Discover and read the best of Twitter Threads about #obts
Most recents (8)
RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in! 1/n 🧵
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in! 1/n 🧵
We'll start with 3CXDesktopApp-18.12.416.dmg
(SHA 1: 3DC840D32CE86CEBF657B17CEF62814646BA8E98)
It contains a *notarized* app ("3CX Desktop App.app") ...meaning Apple checked it for malware "and none was detected" 😜☠️ 2/n
(SHA 1: 3DC840D32CE86CEBF657B17CEF62814646BA8E98)
It contains a *notarized* app ("3CX Desktop App.app") ...meaning Apple checked it for malware "and none was detected" 😜☠️ 2/n
This app is massive - 381mb 🤯
...let's focus on libffmpeg.dylib
found in the App's /Contents/Frameworks/Electron\ Framework.framework/Versions/A/Libraries directory
(SHA 1: 769383fc65d1386dd141c960c9970114547da0c2)
It was submitted to VT today:
virustotal.com/gui/file/a64fa… 3/n
...let's focus on libffmpeg.dylib
found in the App's /Contents/Frameworks/Electron\ Framework.framework/Versions/A/Libraries directory
(SHA 1: 769383fc65d1386dd141c960c9970114547da0c2)
It was submitted to VT today:
virustotal.com/gui/file/a64fa… 3/n
I've just posted slides from my #OBTS v5 talk: "Making oRAT, Go" 🍎🐀
speakerdeck.com/patrickwardle/…
After creating a custom C&C server, we can uncover the malware’s full capabilities - simply by asking (tasking) the right questions! 🤭
speakerdeck.com/patrickwardle/…
After creating a custom C&C server, we can uncover the malware’s full capabilities - simply by asking (tasking) the right questions! 🤭
1️⃣ First, we must understand how the malware figures out how to find its C&C server - so we can coerce it to talk to our C&C instead!
As this (encrypted) info is embedded within the malware, we can write a simple decryptor/encryptor to (re)configure the malware 👾🔓✍🏼🔒 → 🖥✅
As this (encrypted) info is embedded within the malware, we can write a simple decryptor/encryptor to (re)configure the malware 👾🔓✍🏼🔒 → 🖥✅
2️⃣ Second, we need to understand its protocol, so we can task the malware to reveal its capabilities.
A brief triage of the malware's binary shows us it sets up a local server and registers various "routes" - taskable via requests from a remote C&C server.
A brief triage of the malware's binary shows us it sets up a local server and registers various "routes" - taskable via requests from a remote C&C server.
Pretty excited for this talk by @patch1t about a one-click macOS takeover, starting out mentioning P0’s iMessage exploit and NSO’s Pegasus spyware. #HITB2022SIN
In his talk, @patch1t also gives a shoutout to @patrickwardle for this 2021 blog post about bypassing macOS's file quarantine, gatekeeper, and notarization requirements. #HITB2022SIN objective-see.org/blog/blog_0x64…
The story of CVE-2021-30657 was one of my favorite talks at #OBTS last year, esp. the way @cedowens, @jbradley89 and @patrickwardle talked through the steps to finding the initial flaw.
"Objective by the Sea" the Mac Security Conference, is back for v5.0!! 😍🥳 #OBTS
📍 Spain (near Barcelona)
🧑🏻💻 Trainings: Oct 3rd - 5th
🧑🏻🏫 Presentations: Oct 6th - 7th
Submit a talk or register today:
objectivebythesea.org/v5/index.html
...we can't wait to see y'all in sunny Spain! 🇪🇸
📍 Spain (near Barcelona)
🧑🏻💻 Trainings: Oct 3rd - 5th
🧑🏻🏫 Presentations: Oct 6th - 7th
Submit a talk or register today:
objectivebythesea.org/v5/index.html
...we can't wait to see y'all in sunny Spain! 🇪🇸
#OBTS v5.0 will be held at the lovely Le Méridien Ra Beach Hotel & Spa.
