#obtsv7 — Public Fediverse posts

Finally got around to writing up my iPhone Backup Forensics talk from #OBTSv7.0 — now in blog form:

https://kieczkowska.wordpress.com/2025/04/29/iphone-backup-forensics-101/

First post in a while, hopefully not the last.

Finally got around to writing up my iPhone Backup Forensics talk from #OBTSv7.0 — now in blog form:

https://kieczkowska.wordpress.com/2025/04/29/iphone-backup-forensics-101/

First post in a while, hopefully not the last.

"Mirror Mirror: Restoring Reflective Code Loading on macOS" (Patrick Wardle)

TL;DR In-memory execution is possible on macOS and used by bad actors. However, Apple has decided not to let processes see the memory of other processes as a privacy protection. Current detection will have to focus on what bad actors do after in-memory code execution. #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_1

#obts #obtsv7

"Mirror Mirror: Restoring Reflective Code Loading on macOS" (Patrick Wardle)

TL;DR In-memory execution is possible on macOS and used by bad actors. However, Apple has decided not to let processes see the memory of other processes as a privacy protection. Current detection will have to focus on what bad actors do after in-memory code execution. #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_1

#obts #obtsv7

"Unveiling the Apple CVE-2024-40834 - A "shortcut" to the bypass road" (Marcio Almeida)

Users can build automations called shortcuts and even send them to other users or share them. 💀 He demonstrated one attack vector where you could persist malware via adding code to the .zshrc file. I'm sure there are many more. There aren't a lot of guardrails on what these shortcuts can do.

For enterprises, I would consider banning shortcuts entirely if you can.
#detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_7

#obts #obtsv7

"Unveiling the Apple CVE-2024-40834 - A "shortcut" to the bypass road" (Marcio Almeida)

Users can build automations called shortcuts and even send them to other users or share them. 💀 He demonstrated one attack vector where you could persist malware via adding code to the .zshrc file. I'm sure there are many more. There aren't a lot of guardrails on what these shortcuts can do.

For enterprises, I would consider banning shortcuts entirely if you can.
#detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_7

#obts #obtsv7

"Mac, where’s my Bootstrap?. What is the bootstrap server and how can you talk to it?" (Brandon Dalton & Fitzl Csaba)

You can detect common classes of XPC exploits by looking at the code signing info on both sides of the connection. #detectionengineering

Code here: https://github.com/Brandon7CC/mac-wheres-my-bootstrap

https://objectivebythesea.org/v7/talks.html#Speaker_2

#obts #obtsv7

"Mac, where’s my Bootstrap?. What is the bootstrap server and how can you talk to it?" (Brandon Dalton & Fitzl Csaba)

You can detect common classes of XPC exploits by looking at the code signing info on both sides of the connection. #detectionengineering

Code here: https://github.com/Brandon7CC/mac-wheres-my-bootstrap

https://objectivebythesea.org/v7/talks.html#Speaker_2

#obts #obtsv7

"Tripwires in the Dark: Developing Behavior Detections for macOS" (Colson Wilhoit)

Mac malware is increasing and is increasingly targeted across verticals. Behavioral detection is an important part of defense. Detecting malware based on behaviors (i.e. this command ran then this command after it) is much more reliable than brittle indicators like IP addresses or hashes. (Though those detections have their place too.)

Colson and Elastic have released some rules here that might be useful for your org: https://github.com/elastic/detection-rules/tree/main/detection_rules
#detectionengineering #obts #obtsv7

"Tripwires in the Dark: Developing Behavior Detections for macOS" (Colson Wilhoit)

Mac malware is increasing and is increasingly targeted across verticals. Behavioral detection is an important part of defense. Detecting malware based on behaviors (i.e. this command ran then this command after it) is much more reliable than brittle indicators like IP addresses or hashes. (Though those detections have their place too.)

Colson and Elastic have released some rules here that might be useful for your org: https://github.com/elastic/detection-rules/tree/main/detection_rules
#detectionengineering #obts #obtsv7

"A Better Way - YARA-X, Mach-O Feature Extraction, and Malware Similarity" (Jacob Latonis & Greg Lesnewich)

Things I learned:
Imports stored inside macho binaries are rebuilt via finite state automa.
A pocket attribution guide for the DPRK. Enjoy the blurry picture of the slide below.

