Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I am trying to secure a Mac after discovering that network links are being established to some unwanted internet sites.

Using 'lsof -i' (list open 'files', internet) I have seen that launchd, ntpd, firefox, dropbox and other processes are either 'LISTENING' or have 'ESTABLISHED' links to a site or sites which I suspect have to do with spyware. I have been trying to find startup files and preference lists that initiate thise links but can't find them. I could easily reinstall the OS and restore data from a backup but I'd prefer to know how to fix this as I have six Macs to look after.

Thanks...

share|improve this question
What is it about these sites that makes them suspect? – Richard Hoskins Sep 22 '09 at 13:49
I researched the three sites (on different machines) via the internet and found that they are all suspect - either adware or possibly spyware. All I would like to do is find what config file and/or process on the Mac starts the link to each site. – TT Sep 22 '09 at 14:22
As soon as I detected each instance, I made the hosts file point to 127.0.0.1 for the respective sites and blocked them on the DNS I use. Sno Leopard's Firewall does not seem to allow for biocking IPs - at least I'm not sure how to do it. This is where my unix sysadmin knowledge starts to wane.... I guess it has been like this for a long time because I only just thought of looking at this recently. One of the sites, apparently, has already been shut down as of Nov 2008 but one of the Macs still 'LISTENS' for it... – TT Sep 22 '09 at 14:30
This sounds confused; LISTEN means your Mac is listening for an incoming connection, and isn't associated with any particular remote computer; instead, lsof will report which of your computer's IP addresses the program is listening on (or "*", meaning all ports). This can be a bit confusing, since lsof tries to display names rather than numeric IP address, and it can give misleading results if (for example) you have a lot of names mapped to 127.0.0.1 in /etc/hosts. Try lsof -i -n to get raw IPs instead. – Gordon Davisson Sep 22 '09 at 17:36
Gordon, thanks for your suggestion to use the '-n' option. It confirmed that the 'ESTABLISHED' connections were the re-mapped IPs I put in the hosts file i.e. to 127.0.0.1. So, at least I know that it is definitely not talking outside anymore. Now all I would like to do is to find out what unix OS config files are involved in launching these attempted connections. That is the problem I am trying to solve. – TT Sep 23 '09 at 15:02
show 1 more comment

3 Answers

up vote 1 down vote

If your are bothered enough to pay for a solution, you might like Little Snitch, which is an outgoing firewall.

share|improve this answer
Thanks for that. Actually what I'm trying to find out is what OS config files are involved in launching the attempted connections... It's preferable to stop the problem at source, especially if it is being launhed by system processes that have superuser rights... – TT Sep 23 '09 at 14:55
up vote 0 down vote

Although it is not trivial, DTrace can be used to help track down where the connection is made if you are willing to write a small D script. Look up anonymous tracing if you need to trace while the system is starting up. You can have it look for a call to connect to the address in question and then capture the user stack trace, for example. (You might want to change the address to 127.0.0.2 in your hosts database so that you have a unique address to match.) You could also trace the file accesses that occur before then. If that is too much data, DTrace speculative tracing would allow you to tentatively trace each file access and commit the most recent trace data once a connection is made.

If the connections are being made by spyware, the information such as host names may be hardcoded into the program and not in a preference file. It would also likely be obfuscated in such a way to make it difficult to track down.

share|improve this answer
up vote 0 down vote

It's one step removed, but all process which run run automatically on OS X are run by launchd. You can use the launchctl command line tool list the tasks it knows about. This Apple article on launchd lists it's configuration directories, where tasks are defined.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.