DHS (Dylib Hijack Scanner) lets you find applications that are currently hijacked or are susceptible of being hijacked. For this purpose, the tool inspects dynamic libraries present in your system. Even if you do not understand what this tool is about, it is extremely easy to use and lets you identify serious malware threats with practically no effort.
When you click on the “Start Scan” button, the application runs two scripts that are specifically intended to check running processes as well as binary files on your disk. If they contain weak import or multiple run-path search paths, they are reported either as hijacked or vulnerable. Unfortunately, the app does not make any kind of recommendations as to what you should do with these items. Instead, you are taken to their location for you to take action.
There are also a few very simple settings you may want to consider. For instance, you can run full system scans and detect weak hijacks. Likewise, you can save the results to a text file for future reference or consultation.
In general, DHS is a simple application with a very narrow target. However, since dynamic library hijacking is still recent in macOS, most antivirus tools cannot find this type of issue. Therefore, it is recommendable to have an app like DHS at hand. Fortunately, the product is both very light and free, so there is nothing to lose and much to gain.
Comments