Mac News & Updates - 07/06/16

Malware:

OSX.Pirrit

OSX.Eleanor

 

Call for Papers:

[PDF] SANS DFIR Summit in Prague, CZ – I really like this conference; small, good people, great presentations. I’m schedule to be there – hope to see some of you all there as well!

 

Presentations:

[LINK] I just came back from the SANS DFIR Summit in Austin, TX which is by far one of my favorite events of the year. The presentations can be found here under ‘Digital Forensics & Incident Response Summit 2016’.

[PDF] Mach-O Libre – Mach-O Libre: Pile Driving Apple Malware with Static Analysis, Big-Data, and Automation. Accompanying presentation for the tool that was in my last update. Great Mach-O info!

[PDF] Java RATs: Not Even Your Macs Are Safe

 

Tools:

[LINK] PoC code for iCloud Keychain Analysis by n0fate , presentation (in Korean) can be found here.

[LINK] FSMon by Sergi Àlvarez at Nowsecure – File system monitor tools for iOS/OSX/Android/etc now updated to v1.4

 

Blogs:

[LINK] Adam Leventhal’s Blog – APFS in Detail

[LINK] Marc Padilla - Using File Attributes to Fill Volumes and Bypass OS X Server Limits

[LINK] Harden The World – OS X 10.11 Hardening Guide

[LINK] @osxreverser – ‘Apple EFI firmware passwords and the SCBO myth’

[LINK] Blackbag Technologies Blog – Did the iPhone Take the Picture?

 

Media:

[WEBCAST] My iOS Location Forensics webcast from May is up. []

[WEBCAST] Joshua Wright’s webcast, ‘What You Need to Know: iOS 10 Security’

[VIDEO] Attacking OSX for fun and profit Toolset Limitations Frustration and Table Flipping by Dan ‘Viss’ Tentler from CircleCityCon

[AUDIO] ThreatPost - Patrick Wardle on macOS Gatekeeper, Crypto Enhancements

 

Publications: 

[PDF] DRAFT SP 800-179 - Guide to Securing Apple OS X 10.10 Systems for IT Professionals: A NIST Security Configuration Checklist

 

My Upcoming Classes & Presentations:

I’ll be teaching my SANS FOR518 – Mac Forensic Analysis class at the following conferences, there are some bonus @Night presentations as well! I hope to see many of you at one of these conference some day!

[LINK] SANS Virginia Beach (Aug 28 – Sept 2) - This conference is right on the beach and makes it a really nice one to go to at the end of the summer season. Class during the day, walking the boardwalk in the breezy late summer evening!  

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS Network Security (Sept 12 – 17 in Las Vegas, NV) - Vegas is always a good time, and the weather in September isn’t too shabby either!

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS DFIR Prague (Oct 3 –  8 in the Czech Republic), Stay for the Summit on the 9th!

[LINK] SANS San Francisco (Nov 27 – Dec 2) []

  • @Night – iOS Location Forensics

[LINK] SANS Cyber Defense Initiative (Dec 12 – 17 in Washington, DC)

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS Cyber Threat Intelligence Summit (Jan 25 – 30 in Arlington, VA)

Mac News & Updates - 06/19/16

With WWDC happening this week there has been lots of Apple/Mac news, so I figured I would take this opportunity to put out a list of links and videos that I found worthwhile to read/watch. I hope to do this at somewhat regular intervals so keep an eye out for them! A good portion of these I’ve already tweeted out – but I’ve been told not everyone is on Twitter so here you go!

Videos:

WWDC Videos can be streamed on various Apple devices or thru the Safari browser – for you Windows folks, you can download them in the ‘Resources’ section of each link below. All videos can be accessed from the main page here, https://developer.apple.com/videos/wwdc2016/. I will highlight some of the videos I think are particular useful.

Blogs Articles & Other Web Links:

 Tools:

Upcoming Classes & Presentations:

I’ll be teaching my SANS FOR518 – Mac Forensic Analysis class at the following conferences, there are some bonus @Night presentations as well! I hope to see many of you at one of these conference some day!

