Hipster DFIR on OSX

My talk on Digital Forensics & Incident Response on OSX. GIven at ArchCon 2015.

Transcript

1. Hipster DFIR on OSX Incident Response Tools So Cool You've Never Heard of Them
2. Who Am I? GitHub Since 2012 DFIR Since 2006 Mac User Since 1989 Curious Since 1983
3. Trust me! SOC’d Intel’d & DFIR’d @ Symantec Mandiant + Vigilant
4. My First Computer…
5. DFIR @ GitHub
6. Getting Started
7. Why Bother?
12. Market Share From MacRumors.com
13. Support is… “Meh”
14. On vs. On
15. A Bit About
16. Problems Location, OS, & Attitude
17. Problems Location, Platform, & Attitude Challenges
18. Location
19. Challenge: No Hands On
20. ~100% OSX On the Desktop Platform
21. ~100% Linux In the Datacenter Platform
22. Challenge: Limited Tools
23. Attitude Trust, Openness, & Transparency
24. Challenge: No Draconian Tactics
25. Bonus! We ❤ Open Source…
26. Concepts You’ll Need
27. Next* NS*
28. Its Unix w/ Windows And OSX
29. Plists
30. Property lists organize data into named values and lists of values using several Core Foundation types: CFString, CFNumber, CFBoolean, CFDate, CFData, CFArray, and CFDictionary. These types give you the means to produce data that is meaningfully structured, transportable, storable, and accessible, but still as efficient as possible.
31. Binary*, XML, & JSON * Almost always the binary…
32. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN” "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Year Of Birth</key> <integer>1965</integer> <key>Pets Names</key> <array/> <key>Picture</key> <data>PEKBpYGlmYFCPA==</data> <key>City of Birth</key> <string>Springfield</string> <key>Name</key> <string>John Doe</string> <key>Kids Names</key> <array> <string>John</string> <string>Kyra</string> </array> </dict> </plist>
34. Mach-O
35. HFS+
36. Kexts
37. GateKeeper & XProtect
38. Persistance Mechanisms
39. Persistance Mechanisms - cron jobs - Yup… just like basic Linux cron - No admin necessary
40. Persistance Mechanisms - cron jobs - kexts - OSX’s kernal extensions/modules - Needs admin privileges to install, but can do almost anything… - Defaults to: /System/Library/Extensions
41. Persistance Mechanisms - cron jobs - kexts - launchdaemons - The “common” way for admin level binaries to persist across reboots - launchd is the first process and kicks off launch agents & daemons - Described by plist lauchd item
42. Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Deprecated… but still works! - Requires startup script & a plist in: - /Library/StartupItems - /System/Library/StartupItems - Starts up with operating system
43. Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Login Items - The “common” way for desktop userland applications to start up - User specific - User configurable without admin rights
44. Persistance Mechanisms - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout Hooks - Deprecated… but still works! - User specific - Just writes the script to execute to com.apple.loginwindow.plist and specify either LoginHook or LogoutHook
45. Persistance Mechanisms - OSX “helps” you out and automatically re-opens applications at startup - Persists lost of state, like browser tabs in Safari & Chrome and docs in Pages - Defaults to On in 10.10 - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout hooks - Re-opened Applications
46. Tools
47. Alerting Triage Forensics Malware Reporting
48. Linux Tools Are Usable Mostly…
49. VM Support is Awesome VMWare Fusion, VirtualBox, Docker, Vagrant etc
50. Built In Tools That Make Life Easier
51. /var/log
52. Console
53. Activity Monitor
54. Xcode & DTrace
55. Xcode - Apple’s Developer Suite - Development - Debugging - Instruments - Debugging & Monitoring with Dtrace - Commandline Tools
57. netstat & lsof
58. awk/sed/grep
59. python & ruby
60. Non Security Tools You Should Install
61. HomeBrew & Cask
62. ./jq
67. Apple Remote Desktop
68. Open Source Tools That Make me ☺
69. OSXCollector - Zero dependency OSX live response tool - Built by the security team at Yelp based on OSXAuditor - Copies key system state and log files for off host analysis - Built in filters for quickly identifying common patterns
72. - Host instrumentation for OSX & Linux - Exposes the operating system as a series of SQLite tables - Framework that allows lots of customization but needs integration Written by this handsome devil: Facebook’s @marpaia (& @theopolis) osquery
74. ELK - 3 services = 1 Log management platform - High effort/high reward - Take a look at Yelp’s ElastAlert
76. Yara - Malware centric Pattern Matching - Disk & Network - Highly Integratabtle rule leverage_a { meta: author = "earada@alienvault.com" version = "1.0" description = "OSX/Leverage.A" date = "2013/09" strings: $a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F" $a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:" $a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'" $script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'" $script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'" $script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'" $properties = "serverVisible \x00" condition: all of them } OSX/Leverage Rule from AlienVault }
77. - Remote Forensics & Host Sweeping Tool - Cross Platform: OSX & Linux (& Windows) - Add in Rekall (MemForensics) & ForensicArtifacts.com - Great API & Easy PoC
79. - “The” OSS Memory Forensics Tool - Tons of Plugins (including OSX specific) to look for different data structures and techniques - Worth the time to get setup ahead of time
80. $ python vol.py --info | grep mac_ mac_arp - Prints the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dead_procs - Prints terminated/de-allocated processes mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in user land (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image mac_yarascan - A shell in the mac memory image
81. FIR - “FIR (Fast Incident Response) is an cybersecurity incident management platform designed with agility and speed in mind” - Entity extraction & autolinking to common data sites - Minimal (in a good way) but comprehensive
83. Paid Security Tools I Like & Use
84. Paterva Maltego - Infrastructure Reconnaissance Tool? - Network Visualization & Analysis Tool? - Mash Up & Pivot Tool! - LEARN TO WRITE YOUR OWN TRANSFORMS!!!!
87. Hopper - A Mac Dissassembler and Binary Analysis Tool - Somewhat dev focused - Somewhat security focused - Great Value!
88. Other Tools - The Sleuth Kit & Autopsy - Traditional Forensics - Wireshark & tcpdump - Network Monitoring - 0xED - Hex Editor
89. Resources
90. People - @blackbagtech - @dinodaizovi - @iamevltwin - @mikearpaia - @osquery - @osxreverser - @patrickwardle - @robtlee - @sansforensics - @synack
91. Sites https://reverse.put.as/ http://www.mac4n6.com/ http://www.thesafemac.com/ https://objective-see.com/
92. Books - Mac OS X and iOS Internals - Mac Hacker's Handbook - iOS Hacker's Handbook
93. Courses SANS FOR518: Mac Forensic Analysis
94. Hardening - http://iase.disa.mil/stigs/os/mac/Pages/mac-os.aspx - https://github.com/google/santa/ - https://www.usenix.org/conference/lisa13/os-x-hardening- securing-large-global-mac-fleet - https://github.com/drduh/OS-X-Yosemite-Security-and- Privacy-Guide
95. Conclusion
96. Concepts - PLists, Mach-O, HFS+, Kexts, Gate Keeper, & XProtect - Get Started: OSXCollector, ./jq, & FIR - Advance To: osquery, GRR, Yara, Maltego, & Hopper
97. GitHub Security Is Growing!! - DFIR - Logging - IAM
98. Thanks & Questions???