And . . . cool tools. Yara-X (written by Jacob) can parse macho files. So now we can build yara rules including dylib hashes (similar to imphashes for windows) and entitlement hashes. #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_26

#obts #obtsv7

"A Better Way - YARA-X, Mach-O Feature Extraction, and Malware Similarity" (Jacob Latonis & Greg Lesnewich)

Things I learned:
Imports stored inside macho binaries are rebuilt via finite state automa.
A pocket attribution guide for the DPRK. Enjoy the blurry picture of the slide below.

And . . . cool tools. Yara-X (written by Jacob) can parse macho files. So now we can build yara rules including dylib hashes (similar to imphashes for windows) and entitlement hashes. #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_26

#obts #obtsv7

"iPhone Backup Forensics" (Kinga Kieczkowska)

Bunch of useful stuff here, but also a spy tip: you can guess a person's location by profiling their apps. Apps like parking payment can be very localized.

https://objectivebythesea.org/v7/talks.html#Speaker_11

#obts #obtsv7

"iPhone Backup Forensics" (Kinga Kieczkowska)

Bunch of useful stuff here, but also a spy tip: you can guess a person's location by profiling their apps. Apps like parking payment can be very localized.

https://objectivebythesea.org/v7/talks.html#Speaker_11

#obts #obtsv7

"Apple's not so Rapid Security Response" (Mykola Grymalyuk)

I have to admit, I didn't know much about RSRs. The July 2023 patch that broke everything was related to . . . how RSRs changed version numbers. RSRs added a letter to the OS version. Which was unexpected in user agents.

https://objectivebythesea.org/v7/talks.html#Speaker_10

#obts #obtsv7

"Apple's not so Rapid Security Response" (Mykola Grymalyuk)

I have to admit, I didn't know much about RSRs. The July 2023 patch that broke everything was related to . . . how RSRs changed version numbers. RSRs added a letter to the OS version. Which was unexpected in user agents.

https://objectivebythesea.org/v7/talks.html#Speaker_10

#obts #obtsv7

"Triangulating TrueType Fonts On macOS: Reconstructing CVE-2023-41990" (Aleksandar Nikolic )

Fonts are so much more complicated than I thought. To handle low-resolution displays, fonts could specify how they should be displayed when they scaled up and down. This complicated code allowed for an out-of-bounds memory write.

https://objectivebythesea.org/v7/talks.html#Speaker_15

#obts #obtsv7

"Triangulating TrueType Fonts On macOS: Reconstructing CVE-2023-41990" (Aleksandar Nikolic )

Fonts are so much more complicated than I thought. To handle low-resolution displays, fonts could specify how they should be displayed when they scaled up and down. This complicated code allowed for an out-of-bounds memory write.

https://objectivebythesea.org/v7/talks.html#Speaker_15

#obts #obtsv7

"Unraveling Time: Understanding Time Formats in iOS Sysdiagnose for Security Forensics" (Lina Wilske)

Things I learned:
Sysdiagnose logs use multiple timestamp formats. Like way too many formats.
You can enable baseband logging for more granular timezone changes, but you have to re-enable every 21 days.

https://objectivebythesea.org/v7/talks.html#Speaker_12

#obts #obtsv7

"Unraveling Time: Understanding Time Formats in iOS Sysdiagnose for Security Forensics" (Lina Wilske)

Things I learned:
Sysdiagnose logs use multiple timestamp formats. Like way too many formats.
You can enable baseband logging for more granular timezone changes, but you have to re-enable every 21 days.

https://objectivebythesea.org/v7/talks.html#Speaker_12

#obts #obtsv7

"Endless Exploits: The Saga of a macOS Vulnerability Exploited Seven Times" (Mickey Jin)

Things I learned:
installd is for third party .pkg files
system_installd is for Apple-signed .pkg files

my idea for detection (not tested yet, ymmv) - installd writing to system volumes #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_6

https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/Endless%20Exploits.pdf

#obts #obtsv7

"Endless Exploits: The Saga of a macOS Vulnerability Exploited Seven Times" (Mickey Jin)

Things I learned:
installd is for third party .pkg files
system_installd is for Apple-signed .pkg files

my idea for detection (not tested yet, ymmv) - installd writing to system volumes #detectionengineering

https://objectivebythesea.org/v7/talks.html#Speaker_6

https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/Endless%20Exploits.pdf

#obts #obtsv7

"iDecompile: Writing a Decompiler for iOS Applications"(Laurie Kirk)

Things I learned:
When decompiling iOS apps it makes sense to think of the application life cycle, i.e. specific code is triggered when apps go from background to foreground. You can think of these triggers as multiple mains or entry points.

