Includes full technical analysis of LockBit's macOS arm64 variant ("locker_Apple_M1_64") + sample for download + heuristic methods of detection ๐ฅ
H/T @malwrhunterteam@vxunderground
First, (can't stress this enough), this variant though *compiled* for macOS is not specifically designed for macOS.
It's buggy (crashes), has an invalid signature, nor takes into account as of macOS's file-system security mechanisms.
So, impact to macOS users (for now): 0
Mar 30, 2023 โข 33 tweets โข 17 min read
RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) ๐๐โ ๏ธ
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
It contains a *notarized* app ("3CX Desktop App.app") ...meaning Apple checked it for malware "and none was detected" ๐โ ๏ธ 2/n
Mar 29, 2023 โข 5 tweets โข 3 min read
Ever wondered what it's like writing security tools for macOS? ๐ค
As Apple provides no official way to detect what app is using the webcam/mic, OverSight simply monitored the system log.
This was (independently) reported to Apple, who decided to assign it a CVE/patch it ๐ฅฒ๐คฆ๐ปโโ๏ธ
Unfortunately this means OverSight is now broken on macOS 13.3
Apple still doesn't provide a method for security tools to determine what app is accessing the mic/camera, even after years of requesting (begging) for this capability ๐ญ
Oct 10, 2022 โข 7 tweets โข 5 min read
I've just posted slides from my #OBTS v5 talk: "Making oRAT, Go" ๐๐
After creating a custom C&C server, we can uncover the malwareโs full capabilities - simply by asking (tasking) the right questions! ๐คญ
1๏ธโฃ First, we must understand how the malware figures out how to find its C&C server - so we can coerce it to talk to our C&C instead!
As this (encrypted) info is embedded within the malware, we can write a simple decryptor/encryptor to (re)configure the malware ๐พ๐โ๐ผ๐ โ ๐ฅโ
Sep 21, 2021 โข 4 tweets โข 3 min read
โ ๏ธ Latest macOS 0day (credit: Park Minchan)
...bypasses File Quarantine, Gatekeeper, etc.
๐งฎ I've posted Park's PoC (pops Calc) if you'd like to play: objective-see.com/downloads/PoCsโฆ
The PoC once downloaded still has to be manually executed by the user.
macOS should, via File Quarantine/Gatekeeper, alert/warn/block as this is an 'executable' item from the Internet.
Apple attempted to patch (blocking file:// prefix), but File:// or fIle:// still work ๐คฃ๐คฃ๐คฃ
The other "drivers" (e.g. 'C-00000291-...32.sys') appear to be obfuscated data ...and are x-ref'd (perhaps ingested?) by CSAgent.sys
Unfortunately this means OverSight is now broken on macOS 13.3
1 subscribed