Hipster DFIR on OSX

Hipster DFIR on OSX

My talk on Digital Forensics & Incident Response on OSX. GIven at ArchCon 2015.

Ded29c7918dce50c65131df03c769004?s=128

Scott J. Roberts

September 10, 2015
Tweet

Transcript

  1. Hipster DFIR on OSX Incident Response Tools So Cool You've

    Never Heard of Them
  2. Who Am I? GitHub Since 2012 DFIR Since 2006 Mac

    User Since 1989 Curious Since 1983
  3. Trust me! SOC’d Intel’d & DFIR’d @ Symantec Mandiant +

    Vigilant
  4. My First Computer…

  5. DFIR @ GitHub

  6. Getting Started

  7. Why Bother?

  8. None
  9. None
  10. None
  11. None
  12. Market Share From MacRumors.com

  13. Support is… “Meh”

  14. On vs. On

  15. A Bit About

  16. Problems Location, OS, & Attitude

  17. Problems Location, Platform, & Attitude Challenges

  18. Location

  19. Challenge: No Hands On

  20. ~100% OSX On the Desktop Platform

  21. ~100% Linux In the Datacenter Platform

  22. Challenge: Limited Tools

  23. Attitude Trust, Openness, & Transparency

  24. Challenge: No Draconian Tactics

  25. Bonus! We ❤ Open Source…

  26. Concepts You’ll Need

  27. Next* NS*

  28. Its Unix w/ Windows And OSX

  29. Plists

  30. Property lists organize data into named values and lists of

    values using several Core Foundation types: CFString, CFNumber, CFBoolean, CFDate, CFData, CFArray, and CFDictionary. These types give you the means to produce data that is meaningfully structured, transportable, storable, and accessible, but still as efficient as possible.
  31. Binary*, XML, & JSON * Almost always the binary…

  32. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN”

    "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Year Of Birth</key> <integer>1965</integer> <key>Pets Names</key> <array/> <key>Picture</key> <data>PEKBpYGlmYFCPA==</data> <key>City of Birth</key> <string>Springfield</string> <key>Name</key> <string>John Doe</string> <key>Kids Names</key> <array> <string>John</string> <string>Kyra</string> </array> </dict> </plist>
  33. None
  34. Mach-O

  35. HFS+

  36. Kexts

  37. GateKeeper & XProtect

  38. Persistance Mechanisms

  39. Persistance Mechanisms - cron jobs - Yup… just like basic

    Linux cron - No admin necessary
  40. Persistance Mechanisms - cron jobs - kexts - OSX’s kernal

    extensions/modules - Needs admin privileges to install, but can do almost anything… - Defaults to: /System/Library/Extensions
  41. Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    The “common” way for admin level binaries to persist across reboots - launchd is the first process and kicks off launch agents & daemons - Described by plist lauchd item
  42. Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Deprecated… but still works! - Requires startup script & a plist in: - /Library/StartupItems - /System/Library/StartupItems - Starts up with operating system
  43. Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Login Items - The “common” way for desktop userland applications to start up - User specific - User configurable without admin rights
  44. Persistance Mechanisms - cron jobs - kexts - launchdaemons -

    Startup Items - Login Items - Login/Logout Hooks - Deprecated… but still works! - User specific - Just writes the script to execute to com.apple.loginwindow.plist and specify either LoginHook or LogoutHook
  45. Persistance Mechanisms - OSX “helps” you out and automatically re-opens

    applications at startup - Persists lost of state, like browser tabs in Safari & Chrome and docs in Pages - Defaults to On in 10.10 - cron jobs - kexts - launchdaemons - Startup Items - Login Items - Login/Logout hooks - Re-opened Applications
  46. Tools

  47. Alerting Triage Forensics Malware Reporting

  48. Linux Tools Are Usable Mostly…

  49. VM Support is Awesome VMWare Fusion, VirtualBox, Docker, Vagrant etc

  50. Built In Tools That Make Life Easier

  51. /var/log

  52. Console

  53. Activity Monitor

  54. Xcode & DTrace

  55. Xcode - Apple’s Developer Suite - Development - Debugging -

    Instruments - Debugging & Monitoring with Dtrace - Commandline Tools
  56. None
  57. netstat & lsof