Tool for #reverseengineering
https://github.com/LaurieWired/Malimite

https://objectivebythesea.org/v7/talks.html#Speaker_8

#obts #obtsv7

"iDecompile: Writing a Decompiler for iOS Applications"(Laurie Kirk)

Things I learned:
When decompiling iOS apps it makes sense to think of the application life cycle, i.e. specific code is triggered when apps go from background to foreground. You can think of these triggers as multiple mains or entry points.

Tool for #reverseengineering
https://github.com/LaurieWired/Malimite

https://objectivebythesea.org/v7/talks.html#Speaker_8

#obts #obtsv7

"Broken isolation - draining your credentials from popular macOS password managers" (Wojciech Reguła)

Hardened runtime blocks code injection but there are often exceptions for conveniences, like plugins. Popular password managers also have these exceptions which leads to vulnerabilities, or features, depending on your definition.

https://objectivebythesea.org/v7/talks.html#Speaker_19

#obts #obtsv7

"Broken isolation - draining your credentials from popular macOS password managers" (Wojciech Reguła)

Hardened runtime blocks code injection but there are often exceptions for conveniences, like plugins. Popular password managers also have these exceptions which leads to vulnerabilities, or features, depending on your definition.

https://objectivebythesea.org/v7/talks.html#Speaker_19

#obts #obtsv7

Mach-O in Three Dimensions (Jaron Bradley)

One of my favorite talks at the conference - Jaron showed off how they mapped malware samples into a 3D space according to their similarity. Imagine a galaxy full of stars, except they're all evil.

Bundlore shows up as giant space slug because of the incremental changes to throw off detection. This visualization lets you see things like one dot in a cluster that's not matching the same yara sig. Or an entire cluster of samples yet to be detected.

Or giving you hints at attribution - Beavertail shares similarities with AppleJeus/Lazarus samples. #cti

#detectionengineering #obts #obtsv7

Mach-O in Three Dimensions (Jaron Bradley)

One of my favorite talks at the conference - Jaron showed off how they mapped malware samples into a 3D space according to their similarity. Imagine a galaxy full of stars, except they're all evil.

Bundlore shows up as giant space slug because of the incremental changes to throw off detection. This visualization lets you see things like one dot in a cluster that's not matching the same yara sig. Or an entire cluster of samples yet to be detected.

Or giving you hints at attribution - Beavertail shares similarities with AppleJeus/Lazarus samples. #cti

#detectionengineering #obts #obtsv7

"Stealer Crossing: New Horizons" (Stuart Ashenbrenner & Alden Schmidt)

Things I learned:
C2 is the best way to distinguish between macOS stealers because the code is widely shared. #cti
AMOS hopped between multiple different code bases for unknown reasons.

#detectionengineering
Responsible process: something in a .app directory, parent: osascript, process: /bin/sh -c
dscl with arguments of 'Local/Default' or 'authonly'

https://objectivebythesea.org/v7/talks.html#Speaker_17

#obts #obtsv7

"Stealer Crossing: New Horizons" (Stuart Ashenbrenner & Alden Schmidt)

Things I learned:
C2 is the best way to distinguish between macOS stealers because the code is widely shared. #cti
AMOS hopped between multiple different code bases for unknown reasons.

#detectionengineering
Responsible process: something in a .app directory, parent: osascript, process: /bin/sh -c
dscl with arguments of 'Local/Default' or 'authonly'

https://objectivebythesea.org/v7/talks.html#Speaker_17

#obts #obtsv7

"Trace the Base: Unraveling the iPhone’s Baseband Architecture to Defend Against Cellular Attacks" (Lukas Arnold)

Things I learned:
iOS baseband configurations override configuration profiles.
You can disable 2G on your iPhone to mitigate some attacks.
Apple uses wifi to save battery for location services.
IPhones use special servers for Location Services in China.

If you want to join the Cell Guard research project check it out here: https://cellguard.seemoo.tu-darmstadt.de/

#obts #obtsv7

"Trace the Base: Unraveling the iPhone’s Baseband Architecture to Defend Against Cellular Attacks" (Lukas Arnold)

Things I learned:
iOS baseband configurations override configuration profiles.
You can disable 2G on your iPhone to mitigate some attacks.
Apple uses wifi to save battery for location services.
IPhones use special servers for Location Services in China.

