss what happens if you are infected.
Also, isn't running binary files on OS X from let's say "Finder" automatically triggers Security alert ( like App-vendor lock )?
The software described would usually be classified as an Advanced Persistent Threat [1] or Rootkit [2] Backdoor [3] usually refers to methods to sidestep authentication added by the vendor.
1: https://en.wikipedia.org/wiki/Advanced_persistent_threat
2: https://en.wikipedia.org/wiki/Rootkit
3: https://en.wikipedia.org/wiki/Backdoor_(computing)From https://en.wikipedia.org/wiki/Rootkit:
> The modified compiler would detect attempts to compile the Unix login command and generate altered code that would accept not only the user's correct password, but an additional "backdoor" password known to the attacker...This exploit was equivalent to a rootkit.
From https://en.wikipedia.org/wiki/Advanced_persistent_threat:
> Establish Foothold – plant remote administration software in victim's network, create net backdoors and tunnels allowing stealth access to its infrastructure.
From https://en.wikipedia.org/wiki/Backdoor_(computing):
> A backdoor is a method, often secret, of bypassing normal authentication in a product, computer system, cryptosystem or algorithm etc. Backdoors are often used for securing unauthorized remote access to a computer, or obtaining access to plaintext in cryptographic systems.
I read all of that as a backdoor being an umbrella term, of which one type is a rootkit, and APTs create backdoors, perhaps of a type other than rootkit (e.g. net backdoor).
I agree that much software has terrible UI, but it's good to distinguish surface stuff from objectively terrible security decisions.
Malware, trojan, virus, rootkit, backdoor, squirglebunny (OK, I may have made that last one up).
There's not a lot of talk about the threat vector though - does anyone know how this infects systems?
From the article it seems to be via executable. That's why the terminology is important in this case. It's a executable rootkit that opens a backdoor, not a OS remote execution exploit. And this article relates to the OS X variant of a cross-platform package (so this affects Windows and Linux systems as well).
I hate to join in the terminology argument, but is it really a rootkit? After all, it doesn't (according to the reports) disguise its presence, which discards "rootkit" as a classification.
It seems to be pretty much run-of-the-mill malware. It would be interesting to understand the delivery mechanism (email, or whatever).
And if people will install untrusted third-party software, delivered by an untrustworthy mechanism, then they inevitably accept a certain amount of exposure.
In all seriousness, when a company releases a malware write-up, they typically imply that their software would have prevented it or will prevent it.
From what I can tell, they posted the SHA256 of the offending binary under the IOCs section of that web page. So you should be able to do this in the root of your home directory to detect if such a file exists:
# find . -type f -print0 | xargs -0 shasum -a 256 | grep 664e0a048f61a76145b55d1f1a5714606953d69edccec5228017eb546049dc8c
Title should be 'OS X Variant of Backdoor Discovered', shouldn't it?
"OS X variant of a cross-platform backdoor which is able to operate on all major operating systems (Windows,Linux,OS X). Please see also our analysis on the Windows and Linux variants."
Either the malware targeted very old versions of such software and/or OSX, or somebody between the malware author and the blog writer f###ed up.
Is it too new a threat? Outside the scope of my Malware app?
2. This is not specific to OS X, it affects many operating systems, so this sounds like an attempt at slandering software that someone doesn't like, or has a reason not to like.
We describe how to disable the LED on a class of Apple internal iSight webcams used in some versions of MacBook laptops and iMac desktops. This enables video to be captured without any visual indication to the user and can be accomplished entirely in user space by an unprivileged (non- root) application.
Yeah, a few years back studying MacBooks from 2008.
https://jscholarship.library.jhu.edu/bitstream/handle/1774.2...
Interestingly, on my battered, el cheapo Asus 12" netbook (2011 Intel Atom), this problem is solved very well: the on/off webcam switch physically blocks the webcam lens in the off state.
I'm guessing that is what the summary is referring to when it says "video capture", because there is no other reference to video or camera.
[0]https://developer.apple.com/library/ios/documentation/AVFoun...
If the LED == LED_TORCH, then it looks like it may be possible:
https://github.com/patjak/bcwc_pcie/blob/8cc44d67f3c924f30a8...
Either way, I'm planning on buying some spare parts to actually test and possibly PoC this.
In fact, it says it on this current page:
http://www.apple.com/business/mac/
"Because OS X is secure by design, there’s no need for IT to install additional tools or lock down functionality for employees. And with an automated zero-touch deployment process, they don’t even have to open the box."
"Secure by design" doesn't mean 100% secure no matter what. Part of that design is the update/patch process that addresses vulnerabilities quickly, and mitigating controls like lower default permissions and application signing.
The fact that you're so quick to call everyone an astroturfer because you made a ridiculous statement just proves that your only interest is trolling.