Hipster DFIR on OSX

Hipster DFIR on OSX

My talk on Digital Forensics & Incident Response on OSX. GIven at ArchCon 2015.

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

September 10, 2015
Tweet

Transcript

  1. 2.

    Who Am I? GitHub Since 2012 DFIR Since 2006 Mac

    User Since 1989 Curious Since 1983
  2. 8.
  3. 9.
  4. 10.
  5. 11.
  6. 14.
  7. 18.
  8. 27.
  9. 29.
  10. 30.

    Property lists organize data into named values and lists of

    values using several Core Foundation types: CFString, CFNumber, CFBoolean, CFDate, CFData, CFArray, and CFDictionary. These types give you the means to produce data that is meaningfully structured, transportable, storable, and accessible, but still as efficient as possible.
  11. 32.

    <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN”

    "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Year Of Birth</key> <integer>1965</integer> <key>Pets Names</key> <array/> <key>Picture</key> <data>PEKBpYGlmYFCPA==</data> <key>City of Birth</key> <string>Springfield</string> <key>Name</key> <string>John Doe</string> <key>Kids Names</key> <array> <string>John</string> <string>Kyra</string> </array> </dict> </plist>
  12. 33.
  13. 34.
  14. 35.
  15. 36.
  16. 40.

    Persistance Mechanisms - cron jobs - kexts - OSX’s kernal

    extensions/modules - Needs admin privileges to install, but can do almost anything… - Defaults to: /System/Library/Extensions
  17. 41.

    Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    The “common” way for admin level binaries to persist across reboots - launchd is the first process and kicks off launch agents & daemons - Described by plist lauchd item
  18. 42.

    Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Deprecated… but still works! - Requires startup script & a plist in: - /Library/StartupItems - /System/Library/StartupItems - Starts up with operating system
  19. 43.

    Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Login Items - The “common” way for desktop userland applications to start up - User specific - User configurable without admin rights
  20. 44.

    Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Login Items - Login/Logout Hooks - Deprecated… but still works! - User specific - Just writes the script to execute to com.apple.loginwindow.plist and specify either LoginHook or LogoutHook
  21. 45.

    Persistance Mechanisms - OSX “helps” you out and automatically re-opens

    applications at startup - Persists lost of state, like browser tabs in Safari & Chrome and docs in Pages - Defaults to On in 10.10 - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout hooks - Re-opened Applications
  22. 46.
  23. 51.
  24. 52.
  25. 55.

    Xcode - Apple’s Developer Suite - Development - Debugging -

    Instruments - Debugging & Monitoring with Dtrace - Commandline Tools
  26. 56.
  27. 62.
  28. 63.
  29. 64.
  30. 65.
  31. 66.
  32. 69.

    OSXCollector - Zero dependency OSX live response tool - Built

    by the security team at Yelp based on OSXAuditor - Copies key system state and log files for off host analysis - Built in filters for quickly identifying common patterns
  33. 70.
  34. 71.
  35. 72.

    - Host instrumentation for OSX & Linux - Exposes the

    operating system as a series of SQLite tables - Framework that allows lots of customization but needs integration Written by this handsome devil: Facebook’s @marpaia (& @theopolis) osquery
  36. 73.
  37. 74.

    ELK - 3 services = 1 Log management platform -

    High effort/high reward - Take a look at Yelp’s ElastAlert
  38. 75.
  39. 76.

    Yara - Malware centric Pattern Matching - Disk & Network

    - Highly Integratabtle rule leverage_a { meta: author = "earada@alienvault.com" version = "1.0" description = "OSX/Leverage.A" date = "2013/09" strings: $a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F" $a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:" $a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'" $script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'" $script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'" $script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'" $properties = "serverVisible \x00" condition: all of them } OSX/Leverage Rule from AlienVault }
  40. 77.

    - Remote Forensics & Host Sweeping Tool - Cross Platform:

    OSX & Linux (& Windows) - Add in Rekall (MemForensics) & ForensicArtifacts.com - Great API & Easy PoC
  41. 78.
  42. 79.

    - “The” OSS Memory Forensics Tool - Tons of Plugins

    (including OSX specific) to look for different data structures and techniques - Worth the time to get setup ahead of time
  43. 80.

    $ python vol.py --info | grep mac_ mac_arp - Prints

    the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dead_procs - Prints terminated/de-allocated processes mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in user land (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image mac_yarascan - A shell in the mac memory image
  44. 81.

    FIR - “FIR (Fast Incident Response) is an cybersecurity incident

    management platform designed with agility and speed in mind” - Entity extraction & autolinking to common data sites - Minimal (in a good way) but comprehensive
  45. 82.
  46. 84.

    Paterva Maltego - Infrastructure Reconnaissance Tool? - Network Visualization &

    Analysis Tool? - Mash Up & Pivot Tool! - LEARN TO WRITE YOUR OWN TRANSFORMS!!!!
  47. 85.
  48. 86.
  49. 87.

    Hopper - A Mac Dissassembler and Binary Analysis Tool -

    Somewhat dev focused - Somewhat security focused - Great Value!
  50. 88.

    Other Tools - The Sleuth Kit & Autopsy - Traditional

    Forensics - Wireshark & tcpdump - Network Monitoring - 0xED - Hex Editor
  51. 89.
  52. 90.

    People - @blackbagtech - @dinodaizovi - @iamevltwin - @mikearpaia -

    @osquery - @osxreverser - @patrickwardle - @robtlee - @sansforensics - @synack
  53. 92.

    Books - Mac OS X and iOS Internals - Mac

    Hacker's Handbook - iOS Hacker's Handbook
  54. 96.

    Concepts - PLists, Mach-O, HFS+, Kexts, Gate Keeper, & XProtect

    - Get Started: OSXCollector, ./jq, & FIR - Advance To: osquery, GRR, Yara, Maltego, & Hopper
  55. 99.