If you want to join the Cell Guard research project check it out here: https://cellguard.seemoo.tu-darmstadt.de/

#obts #obtsv7

"Swift Reversing in 2024 - It's not so bad :)" (Christopher Lopez @L0psec)

I learned that Swift makes reverse engineers sad. And that Swift uses Objective-C. Srsly, the presentation was cool but since I'm not a reverse engineer I don't have a lot to add.

But if you're a reverse engineer, you might find his videos useful.

https://www.youtube.com/@L0psec

#reverseengineering
#obts #obtsv7

"Swift Reversing in 2024 - It's not so bad :)" (Christopher Lopez @L0psec)

I learned that Swift makes reverse engineers sad. And that Swift uses Objective-C. Srsly, the presentation was cool but since I'm not a reverse engineer I don't have a lot to add.

But if you're a reverse engineer, you might find his videos useful.

https://www.youtube.com/@L0psec

#reverseengineering
#obts #obtsv7

"macOS Stealers: Stealing Your Coins, Cookies and Keychains" (Maddie Stewart & Suweera De Souza)

Things I Learned:
Lots of drama in the Infostealer scene
CuckooStealer and TMStealer(aka KoiStealer) are likely the same actor #cti

#detectionengineering
Some infostealers reset the TCC db (tccutil reset AppleEvents) and in order to hide the notification sound they mute/unmute the machine using osascript (osascript -e 'set volume output muted true')

OBTS link:
https://objectivebythesea.org/v7/talks.html#Speaker_20

#obts #obtsv7
Terrible photo from their slides below.

"macOS Stealers: Stealing Your Coins, Cookies and Keychains" (Maddie Stewart & Suweera De Souza)

Things I Learned:
Lots of drama in the Infostealer scene
CuckooStealer and TMStealer(aka KoiStealer) are likely the same actor #cti

#detectionengineering
Some infostealers reset the TCC db (tccutil reset AppleEvents) and in order to hide the notification sound they mute/unmute the machine using osascript (osascript -e 'set volume output muted true')

OBTS link:
https://objectivebythesea.org/v7/talks.html#Speaker_20

#obts #obtsv7
Terrible photo from their slides below.

"Sweet QuaDreams or Nightmare before Christmas? Dissecting an iOS 0-Day" (Christine Fossaceca & Bill Marczak)

Things I learned:
BlastDoor is the sandbox for objects in messages on iOS. (curious if something similar exists in macOS?)
The keychain is a target of attacks on iOS too.
Persistence is hard on iOS, and some attackers just don't bother. If you're exploit is good enough, you can just re-exploit the device after a reboot.

Other notes:
There's a cute theoretical attack on the Zecops blog "No Reboot" where you can fake the reboot screen so the user thinks they've rebooted their device when they actually haven't.
QuaDream subverted iCloud 2FA by giving false dates to the process that generates TOTP codes. Malware can generate/cache TOTP codes that are valid at future times.
QuaDream stored XML data in a backdated calendar item. At the time, backdated calendar items didn't generate notifications.
QuaDream used triggering events to decide when to send data - i.e. screen locked or unlocked.

#detectionengineering
For iOS, code executing from /private/var/db/com.apple.xpc.roleaccountd/staging/ is sus. (True for macOS as well?)
A system process that doesn't normally make a network connection uploading data (for QuaDream, BackupAgent was used)

OBTS link: https://objectivebythesea.org/v7/talks.html#Speaker_25

BlackHat Slides: https://i.blackhat.com/EU-23/Presentations/BHEU23-Fossaceca.pdf

#obts #OBTSv7

"Sweet QuaDreams or Nightmare before Christmas? Dissecting an iOS 0-Day" (Christine Fossaceca & Bill Marczak)

Things I learned:
BlastDoor is the sandbox for objects in messages on iOS. (curious if something similar exists in macOS?)
The keychain is a target of attacks on iOS too.
Persistence is hard on iOS, and some attackers just don't bother. If you're exploit is good enough, you can just re-exploit the device after a reboot.

Other notes:
There's a cute theoretical attack on the Zecops blog "No Reboot" where you can fake the reboot screen so the user thinks they've rebooted their device when they actually haven't.
QuaDream subverted iCloud 2FA by giving false dates to the process that generates TOTP codes. Malware can generate/cache TOTP codes that are valid at future times.
QuaDream stored XML data in a backdated calendar item. At the time, backdated calendar items didn't generate notifications.
QuaDream used triggering events to decide when to send data - i.e. screen locked or unlocked.

