#obts — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #obts, aggregated by home.social.
-
Feeling FOMO because I was at one cool thing over the weekend that prevented me from being at two other cool things #OBTS and #NoKings. But on the bright side it looks like the protests went amazingly well. Super excited to see what actions come out of the connections people made while joyfully speaking their minds.
-
-
Ticket to #OBTS 8 acquired!
Missed every previous instance of it due to conflicts. Not this time!
-
Objective by the Sea slides/recordings are posted to their site. Check it out for great research on all things macOS security.
-
You can find the recording of my #OBTS talk about iPhone basebands and Apple Location Services on YouTube: https://youtu.be/DqOOggWDtes
-
Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": https://www.youtube.com/watch?v=Ellb76t7nrc
-
I was pointed at Apple Blocks plugin by @droe for @binaryninja during #OBTS conference 🏝️ and I totally recommend using it 🤘#mahalo @droe and the #obts24 crowd 🙏😉 https://github.com/droe/binja-blocks
-
"Mirror Mirror: Restoring Reflective Code Loading on macOS" (Patrick Wardle)
TL;DR In-memory execution is possible on macOS and used by bad actors. However, Apple has decided not to let processes see the memory of other processes as a privacy protection. Current detection will have to focus on what bad actors do after in-memory code execution. #detectionengineering
-
"Unveiling the Apple CVE-2024-40834 - A "shortcut" to the bypass road" (Marcio Almeida)
Users can build automations called shortcuts and even send them to other users or share them. 💀 He demonstrated one attack vector where you could persist malware via adding code to the .zshrc file. I'm sure there are many more. There aren't a lot of guardrails on what these shortcuts can do.
For enterprises, I would consider banning shortcuts entirely if you can.
#detectionengineering -
"Mac, where’s my Bootstrap?. What is the bootstrap server and how can you talk to it?" (Brandon Dalton & Fitzl Csaba)
You can detect common classes of XPC exploits by looking at the code signing info on both sides of the connection. #detectionengineering
Code here: https://github.com/Brandon7CC/mac-wheres-my-bootstrap
-
"Tripwires in the Dark: Developing Behavior Detections for macOS" (Colson Wilhoit)
Mac malware is increasing and is increasingly targeted across verticals. Behavioral detection is an important part of defense. Detecting malware based on behaviors (i.e. this command ran then this command after it) is much more reliable than brittle indicators like IP addresses or hashes. (Though those detections have their place too.)
Colson and Elastic have released some rules here that might be useful for your org: https://github.com/elastic/detection-rules/tree/main/detection_rules
#detectionengineering #obts #obtsv7 -
"A Better Way - YARA-X, Mach-O Feature Extraction, and Malware Similarity" (Jacob Latonis & Greg Lesnewich)
Things I learned:
Imports stored inside macho binaries are rebuilt via finite state automa.
A pocket attribution guide for the DPRK. Enjoy the blurry picture of the slide below.And . . . cool tools. Yara-X (written by Jacob) can parse macho files. So now we can build yara rules including dylib hashes (similar to imphashes for windows) and entitlement hashes. #detectionengineering
-
"iPhone Backup Forensics" (Kinga Kieczkowska)
Bunch of useful stuff here, but also a spy tip: you can guess a person's location by profiling their apps. Apps like parking payment can be very localized.
-
"Apple's not so Rapid Security Response" (Mykola Grymalyuk)
I have to admit, I didn't know much about RSRs. The July 2023 patch that broke everything was related to . . . how RSRs changed version numbers. RSRs added a letter to the OS version. Which was unexpected in user agents.
-
"Triangulating TrueType Fonts On macOS: Reconstructing CVE-2023-41990" (Aleksandar Nikolic )
Fonts are so much more complicated than I thought. To handle low-resolution displays, fonts could specify how they should be displayed when they scaled up and down. This complicated code allowed for an out-of-bounds memory write.
-
"Unraveling Time: Understanding Time Formats in iOS Sysdiagnose for Security Forensics" (Lina Wilske)
Things I learned:
Sysdiagnose logs use multiple timestamp formats. Like way too many formats.
You can enable baseband logging for more granular timezone changes, but you have to re-enable every 21 days. -
"Endless Exploits: The Saga of a macOS Vulnerability Exploited Seven Times" (Mickey Jin)
Things I learned:
installd is for third party .pkg files
system_installd is for Apple-signed .pkg filesmy idea for detection (not tested yet, ymmv) - installd writing to system volumes #detectionengineering
https://objectivebythesea.org/v7/talks.html#Speaker_6
https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/Endless%20Exploits.pdf
-
"iDecompile: Writing a Decompiler for iOS Applications"(Laurie Kirk)
Things I learned:
When decompiling iOS apps it makes sense to think of the application life cycle, i.e. specific code is triggered when apps go from background to foreground. You can think of these triggers as multiple mains or entry points.Tool for #reverseengineering
https://github.com/LaurieWired/Malimite -
"Broken isolation - draining your credentials from popular macOS password managers" (Wojciech Reguła)
Hardened runtime blocks code injection but there are often exceptions for conveniences, like plugins. Popular password managers also have these exceptions which leads to vulnerabilities, or features, depending on your definition.
