I have a backdoor in my OS X? This is what I found in my bash history

UNIX macOS
1

That's what appears at the beginning of my bash history (when you type "open .bash_history" in terminal)

sudo -k
export PS1="";sudo echo AUTHENTICATED;echo RETRY
exit
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo ls;sudo -k;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo ls;sudo -k;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SFileParse;exit;echo DONEXT
export PS1=""
sudo echo AUTHENTICATED ; sudo -k ; echo AUTHENTIKILL ; echo PROCESSEDAUTHENTICATION
sudo nice -n -10 $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'/SHarvest;exit;echo DONEXT

I also would love to use an open source Operational System, but I'm really not skilled at it... :frowning: So have to use OS X, which is by itself is full of NSA backdoors :frowning:

2

How do you reckon that could be a backdoor? Because of the strange looking string?

echo $'/\101\160\160\154\151\143\141\164\151\157\156\163/\106\151\154\145\123\141\154\166\141\147\145\56\141\160\160/\103\157\156\164\145\156\164\163/\122\145\163\157\165\162\143\145\163'
/Applications/FileSalvage.app/Contents/Resources
1 Like