#detectionengineering
For iOS, code executing from /private/var/db/com.apple.xpc.roleaccountd/staging/ is sus. (True for macOS as well?)
A system process that doesn't normally make a network connection uploading data (for QuaDream, BackupAgent was used)

OBTS link: https://objectivebythesea.org/v7/talks.html#Speaker_25

BlackHat Slides: https://i.blackhat.com/EU-23/Presentations/BHEU23-Fossaceca.pdf

#obts #OBTSv7

Finally going to do the thing I've been meaning to do for after every other Objective by the Sea before this - post a wrap-up! One post per talk with the most interesting bits from my perspective. Tagged with the relevant groups. Slides if I can find them.

#obts #obtsv7 #cti #reverseengineering #detectionengineering

Finally going to do the thing I've been meaning to do for after every other Objective by the Sea before this - post a wrap-up! One post per talk with the most interesting bits from my perspective. Tagged with the relevant groups. Slides if I can find them.

#obts #obtsv7 #cti #reverseengineering #detectionengineering

Objective by the Sea is always an excellent conference, and I'd attend if it were held in a corn field in the middle of nowhere in Iowa. However, the amazing locations where the conference is held are frosting on the cake! Here are a few of my favorites while in Maui for the conference the last couple weeks.

See the alt text for details on each photo

#maui #obts #OBTSv7 #haleakala #milkyway #pipiwaitrail #iaovalley #hookipa #hookipabeach

Objective by the Sea is always an excellent conference, and I'd attend if it were held in a corn field in the middle of nowhere in Iowa. However, the amazing locations where the conference is held are frosting on the cake! Here are a few of my favorites while in Maui for the conference the last couple weeks.

See the alt text for details on each photo

#maui #obts #OBTSv7 #haleakala #milkyway #pipiwaitrail #iaovalley #hookipa #hookipabeach

Mini-luau dinner on the way home #obts #obtsv7

Mini-luau dinner on the way home #obts #obtsv7

Behavior detection can bridge the gap between static and ML malware analysis, but in order to roll out behavior detection you will need: quality data collection, understanding of normal, and expertise in attacker techniques. - Colson Wilhoit at #obts #obtsv7

Behavior detection can bridge the gap between static and ML malware analysis, but in order to roll out behavior detection you will need: quality data collection, understanding of normal, and expertise in attacker techniques. - Colson Wilhoit at #obts #obtsv7

I had no idea there was so much to rendering fonts. A really interesting deep dive into the messiness of font rendering by Aleksandar Nikolic @FuzzyAleks at #obts #obtsv7

I had no idea there was so much to rendering fonts. A really interesting deep dive into the messiness of font rendering by Aleksandar Nikolic @FuzzyAleks at #obts #obtsv7

Team made 11th place at #OBTS CTF. We dropped 1 place from last year but still had a blast. Hope the rest of the #OBTSv7 crew have a blast!

Team made 11th place at #OBTS CTF. We dropped 1 place from last year but still had a blast. Hope the rest of the #OBTSv7 crew have a blast!

Some really exciting stuff in Jaron Bradley's 3d malware talk. #obts #obtsv7

Some really exciting stuff in Jaron Bradley's 3d malware talk. #obts #obtsv7

Thanks for joining my talk about iPhone basebands at #OBTS #OBTSv7. It’s an awesome experience in Maui, and I’m looking forward to the rest of the conference. You can find the slides at https://lukasarnold.de/pdfs/obts7-trace-the-base.pdf

Thanks for joining my talk about iPhone basebands at #OBTS #OBTSv7. It’s an awesome experience in Maui, and I’m looking forward to the rest of the conference. You can find the slides at https://lukasarnold.de/pdfs/obts7-trace-the-base.pdf

Infostealer behavioral detection is hard with common commands, depends a lot on context - Stuart Ashenbrenner/Alden Schmidt at #obts #obtsv7 (exactly the sort of thing I was aiming at with NBD, btw. :) https://github.com/megancarney/nbd)

Infostealer behavioral detection is hard with common commands, depends a lot on context - Stuart Ashenbrenner/Alden Schmidt at #obts #obtsv7 (exactly the sort of thing I was aiming at with NBD, btw. :) https://github.com/megancarney/nbd)

SweetQua hid XML in a backdated calendar event. Backdated calendar events used to not generate notifications for the user.
Christine Fossaceca (@x71n3) and Bill Marczak, (@billmarczak) at #obts #obtsv7

SweetQua hid XML in a backdated calendar event. Backdated calendar events used to not generate notifications for the user.
Christine Fossaceca (@x71n3) and Bill Marczak, (@billmarczak) at #obts #obtsv7