  58. awk/sed/grep

  59. python & ruby

  60. Non Security Tools You Should Install

  61. HomeBrew & Cask

  62. ./jq

  63. None
  64. None
  65. None
  66. None
  67. Apple Remote Desktop

  68. Open Source Tools That Make me ☺

  69. OSXCollector - Zero dependency OSX live response tool - Built

    by the security team at Yelp based on OSXAuditor - Copies key system state and log files for off host analysis - Built in filters for quickly identifying common patterns
  70. None
  71. None
  72. - Host instrumentation for OSX & Linux - Exposes the

    operating system as a series of SQLite tables - Framework that allows lots of customization but needs integration Written by this handsome devil: Facebook’s @marpaia (& @theopolis) osquery
  73. None
  74. ELK - 3 services = 1 Log management platform -

    High effort/high reward - Take a look at Yelp’s ElastAlert
  75. None
  76. Yara - Malware centric Pattern Matching - Disk & Network

    - Highly Integratabtle rule leverage_a { meta: author = "earada@alienvault.com" version = "1.0" description = "OSX/Leverage.A" date = "2013/09" strings: $a1 = "ioreg -l | grep \"IOPlatformSerialNumber\" | awk -F" $a2 = "+:Users:Shared:UserEvent.app:Contents:MacOS:" $a3 = "rm '/Users/Shared/UserEvent.app/Contents/Resources/UserEvent.icns'" $script1 = "osascript -e 'tell application \"System Events\" to get the hidden of every login item'" $script2 = "osascript -e 'tell application \"System Events\" to get the name of every login item'" $script3 = "osascript -e 'tell application \"System Events\" to get the path of every login item'" $properties = "serverVisible \x00" condition: all of them } OSX/Leverage Rule from AlienVault }
  77. - Remote Forensics & Host Sweeping Tool - Cross Platform:

    OSX & Linux (& Windows) - Add in Rekall (MemForensics) & ForensicArtifacts.com - Great API & Easy PoC
  78. None
  79. - “The” OSS Memory Forensics Tool - Tons of Plugins

    (including OSX specific) to look for different data structures and techniques - Worth the time to get setup ahead of time
  80. $ python vol.py --info | grep mac_ mac_arp - Prints

    the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dead_procs - Prints terminated/de-allocated processes mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in user land (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image mac_yarascan - A shell in the mac memory image
  81. FIR - “FIR (Fast Incident Response) is an cybersecurity incident

    management platform designed with agility and speed in mind” - Entity extraction & autolinking to common data sites - Minimal (in a good way) but comprehensive
  82. None
  83. Paid Security Tools I Like & Use

  84. Paterva Maltego - Infrastructure Reconnaissance Tool? - Network Visualization &

    Analysis Tool? - Mash Up & Pivot Tool! - LEARN TO WRITE YOUR OWN TRANSFORMS!!!!
  85. None
  86. None
  87. Hopper - A Mac Dissassembler and Binary Analysis Tool -

    Somewhat dev focused - Somewhat security focused - Great Value!
  88. Other Tools - The Sleuth Kit & Autopsy - Traditional

    Forensics - Wireshark & tcpdump - Network Monitoring - 0xED - Hex Editor
  89. Resources

  90. People - @blackbagtech - @dinodaizovi - @iamevltwin - @mikearpaia -

    @osquery - @osxreverser - @patrickwardle - @robtlee - @sansforensics - @synack
  91. Sites https://reverse.put.as/ http://www.mac4n6.com/ http://www.thesafemac.com/ https://objective-see.com/

  92. Books - Mac OS X and iOS Internals - Mac

    Hacker's Handbook - iOS Hacker's Handbook
  93. Courses SANS FOR518: Mac Forensic Analysis

  94. Hardening - http://iase.disa.mil/stigs/os/mac/Pages/mac-os.aspx - https://github.com/google/santa/ - https://www.usenix.org/conference/lisa13/os-x-hardening- securing-large-global-mac-fleet - https://github.com/drduh/OS-X-Yosemite-Security-and-

    Privacy-Guide
  95. Conclusion

  96. Concepts - PLists, Mach-O, HFS+, Kexts, Gate Keeper, & XProtect

    - Get Started: OSXCollector, ./jq, & FIR - Advance To: osquery, GRR, Yara, Maltego, & Hopper
  97. GitHub Security Is Growing!! - DFIR - Logging - IAM

  98. Thanks & Questions???

  99. None