Only ~30 minutes south of Barcelona, the venue is located right on the sunny Mediterranean Sea ☀️🌴
We've negotiated a discounted group rate, so book thru the conference site: objectivebythesea.org/v5/location.ht…
Only ~30 minutes south of Barcelona, the venue is located right on the sunny Mediterranean Sea ☀️🌴
We've negotiated a discounted group rate, so book thru the conference site: objectivebythesea.org/v5/location.ht…
We're also stoked to offer new and expanded (3-day) trainings at #OBTS v5.0:
Training 0x1: "The Art of Mac Malware: Detection & Analysis" by @patrickwardle
Training 0x2: "Arm Reverse Engineering & Exploitation" by @Fox0x01 🦊
For more info/to sign up:
objectivebythesea.org/v5/trainings.h…
Training 0x1: "The Art of Mac Malware: Detection & Analysis" by @patrickwardle
Training 0x2: "Arm Reverse Engineering & Exploitation" by @Fox0x01 🦊
For more info/to sign up:
objectivebythesea.org/v5/trainings.h…
Was digging through court records related to Vault 7 and found this tidbit. The FBI used the wifi at Starbucks to download the leak. #OBTS
Day two of training, currently talking about Apple’s native OS X encryption scheme. #OBTS
Here's a 2013 blog post about Apple's native encryption scheme, h/t @patrickwardle. #OBTS cerbero-blog.com/?p=1311
⚠️ Latest macOS 0day (credit: Park Minchan)
...bypasses File Quarantine, Gatekeeper, etc.
Advisory:
📝 "macOS Finder RCE" ssd-disclosure.com/ssd-advisory-m…
😅 Confirmed Big Sur & Monterey are vulnerable
🧮 I've posted Park's PoC (pops Calc) if you'd like to play: objective-see.com/downloads/PoCs…
...bypasses File Quarantine, Gatekeeper, etc.
Advisory:
📝 "macOS Finder RCE" ssd-disclosure.com/ssd-advisory-m…
😅 Confirmed Big Sur & Monterey are vulnerable
🧮 I've posted Park's PoC (pops Calc) if you'd like to play: objective-see.com/downloads/PoCs…
The PoC once downloaded still has to be manually executed by the user.
macOS should, via File Quarantine/Gatekeeper, alert/warn/block as this is an 'executable' item from the Internet.
Apple attempted to patch (blocking file:// prefix), but File:// or fIle:// still work 🤣🤣🤣
macOS should, via File Quarantine/Gatekeeper, alert/warn/block as this is an 'executable' item from the Internet.
Apple attempted to patch (blocking file:// prefix), but File:// or fIle:// still work 🤣🤣🤣
ℹ️ The initial patch, will as noted, block items that attempt to abuse the "file://" prefix: (but not "File://" etc.):
[ #OBTS News ]
Objective by the Sea v4.0 (2021):
objectivebythesea.com/v4/
👨🏫 Training: 09/28 - 09/29
💬 Presentations: 09/30 - 10/01
📍 Location: Maui, Hawaii, USA
Can't wait to see y'all in lovely Maui!! ☀️🌴
...more details (venue, registration, etc.) soon!
Objective by the Sea v4.0 (2021):
objectivebythesea.com/v4/
👨🏫 Training: 09/28 - 09/29
💬 Presentations: 09/30 - 10/01
📍 Location: Maui, Hawaii, USA
Can't wait to see y'all in lovely Maui!! ☀️🌴
...more details (venue, registration, etc.) soon!
#OBTS v4.0 Call For Papers now open!
Themes of interest are 🍎-security topics, such as:
⚙️ OS internals
🦠 Malware analysis
🛠️ Tool making & breaking
🐛 Bug discovery & exploitation
CFP details: objectivebythesea.com/v4/cfp.html
Themes of interest are 🍎-security topics, such as:
⚙️ OS internals
🦠 Malware analysis
🛠️ Tool making & breaking
🐛 Bug discovery & exploitation
CFP details: objectivebythesea.com/v4/cfp.html
We've selected the newly remodeled beachside Westin Resort & Spa, in Ka'anapali Maui to host #OBTS v4.0🏖️ 😎
We've also secured a block of rooms at a massively discounted group rate. These will sell out, so don't wait (too long)!
More info / to book: objectivebythesea.com/v4/attending.h…
We've also secured a block of rooms at a massively discounted group rate. These will sell out, so don't wait (too long)!
More info / to book: objectivebythesea.com/v4/attending.h…
