5 ms·

No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and op

No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only a backdoor. Not a rootkit.

takeda 10y ago
rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.
- stcredzero 10y ago
  rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 online when Red Hat 7 was out.) (that's where the name comes from root = admin on unix) The fact that you think this is something that bears explaining is interesting in the context of HN. I hope this is based on something you've noticed about recent user trends here. There was a time when someone would be very surprised if a user here didn't already know this.
  - caf 10y ago
    Right. a "rootkit" was a kit of tools you deploy once you have obtained root (on someone else's server).
    - cmdrfred 10y ago
      I always thought of them as a way to gain root. As in privilege escalation.
      - detaro 10y ago
        A rootkit might come with tools for that, but the actual rootkit generally requires you having root (or some other privileged role) to deploy it. E.g. a Linux rootkit commonly is a kernel module, which you can only load if you have already obtained root privileges.
  - Whitestrake 10y ago
    > It also commonly referred to such kits being used by hostile parties. I suspect that's exactly what he means - a rootkit is deployed by an intruder so that when the admin discovers the host has been compromised and patches the vulnerability, the rootkit, if not addressed, will grant the intruder root capabilities once more.
  - takeda 10y ago
    I see my response was ambiguous. Of course I meant rootkit was always malicious. It was used by intruder to gain root back after admin though he restored the host after being hacked. Rootkits are the reason why it is recommended to wipe the whole system after being hacked, because you can't be sure there there wasn't anything installed.
kbenson 10y ago
Whether the terminology is technically correct or not, I think it's obvious that it can easily be interpreted in different ways, some of which are incorrect. As such, while it may not be wrong, it is poorly chosen, and may be misleading. A better way to phrase it might have been "A sophisticated backdoor targeting OS X discovered".
- markcerqueira 10y ago
  > "A sophisticated backdoor targeting OS X discovered" Unsure how this clears up the rootkit versus backdoor confusion...
  - greenshackle 10y ago
    It doesn't, it clears up the 'this was put in by Apple' confusion.
    - kbenson 10y ago
      Yes, that's exactly what I was trying to address. I should have quoted the first sentence of the parent to make that obvious, since there were a few assertions in that comment.
seandougall 10y ago
Calling it a backdoor may be correct, but calling it an "OS X backdoor", particularly with no other context in the title, is not. It's merely clickbait.
- smsm42 10y ago
  Yes, I concluded from the title it's backdoor in OS X itself (which would be huge news), not merely a backdoor kit running on OS X (which is not really all that notable, absolutely no surprise that backdoor kits exist for OS X and this one is nothing special among them as it seems).
superuser2 10y ago
Backdoor is a politically loaded term at this point. Backdoors (in privacy-related discourse) are vulnerabilities inserted intentionally by the manufacturer or government with supply-chain cooperation. The claim "Backdoor found in X's product" is roughly equivalent to the claim "Evidence found that X is a collaborator with the surveillance state" to many people, so we might want to be careful about throwing it around when we don't mean that.
- oso2k 10y ago
  At least for me, there is a distinction between a Phone Home capability and a Backdoor.
- saurik 10y ago
  That is different wording. One can find an OS X backdoor in Microsoft Word, for example. Here the OS X backdoor was found not in OS X but in some other program.
random55643 10y ago
Let's call it "a window with a shitty lock" instead of a "back door", if it's an unintentional vulnerability. Then we can just use "back door [left open]" to mean something intentional. Or, you know "key under a rock in the garden" because only certain people know where it is. Actually, I think that's where "Window( with a )S(hitty lock)" 95 first got it's name.

takeda 10y ago

rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.

stcredzero 10y ago
rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 online when Red Hat 7 was out.) (that's where the name comes from root = admin on unix) The fact that you think this is something that bears explaining is interesting in the context of HN. I hope this is based on something you've noticed about recent user trends here. There was a time when someone would be very surprised if a user here didn't already know this.
- caf 10y ago
  Right. a "rootkit" was a kit of tools you deploy once you have obtained root (on someone else's server).
  - cmdrfred 10y ago
    I always thought of them as a way to gain root. As in privilege escalation.
    - detaro 10y ago
      A rootkit might come with tools for that, but the actual rootkit generally requires you having root (or some other privileged role) to deploy it. E.g. a Linux rootkit commonly is a kernel module, which you can only load if you have already obtained root privileges.
- Whitestrake 10y ago
  > It also commonly referred to such kits being used by hostile parties. I suspect that's exactly what he means - a rootkit is deployed by an intruder so that when the admin discovers the host has been compromised and patches the vulnerability, the rootkit, if not addressed, will grant the intruder root capabilities once more.
- takeda 10y ago
  I see my response was ambiguous. Of course I meant rootkit was always malicious. It was used by intruder to gain root back after admin though he restored the host after being hacked. Rootkits are the reason why it is recommended to wipe the whole system after being hacked, because you can't be sure there there wasn't anything installed.

kbenson 10y ago

Whether the terminology is technically correct or not, I think it's obvious that it can easily be interpreted in different ways, some of which are incorrect. As such, while it may not be wrong, it is poorly chosen, and may be misleading. A better way to phrase it might have been "A sophisticated backdoor targeting OS X discovered".

markcerqueira 10y ago
> "A sophisticated backdoor targeting OS X discovered" Unsure how this clears up the rootkit versus backdoor confusion...
- greenshackle 10y ago
  It doesn't, it clears up the 'this was put in by Apple' confusion.
  - kbenson 10y ago
    Yes, that's exactly what I was trying to address. I should have quoted the first sentence of the parent to make that obvious, since there were a few assertions in that comment.

seandougall 10y ago

Calling it a backdoor may be correct, but calling it an "OS X backdoor", particularly with no other context in the title, is not. It's merely clickbait.

smsm42 10y ago
Yes, I concluded from the title it's backdoor in OS X itself (which would be huge news), not merely a backdoor kit running on OS X (which is not really all that notable, absolutely no surprise that backdoor kits exist for OS X and this one is nothing special among them as it seems).

superuser2 10y ago

Backdoor is a politically loaded term at this point. Backdoors (in privacy-related discourse) are vulnerabilities inserted intentionally by the manufacturer or government with supply-chain cooperation. The claim "Backdoor found in X's product" is roughly equivalent to the claim "Evidence found that X is a collaborator with the surveillance state" to many people, so we might want to be careful about throwing it around when we don't mean that.

oso2k 10y ago
At least for me, there is a distinction between a Phone Home capability and a Backdoor.
saurik 10y ago
That is different wording. One can find an OS X backdoor in Microsoft Word, for example. Here the OS X backdoor was found not in OS X but in some other program.

random55643 10y ago

Let's call it "a window with a shitty lock" instead of a "back door", if it's an unintentional vulnerability. Then we can just use "back door [left open]" to mean something intentional. Or, you know "key under a rock in the garden" because only certain people know where it is. Actually, I think that's where "Window( with a )S(hitty lock)" 95 first got it's name.