Recently one of the linux servers that I access was compromised to steal passwords and ssh keys using a modified ssh binary. This lead me to question if the attacker had compromised my OSX Laptop which had ssh access turned on. A sophos virus scan turned up nothing, and I did not have rkhunter installed before the attack, so I could not compare hashes of the system binaries to be sure. However because OSX is relatively standard for each of their major releases, I asked fiends for md5 hashes md5 /usr/bin/ssh and md5 /usr/sbin/sshd as a basic first check to see if there was anything different about my machine. A few emails later I have found the following data:

    Version  (Arch) [N]               MD5 (/usr/bin/ssh)             MD5 (/usr/sbin/sshd)
OSX  10.5.8   (PPC) [3] 1e9fd483eef23464ec61c815f7984d61 9d32a36294565368728c18de466e69f1
OSX  10.5.8 (intel) [5] 1e9fd483eef23464ec61c815f7984d61 9d32a36294565368728c18de466e69f1
OSX  10.6.x (intel) [7] 591fbe723011c17b6ce41c537353b059 e781fad4fc86cf652f6df22106e0bf0e
OSX  10.6.x (intel) [4] 58be068ad5e575c303ec348a1c71d48b 33dafd419194b04a558c8404b484f650
Mine 10.6.6 (intel)     df344cc00a294c91230c65e8b7332a79 b5094ccf4cd074aaf573d4f5df75906a

where N is the number of machines with with that MD5, and the last row is my laptop. The sample is relatively heterogeneous spaning a few years of different makes and models of Apples, and different versions of 10.6.x. The different hash for my system made me worried that these binaries might have been compromised. So I made sure that my backup for the week was good, and dived into formatting my system and reinstalling OSX.

After reinstalling OSX from the manufacturer DVD, I found that the MD5 hash did not change for either ssh, or sshd.


Make sure that my system is does not have any malicious software. Should I be worried that this base install of OSX (with no other software installed) has been compromised? I have also updated my system to 10.6.6 and found no change as well.

Other Information

I am not sure if this is helpful information, but my laptop is a i7 15 inch MacBook Pro bought in Nov 2010, and here is some output from system_profiler:

    System Software Overview:

      System Version: Mac OS X 10.6.6 (10J567)
      Kernel Version: Darwin 10.6.0
      64-bit Kernel and Extensions: No
      Time since boot: 1:37


    Hardware Overview:

      Model Name: MacBook
      Model Identifier: MacBook6,2
      Processor Name: Intel Core i7
      Processor Speed: 2.66 GHz
      Number Of Processors: 1
      Total Number Of Cores: 2
      L2 Cache (per core): 256 KB
      L3 Cache: 4 MB
      Memory: 4 GB
      Processor Interconnect Speed: 4.8 GT/s
      Boot ROM Version: MBP61.0057.B0C
      SMC Version (system): 1.58f16
      Sudden Motion Sensor:
          State: Enabled

On the laptop, I find:

$ codesign -vvv /usr/bin/ssh
/usr/bin/ssh: valid on disk
/usr/bin/ssh: satisfies its Designated Requirement
$ codesign -vvv /usr/sbin/sshd
/usr/sbin/sshd: valid on disk
/usr/sbin/sshd: satisfies its Designated Requirement
$ ls -la /usr/bin/ssh
-rwxr-xr-x  1 root  wheel  1001520 Feb 11  2010 /usr/bin/ssh
$ ls -la /usr/sbin/sshd
-rwxr-xr-x  1 root  wheel  1304800 Feb 11  2010 /usr/sbin/sshd
$ ls -la /sbin/md5
-r-xr-xr-x  1 root  wheel  65232 May 18  2009 /sbin/md5


So far I have not gotten an answer about this question, but if you could help by increasing the number of hashes that I can compare against, that would be great. To get hashes, and version numbers, run the following on osx:

md5 /usr/bin/ssh
md5 /usr/sbin/sshd
ssh -V
  • What are the modification dates of both ssh and sshd? And are they properly codesigned? (Run codesign -vvv on both of them)
    – Asmus
    Feb 22 '11 at 0:48
  • I check both ssh, sshd, and md5 on the laptop, and on a different 10.6.6 machine, and have put the results above.
    – Alex
    Feb 22 '11 at 0:52
  • Well if you run codesign -d -vv on both and it returns (amongst others) Authority=Software Signing Authority=Apple Code Signing Certification Authority Authority=Apple Root CA then I guess everything should be okay (or else Apple´s Root CA would have to be compromised), but it´s still strange that your md5 sum fails…
    – Asmus
    Feb 22 '11 at 10:31
  • Just to play on the safe side: if you run md5 /sbin/md5 does it return 94dd237389823d38fc4183113099fb5a?
    – Asmus
    Feb 22 '11 at 10:42
  • Running codesign -d -vv on both the laptop and another 10.6.6 machine returns the same values for each of the lines. Also MD5 (/sbin/md5) = 94dd237389823d38fc4183113099fb5a for both of the machines. Finally, shasum is the same for both machines.
    – Alex
    Feb 22 '11 at 16:23
System Version: Mac OS X 10.6.3 (10J567)

This is weird. That build number should be 10.6.6. Did you complete the upgrade, including the restart?

  • Yep, sorry, I was keeping that machine off of the internet for now before I know it is safe, so it was a mistake in coping it over.
    – Alex
    Feb 22 '11 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.