update

Mac News & Updates - 08/11/16

in , ,

Blogs

Papers

Presentations

Tools

Malware

My Upcoming Classes & Presentations:

I’ll be teaching my SANS FOR518 – Mac Forensic Analysis class at the following conferences, there are some bonus @Night presentations as well! I hope to see many of you at one of these conference some day!

[LINK] SANS Virginia Beach (Aug 28 – Sept 2) - This one is coming up soon! This conference is super chill and relaxed, and you get to watch fighter jets from the beach!

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS Network Security (Sept 12 – 17 in Las Vegas, NV) - Missed Vegas for Blackhat or DEF CON? Didn't get enough of it? Join me...if you're feelin' lucky! :)

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS DFIR Prague (Oct 3 –  8 in the Czech Republic), Stay for the Summit on the 9th!

[LINK] SANS San Francisco (Nov 27 – Dec 2) 

  • @Night – iOS Location Forensics

[LINK] SANS Cyber Defense Initiative (Dec 12 – 17 in Washington, DC)

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

[LINK] SANS Cyber Threat Intelligence Summit (Jan 25 – 30 in Arlington, VA)

  • @Night – The iOS of Sauron- How iOS Tracks Everything You Do

Script Update: Dump iOS Frequent Locations – Now with KML & CSV Output!

in , ,

Update Details

I have added some output options to the script – CSV and KML.

See a related post here - "Parsing iOS Frequent Locations"

The script can now be called with a ‘-output’ argument with the following options:

  • k – KML Output only
  • c – CSV Output only
  • e – Everything (KML and CSV)

Note: The verbose script output is still available from standard output.

Usage

python dump_freq_locs.py –output e <StateModel#.plist>

Updated script (v1.1) is available in GitHub

Output Examples

Example of the CSV output in Excel

Example of the KML output in Google Earth

Example of the KML output in Google ‘My Maps’

 

 

Updates - June 2014

in

A few updates to the website:

Resources Section:

The Resources section now contains the Synalyze It! grammars for HFS+ that I created. Just a reminder – these are work in progress; I will update them as needed.

Also in the Resources section is the most current version of my presentations. If you attended one of my presentations in the past and want that specific copy, please feel free to contact me.

  • Reverse Engineering Mac Malware – A basic walk though of static and dynamic reverse engineering of Mac malware on a Mac. Approximately 20% static, and 80% dynamic analysis. No assembly knowledge needed!
  • When Macs Get Hacked – Intrusion analysis on the Mac - where and what to look for to find Mac malware doing a dead-box forensic analysis.
  • Analysis and Correlation of Mac Logs – Mac systems log a ton of data! This presentation helps correlate this information with other system artifacts to give the analyst a better view of what happened on the system.

Training & Events:

I will be teaching my FOR518: Mac Forensic Analysis at the SANS DFIRCON East 2014 conference in Ft. Lauderdale, Florida in early November. Visit here for more information.

Just a reminder, I will also be co-teaching FOR518: Mac Forensic Analysis with Hal Pomeranz at the following locations in the Fall:

On a budget? If you are looking to get into FOR518: Mac Forensic Analysis at HALF-PRICE(!), seats are still available in the second beta of the class in San Jose, CA in July. Sign up soon! Sign up here. I will be attending the class, while the great Unix god himself – Hal Pomeranz teaches. I assure you he will drop some serious command line kung fu upon us.