Hipster DFIR on OSX - Speaker Deck

Slide 1

Slide 1 text

Hipster DFIR on OSX Incident Response Tools So Cool You've Never Heard of Them

Slide 2

Slide 2 text

Who Am I? GitHub Since 2012 DFIR Since 2006 Mac User Since 1989 Curious Since 1983

Slide 3

Slide 3 text

Trust me! SOC’d Intel’d & DFIR’d @ Symantec Mandiant + Vigilant

Slide 4

Slide 4 text

My First Computer…

Slide 5

Slide 5 text

DFIR @ GitHub

Slide 6

Slide 6 text

Getting Started

Slide 7

Slide 7 text

Why Bother?

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

Market Share From MacRumors.com

Slide 13

Slide 13 text

Support is… “Meh”

Slide 14

Slide 14 text

On vs. On

Slide 15

Slide 15 text

A Bit About

Slide 16

Slide 16 text

Problems Location, OS, & Attitude

Slide 17

Slide 17 text

Problems Location, Platform, & Attitude Challenges

Slide 18

Slide 18 text

Location

Slide 19

Slide 19 text

Challenge: No Hands On

Slide 20

Slide 20 text

~100% OSX On the Desktop Platform

Slide 21

Slide 21 text

~100% Linux In the Datacenter Platform

Slide 22

Slide 22 text

Challenge: Limited Tools

Slide 23

Slide 23 text

Attitude Trust, Openness, & Transparency

Slide 24

Slide 24 text

Challenge: No Draconian Tactics

Slide 25

Slide 25 text

Bonus! We ❤ Open Source…

Slide 26

Slide 26 text

Concepts You’ll Need

Slide 27

Slide 27 text

Next* NS*

Slide 28

Slide 28 text

Its Unix w/ Windows And OSX

Slide 29

Slide 29 text

Plists

Slide 30

Slide 30 text

Property lists organize data into named values and lists of values using several Core Foundation types: CFString, CFNumber, CFBoolean, CFDate, CFData, CFArray, and CFDictionary. These types give you the means to produce data that is meaningfully structured, transportable, storable, and accessible, but still as efﬁcient as possible.

Slide 31

Slide 31 text

Binary*, XML, & JSON * Almost always the binary…

Slide 32

Slide 32 text

Year Of Birth 1965 Pets Names Picture PEKBpYGlmYFCPA== City of Birth Springﬁeld Name John Doe Kids Names John Kyra

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

Mach-O

Slide 35

Slide 35 text

HFS+

Slide 36

Slide 36 text

Kexts

Slide 37

Slide 37 text

GateKeeper & XProtect

Slide 38

Slide 38 text

Persistance Mechanisms

Slide 39

Slide 39 text

Persistance Mechanisms - cron jobs - Yup… just like basic Linux cron - No admin necessary

Slide 40

Slide 40 text

Persistance Mechanisms - cron jobs - kexts - OSX’s kernal extensions/modules - Needs admin privileges to install, but can do almost anything… - Defaults to: /System/Library/Extensions

Slide 41

Slide 41 text

Persistance Mechanisms - cron jobs - kexts - launchdaemons - The “common” way for admin level binaries to persist across reboots - launchd is the ﬁrst process and kicks off launch agents & daemons - Described by plist lauchd item

Slide 42

Slide 42 text

Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Deprecated… but still works! - Requires startup script & a plist in: - /Library/StartupItems - /System/Library/StartupItems - Starts up with operating system

Slide 43

Slide 43 text

Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Login Items - The “common” way for desktop userland applications to start up - User speciﬁc - User conﬁgurable without admin rights

Slide 44

Slide 44 text

Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout Hooks - Deprecated… but still works! - User speciﬁc - Just writes the script to execute to com.apple.loginwindow.plist and specify either LoginHook or LogoutHook

Slide 45

Slide 45 text

Persistance Mechanisms - OSX “helps” you out and automatically re-opens applications at startup - Persists lost of state, like browser tabs in Safari & Chrome and docs in Pages - Defaults to On in 10.10 - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout hooks - Re-opened Applications

Slide 46

Slide 46 text

Tools

Slide 47

Slide 47 text

Alerting Triage Forensics Malware Reporting

Slide 48

Slide 48 text

Linux Tools Are Usable Mostly…

Slide 49

Slide 49 text

VM Support is Awesome VMWare Fusion, VirtualBox, Docker, Vagrant etc

Slide 50

Slide 50 text

Built In Tools That Make Life Easier

Slide 51

Slide 51 text

/var/log

Slide 52

Slide 52 text

Console

Slide 53

Slide 53 text

Activity Monitor

Slide 54

Slide 54 text

Xcode & DTrace

Slide 55

Slide 55 text

Xcode - Apple’s Developer Suite - Development - Debugging - Instruments - Debugging & Monitoring with Dtrace - Commandline Tools

