# I have a backdoor in my OS X? This is what I found in my bash history

**URL:** <https://community.unix.com/t/i-have-a-backdoor-in-my-os-x-this-is-what-i-found-in-my-bash-history/352047>\
**Category:** macOS\
**Created:** [April 17, 2015, 11:42pm UTC](https://community.unix.com/t/i-have-a-backdoor-in-my-os-x-this-is-what-i-found-in-my-bash-history/352047 "2015-04-17T23:42:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonathansmith](https://community.unix.com/letter_avatar/jonathansmith/32/5_5575768a8748004e209b776fc1b2916d.png) [@jonathansmith](https://community.unix.com/u/jonathansmith)\
**Post date:** [April 17, 2015, 11:42pm UTC](https://community.unix.com/t/i-have-a-backdoor-in-my-os-x-this-is-what-i-found-in-my-bash-history/352047/1 "2015-04-17T23:42:28Z")

</div>

That's what appears at the beginning of my bash history (when you type "open .bash\_history" in terminal)

```nohighlight
sudo -k
export PS1="";sudo echo AUTHENTICATED;echo RETRY
exit
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo ls;sudo -k;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo ls;sudo -k;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SHarvest;exit;echo DONEXT

```

I also would love to use an open source Operational System, but I'm really not skilled at it... ☹ So have to use OS X, which is by itself is full of NSA backdoors ☹

---

<div class="post-metadata">

**Author:** ![Scrutinizer](https://community.unix.com/user_avatar/community.unix.com/scrutinizer/32/1216_2.png) [@Scrutinizer](https://community.unix.com/u/Scrutinizer)\
**Post date:** [April 18, 2015, 1:10am UTC](https://community.unix.com/t/i-have-a-backdoor-in-my-os-x-this-is-what-i-found-in-my-bash-history/352047/2 "2015-04-18T01:10:10Z")

</div>

How do you reckon that could be a backdoor? Because of the strange looking string?

```nohighlight
echo $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'
/Applications/FileSalvage.app/Contents/Resources

```