On 2/3/07, frozenINcarbonite <adr
...@gosquareone.com> wrote:
> I was just wondering. If one of these remote vulnerabilities were
> exploited on a user's machine, would reinstalling OS X fix the
> problem. I guess wiping out everything would be the best thing to do
> so that any malicious code or backdoors would be erased.
Not unless by "reinstall" you mean formatting the drive. Just
overwriting the OS X files wouldn't be sufficient to clean the system
off. As long as the home directory is in tact, the user account will
still be just as compromised as it was before, and commands can be
executed to try to escalate privilege again.
There are a variety of methods for the escalation, one that has been
mentioned recently is putting a directory of malware in $PATH before
the normal directories and replacing "sudo" or "ssh" with something
that steals the credentials while otherwise behaving normally.
All this should just serve as additional caution to be careful what
you click on and download since it may not always be trustworthy.
--
wac
|