-
Mach-O in Three Dimensions (Jaron Bradley)
One of my favorite talks at the conference - Jaron showed off how they mapped malware samples into a 3D space according to their similarity. Imagine a galaxy full of stars, except they're all evil.
Bundlore shows up as giant space slug because of the incremental changes to throw off detection. This visualization lets you see things like one dot in a cluster that's not matching the same yara sig. Or an entire cluster of samples yet to be detected.
Or giving you hints at attribution - Beavertail shares similarities with AppleJeus/Lazarus samples. #cti
-
"Stealer Crossing: New Horizons" (Stuart Ashenbrenner & Alden Schmidt)
Things I learned:
C2 is the best way to distinguish between macOS stealers because the code is widely shared. #cti
AMOS hopped between multiple different code bases for unknown reasons.#detectionengineering
Responsible process: something in a .app directory, parent: osascript, process: /bin/sh -c
dscl with arguments of 'Local/Default' or 'authonly' -
"Trace the Base: Unraveling the iPhone’s Baseband Architecture to Defend Against Cellular Attacks" (Lukas Arnold)
Things I learned:
iOS baseband configurations override configuration profiles.
You can disable 2G on your iPhone to mitigate some attacks.
Apple uses wifi to save battery for location services.
IPhones use special servers for Location Services in China.If you want to join the Cell Guard research project check it out here: https://cellguard.seemoo.tu-darmstadt.de/
-
"Swift Reversing in 2024 - It's not so bad :)" (Christopher Lopez @L0psec)
I learned that Swift makes reverse engineers sad. And that Swift uses Objective-C. Srsly, the presentation was cool but since I'm not a reverse engineer I don't have a lot to add.
But if you're a reverse engineer, you might find his videos useful.
-
"macOS Stealers: Stealing Your Coins, Cookies and Keychains" (Maddie Stewart & Suweera De Souza)
Things I Learned:
Lots of drama in the Infostealer scene
CuckooStealer and TMStealer(aka KoiStealer) are likely the same actor #cti#detectionengineering
Some infostealers reset the TCC db (tccutil reset AppleEvents) and in order to hide the notification sound they mute/unmute the machine using osascript (osascript -e 'set volume output muted true')OBTS link:
https://objectivebythesea.org/v7/talks.html#Speaker_20 -
"Sweet QuaDreams or Nightmare before Christmas? Dissecting an iOS 0-Day" (Christine Fossaceca & Bill Marczak)
Things I learned:
BlastDoor is the sandbox for objects in messages on iOS. (curious if something similar exists in macOS?)
The keychain is a target of attacks on iOS too.
Persistence is hard on iOS, and some attackers just don't bother. If you're exploit is good enough, you can just re-exploit the device after a reboot.Other notes:
There's a cute theoretical attack on the Zecops blog "No Reboot" where you can fake the reboot screen so the user thinks they've rebooted their device when they actually haven't.
QuaDream subverted iCloud 2FA by giving false dates to the process that generates TOTP codes. Malware can generate/cache TOTP codes that are valid at future times.
QuaDream stored XML data in a backdated calendar item. At the time, backdated calendar items didn't generate notifications.
QuaDream used triggering events to decide when to send data - i.e. screen locked or unlocked.#detectionengineering
For iOS, code executing from /private/var/db/com.apple.xpc.roleaccountd/staging/ is sus. (True for macOS as well?)
A system process that doesn't normally make a network connection uploading data (for QuaDream, BackupAgent was used)OBTS link: https://objectivebythesea.org/v7/talks.html#Speaker_25
BlackHat Slides: https://i.blackhat.com/EU-23/Presentations/BHEU23-Fossaceca.pdf
-
Finally going to do the thing I've been meaning to do for after every other Objective by the Sea before this - post a wrap-up! One post per talk with the most interesting bits from my perspective. Tagged with the relevant groups. Slides if I can find them.
#obts #obtsv7 #cti #reverseengineering #detectionengineering
-
Objective by the Sea is always an excellent conference, and I'd attend if it were held in a corn field in the middle of nowhere in Iowa. However, the amazing locations where the conference is held are frosting on the cake! Here are a few of my favorites while in Maui for the conference the last couple weeks.
See the alt text for details on each photo
#maui #obts #OBTSv7 #haleakala #milkyway #pipiwaitrail #iaovalley #hookipa #hookipabeach