SANS DFIR Summit Presentations in Austin, TX. There is still time to sign up for this one, starts next week! The DFIR Summit is one of my favorite conferences of the year! I like to call it Summer Camp for Digital Forensicators! 

  • Summit Presentation - The iOS of Sauron - How iOS Tracks Everything You Do on Thursday this week.
  •  @Night - iOS Location Forensics on Monday this week.

SANS Virginia Beach (Aug 28 – Sept 2) - This conference is right on the beach and makes it a really nice one to go to at the end of the summer season. Class during the day, walking the boardwalk in the breezy late summer evening! 

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

SANS Network Security (Sept 12 – 17 in Las Vegas, NV) - Vegas is always a good time, and the weather in September isn’t too shabby either! 

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

DFIR Prague (Oct 3 –  8 in the Czech Republic) - Stay for the Summit on the 9th!

SANS Cyber Defense Initiative (Dec 12 – 17 in Washington, DC)

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

SANS Cyber Threat Intelligence Summit (Jan 25 – 30 in Arlington, VA)

New Script – iOS Locations Scraper

Similar to my iOS Frequent Locations Dumper script, I wanted to extract the iOS locations that are stored in various SQLite databases and review them in CSV and KML output to make analysis easier. You can get the Python script here: https://github.com/mac4n6/iOS-Locations-Scraper

iOS is storing location data (Lats/Longs) in a variety of databases that are only accessible via physical access using a Jailbreak. Each database contains slightly different location data from Cellular (ie: LTE/CDMA), to Wi-Fi (war-driving type data), to application specific (Yelp, see example below). I still have quite a bit of research to do in this area to determine what all these points mean and how they are generated, and how long they persist for - thus a script needed to be created to make my life easier.

/private/var/mobile/Library/Caches/com.apple.routined/cache_encryptedB.db

/private/var/root/Library/Caches/locationd/

  • cache_encryptedA.db
  • cache_encryptedB.db
  • lockCache_encryptedA.db

The new iOS Locations Scraper script takes these extracted databases from a directory, looks at each table for a column labeled ‘Latitude’ and extracts the tuple data and writes it into a CSV and/or KML file. Examples of these files are shown below.

An example of the CSV output:

An example of the KML output in Google Earth (Note: A KML file can be opened in a variety of different tools):

CAVEAT: I wanted to make sure that I put this caveat out there. Some locations are fairly exact to where the device was located at a certain time, however others are more of a general location area (ie: cell tower location). The KML example above shows location artifacts from one database table (cache_encryptedA.db, LocationHarvest) in relation to the Yelp application. That's my iPhone tracking my location when I was using the Yelp app this weekend. (Pretty neat huh?)

For more iOS location-based information take a look at some of my other presentations:

iOS Location Forensics

The iOS of Sauron – How iOS Tracks Everything You Do

 

 

 

 

 

BSidesNOLA Preso - The iOS of Sauron: How iOS Tracks Everything You Do

I was lucky enough to again be selected as a speaker at one of my favorite BSides conferences, BSidesNOLA (4 years running!). This one has THE BEST speaker party. Backyard tiki bar, homemade gumbo, boiled crawfish, jambalaya, bananas foster. If you want to speak at a fantastic forensics heavy security conference, I highly recommend this one!

I presented my newest presentation "The iOS of Sauron". This is a presentation that I will be continuously researching and updating so be sure to visit again to get the newest version. I hope to also write various blog articles going into more depth on some of the topics covered.

This is very much a pattern-of-life presentation - if you have a particular "pattern" you are looking for - let me know. If you think its important, I bet someone else does as well!

You can find the presentation here.

© Sarah Edwards [mac4n6.com and mac4n6.net] 2016
Unauthorized use and/or duplication of this material without express and written permission from this blog’s author
and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given
to Sarah Edwards and [mac4n6.com and mac4n6.net with appropriate and specific direction to the original content.
Opinions expressed on this site of that of Sarah Edwards and no one else unless explicictly stated.