Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Yosemite malware?

M

macmacmacr

macrumors regular
Original poster
Dec 23, 2014
152
5
I have Yosemite 10.10.5 and I am certain that my Mac has malware which allows data to be removed from my system.

Some examples are when I go to a web site like IBM.ca to register and look for positions my log in IBM acount has been removed.
another example is when I user Firefox it would not remove an email account even though I erased the browser cache and performed a refresh to default option found in "troubleshooting Informaiton"

I would like to know if anyone has a method to verify the operating system. for example If I was to reinstall the Yosemite O.S. is there are SHA 512 hash I could perform on the the installation operating system or If I have no open applications what processes should the system have running?

Thanks
 
If you obtain the 10.10.5 installer from the App Store then it will verify itself with Apple, no further checks are needed. If you get it from elsewhere then all bets are off.
 
Not sure why you'd go anywhere else but apple for OS X, it's free with your mac, and about as trustworthy as you can get.
 
macmacmacr said:
I would like to know if anyone has a method to verify the operating system. for example If I was to reinstall the Yosemite O.S. is there are SHA 512 hash I could perform on the the installation operating system or If I have no open applications what processes should the system have running?
Click to expand...

If you download the OS from the App Store it has a hash inside the DMG that verifies itself before it runs. But as far as running some sort of hash against the installed OS, I can't think of an easy way to do that. I suppose you could compare the hash for things like mach_kernal and different system files to known good copies.

Try this... install and run the app Etrecheck once. That will create an anonymized report of everything running on your system as well as list any launch/startup items. Post that report here for us to take a look and we can tell you if there is anything third party running that looks suspicious.
 
Is there no windows type SFC program for OS X? SFC verifies all the core OS files are intact for windows.
 
Apple provides SSH for some of its updates as well as PGP authentication "http://support.apple.com/kb/HT1620" It is not good enough to download a Operating system and say its OK because it installs.

Since Mountain lion the activity monitor displays the incorrect total processes %, showing values over 100% This suggest a hidden process and it has not been corrected in Yosemite. Another strange omission is that Apple updates in snow leopard allowed a user to easily obtain all installed updates in the operating system. Mountain Lion to Yosemite do not have this option.

simonsi said:
If you obtain the 10.10.5 installer from the App Store then it will verify itself with Apple, no further checks are needed. If you get it from elsewhere then all bets are off.
Click to expand...
 
macmacmacr said:
Apple provides SSH for some of its updates as well as PGP authentication "http://support.apple.com/kb/HT1620" It is not good enough to download a Operating system and say its OK because it installs.
Click to expand...

That is because those updates can be downloaded outside the App Store from an Apple web page. But App Store downloads do the have the embedded hash I mentioned and are safe.

What you can do is DL the OS installer then compare the SHS hash to what others are reporting on the Internet. If others are reporting the same hash as you, you have some assurance the installer is intact.

a673c2c6d967f4da2934b7d6cf3736936970b194

I found a post that says this is the SHA hash for Yosemite 10.10.2. If you Google that string you will find quite a few posts on various forums reporting the same thing.

I think that is a close as you are going to get for what you are after.
 
macmacmacr said:
Since Mountain lion the activity monitor displays the incorrect total processes %, showing values over 100%
Click to expand...

It is possible to get over 100% with the new intel processors, the turbo modes and multi-cores make it not so simple to judge where 100% should be.
 
Weaselboy said:
That is because those updates can be downloaded outside the App Store from an Apple web page. But App Store downloads do the have the embedded hash I mentioned and are safe.

What you can do is DL the OS installer then compare the SHS hash to what others are reporting on the Internet. If others are reporting the same hash as you, you have some assurance the installer is intact.

a673c2c6d967f4da2934b7d6cf3736936970b194

I found a post that says this is the SHA hash for Yosemite 10.10.2. If you Google that string you will find quite a few posts on various forums reporting the same thing.

I think that is a close as you are going to get for what you are after.
Click to expand...
Ahhh yes. I am aware of this but what I would expect is Apple provides this information so everyone without searching can say SHAxx value matches Apples value
 
simonsi said:
Others have been known to provide installers via torrents, sometimes with their own little "extras" thrown in...
Click to expand...
How do you know when you go to Apple store your machine hasn't been redirected to another miscellaneous site?
 
macmacmacr said:
How do you know when you go to Apple store your machine hasn't been redirected to another miscellaneous site?
Click to expand...

Provenance. ie the App store code and my OSX came from Apple and was verified, subsequent downloads are verified so if one was intercepted that verification would fail. Once you download OSX or a component from elsewhere that provenance is broken and all bets are off. Apple does not want you getting its code from elsewhere (why would they), so no need to provide the hash. Once a download has been verified there is no need to verify the installed code, where would a discrepancy come from if by definition NOT included in the verified download???
 
macmacmacr said:
How do you know when you go to Apple store your machine hasn't been redirected to another miscellaneous site?
Click to expand...

Don't download OS X .torrents in the first place?

You'd know,, your web browser would open... Apple would ask you with pop up to verify install of such malware, if getting it from the web. which i hope u wouldn't enter your password for.

If anything need to be called from the internet to take control it must be installed, thus the user must enter their password, if they do that anyway, then all security bets are off, your on ya own. as u accepted it.

As far as i know there is no way around Apple's popup. unlike Windows where u could "in theory" provide a some fake UAC, u cannot do that on a mac... its a genuine Apple dialog. unless the OS X itself was malicious, which means u never got it from a trusted source like the App Store in the first place.

If u stick to Apple's methods, then it secure, but outside of that, your left to defend for yourself.
 
  • Like
Reactions: simonsi
There are places like China that do have the power to intercept and redirect you without the mac knowning (great firewall and canon).

Earlier this year they hijacked the facebook.js files to re-route users to anti-China sites. It would be very simple for them to detect an app store request or IP and you end up downloading for not Apple. Very unlikely in any other part of the world.
 
Any ISP can theoretically redirect in this way, however outside China/Korea highly unlikely to be done.
 
Ok, I'll correct that: There are places like China that do intercept and redirect you without the mac knowning (great firewall and canon).
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back