Slide 56

Slide 56 text

No content

Slide 57

Slide 57 text

netstat & lsof

Slide 58

Slide 58 text

awk/sed/grep

Slide 59

Slide 59 text

python & ruby

Slide 60

Slide 60 text

Non Security Tools You Should Install

Slide 61

Slide 61 text

HomeBrew & Cask

Slide 62

Slide 62 text

./jq

Slide 63

Slide 63 text

No content

Slide 64

Slide 64 text

No content

Slide 65

Slide 65 text

No content

Slide 66

Slide 66 text

No content

Slide 67

Slide 67 text

Apple Remote Desktop

Slide 68

Slide 68 text

Open Source Tools That Make me ☺

Slide 69

Slide 69 text

OSXCollector - Zero dependency OSX live response tool - Built by the security team at Yelp based on OSXAuditor - Copies key system state and log ﬁles for off host analysis - Built in ﬁlters for quickly identifying common patterns

Slide 70

Slide 70 text

No content

Slide 71

Slide 71 text

No content

Slide 72

Slide 72 text

- Host instrumentation for OSX & Linux - Exposes the operating system as a series of SQLite tables - Framework that allows lots of customization but needs integration Written by this handsome devil: Facebook’s @marpaia (& @theopolis) osquery

Slide 73

Slide 73 text

No content

Slide 74

Slide 74 text

ELK - 3 services = 1 Log management platform - High effort/high reward - Take a look at Yelp’s ElastAlert

Slide 75

Slide 75 text

No content

Slide 76

Slide 76 text

Yara - Malware centric Pattern Matching - Disk & Network - Highly Integratabtle rule leverage_a { meta: author = "[email protected]" version = "1.0" description = "OSX/Leverage.A" date = "2013/09" strings: $a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F" $a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:" $a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'" $script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'" $script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'" $script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'" $properties = "serverVisible \x00" condition: all of them } OSX/Leverage Rule from AlienVault }

Slide 77

Slide 77 text

- Remote Forensics & Host Sweeping Tool - Cross Platform: OSX & Linux (& Windows) - Add in Rekall (MemForensics) & ForensicArtifacts.com - Great API & Easy PoC

Slide 78

Slide 78 text

No content

Slide 79

Slide 79 text

- “The” OSS Memory Forensics Tool - Tons of Plugins (including OSX speciﬁc) to look for different data structures and techniques - Worth the time to get setup ahead of time

Slide 80

Slide 80 text

$ python vol.py --info | grep mac_ mac_arp - Prints the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dead_procs - Prints terminated/de-allocated processes mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in user land (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image mac_yarascan - A shell in the mac memory image

Slide 81

Slide 81 text

FIR - “FIR (Fast Incident Response) is an cybersecurity incident management platform designed with agility and speed in mind” - Entity extraction & autolinking to common data sites - Minimal (in a good way) but comprehensive

Slide 82

Slide 82 text

No content

Slide 83

Slide 83 text

Paid Security Tools I Like & Use

Slide 84

Slide 84 text

Paterva Maltego - Infrastructure Reconnaissance Tool? - Network Visualization & Analysis Tool? - Mash Up & Pivot Tool! - LEARN TO WRITE YOUR OWN TRANSFORMS!!!!

Slide 85

Slide 85 text

No content

Slide 86

Slide 86 text

No content

Slide 87

Slide 87 text

Hopper - A Mac Dissassembler and Binary Analysis Tool - Somewhat dev focused - Somewhat security focused - Great Value!

Slide 88

Slide 88 text

Other Tools - The Sleuth Kit & Autopsy - Traditional Forensics - Wireshark & tcpdump - Network Monitoring - 0xED - Hex Editor

Slide 89

Slide 89 text

Resources

Slide 90

Slide 90 text

People - @blackbagtech - @dinodaizovi - @iamevltwin - @mikearpaia - @osquery - @osxreverser - @patrickwardle - @robtlee - @sansforensics - @synack

Slide 91

Slide 91 text

Sites https://reverse.put.as/ http://www.mac4n6.com/ http://www.thesafemac.com/ https://objective-see.com/

Slide 92

Slide 92 text

Books - Mac OS X and iOS Internals - Mac Hacker's Handbook - iOS Hacker's Handbook

Slide 93

Slide 93 text

Courses SANS FOR518: Mac Forensic Analysis

Slide 94

Slide 94 text

Hardening - http://iase.disa.mil/stigs/os/mac/Pages/mac-os.aspx - https://github.com/google/santa/ - https://www.usenix.org/conference/lisa13/os-x-hardening- securing-large-global-mac-ﬂeet - https://github.com/drduh/OS-X-Yosemite-Security-and- Privacy-Guide

Slide 95

Slide 95 text

Conclusion

Slide 96

Slide 96 text

Concepts - PLists, Mach-O, HFS+, Kexts, Gate Keeper, & XProtect - Get Started: OSXCollector, ./jq, & FIR - Advance To: osquery, GRR, Yara, Maltego, & Hopper