Foreword |
|
xvii | |
Acknowledgments |
|
xix | |
Introduction |
|
xxi | |
Who Should Read This Book? |
|
xxiv | |
What You'll Find in This Book |
|
xxv | |
A Note on Mac Malware Terminology |
|
xxv | |
A Note on Safely Analyzing Malware |
|
xxv | |
Additional Resources |
|
xxvii | |
Books |
|
xxvii | |
Websites |
|
xxvii | |
Downloading This Book's Malware Specimens |
|
xxviii | |
Endnotes |
|
xxviii | |
|
PART I MAC MALWARE BASICS |
|
|
1 | (66) |
|
|
3 | (20) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
Pirated and Cracked Applications |
|
|
9 | (1) |
|
|
10 | (4) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
Account Compromises of Remote Services |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
20 | (3) |
|
|
23 | (24) |
|
|
24 | (2) |
|
Launch Agents and Daemons |
|
|
26 | (6) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
|
34 | (1) |
|
DYLD_* Environment Variables |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
37 | (2) |
|
|
39 | (2) |
|
|
41 | (1) |
|
|
41 | (1) |
|
|
41 | (1) |
|
Application and Binary Modifications |
|
|
42 | (2) |
|
KnockKnock ... Who's There? |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
45 | (2) |
|
|
47 | (20) |
|
Categorizing Mac Malware Capabilities |
|
|
47 | (1) |
|
Survey and Reconnaissance |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (2) |
|
|
52 | (2) |
|
Adware-Related Hijacks and Injections |
|
|
54 | (2) |
|
|
56 | (1) |
|
|
57 | (1) |
|
Remote Process and Memory Execution |
|
|
58 | (1) |
|
Remote Download and Upload |
|
|
59 | (2) |
|
|
61 | (1) |
|
|
62 | (2) |
|
|
64 | (1) |
|
|
65 | (1) |
|
|
65 | (2) |
|
PART II MAC MALWARE ANALYSIS |
|
|
67 | (152) |
|
|
69 | (30) |
|
|
70 | (2) |
|
Extracting Malicious Files from Distribution Packaging |
|
|
72 | (1) |
|
|
72 | (1) |
|
|
73 | (3) |
|
|
76 | (1) |
|
|
76 | (2) |
|
|
78 | (4) |
|
|
82 | (6) |
|
|
88 | (1) |
|
Microsoft Office Documents |
|
|
89 | (2) |
|
|
91 | (4) |
|
|
95 | (1) |
|
|
96 | (3) |
|
|
99 | (26) |
|
|
99 | (1) |
|
|
100 | (3) |
|
|
103 | (3) |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
107 | (2) |
|
|
109 | (3) |
|
|
112 | (1) |
|
Objective-C Class Information |
|
|
113 | (1) |
|
|
114 | (1) |
|
Identifying the Tool Used to Build the Binary |
|
|
115 | (1) |
|
Extracting the Nonbinary Component |
|
|
116 | (6) |
|
|
122 | (1) |
|
|
122 | (3) |
|
6 Disassembly and Decompilation |
|
|
125 | (24) |
|
|
126 | (1) |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (1) |
|
The objc_msgSend Function |
|
|
128 | (2) |
|
|
130 | (1) |
|
|
130 | (3) |
|
|
133 | (2) |
|
|
135 | (2) |
|
|
137 | (2) |
|
|
139 | (1) |
|
Reverse Engineering with Hopper |
|
|
140 | (1) |
|
Creating a Binary to Analyze |
|
|
140 | (1) |
|
|
141 | (1) |
|
|
141 | (2) |
|
|
143 | (2) |
|
Changing the Display Mode |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
147 | (2) |
|
|
149 | (16) |
|
|
150 | (1) |
|
The ProcessMonitor Utility |
|
|
151 | (2) |
|
|
153 | (1) |
|
|
154 | (1) |
|
|
155 | (2) |
|
|
157 | (1) |
|
macOS's Network Status Monitors |
|
|
158 | (1) |
|
|
159 | (1) |
|
|
160 | (3) |
|
|
163 | (1) |
|
|
163 | (2) |
|
|
165 | (22) |
|
|
166 | (1) |
|
|
167 | (1) |
|
Starting a Debugger Session |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (4) |
|
|
174 | (2) |
|
|
176 | (2) |
|
|
178 | (2) |
|
A Sample Debugging Session: Uncovering Hidden Cryptocurrency Mining Logic in an App Store Application |
|
|
180 | (5) |
|
|
185 | (1) |
|
|
185 | (2) |
|
|
187 | (32) |
|
Anti-Static-Analysis Approaches |
|
|
188 | (1) |
|
Sensitive Strings Disguised as Constants |
|
|
188 | (1) |
|
|
189 | (2) |
|
Locating Obfuscated Strings |
|
|
191 | (2) |
|
Finding the Deobfuscation Code |
|
|
193 | (1) |
|
String Deobfuscation via a Hopper Script |
|
|
194 | (3) |
|
Forcing the Malware to Execute its Decryption Routine |
|
|
197 | (3) |
|
|
200 | (1) |
|
Bypassing Packed Binary Code |
|
|
201 | (2) |
|
Decrypting Encrypted Binaries |
|
|
203 | (1) |
|
Anti-Dynamic-Analysis Approaches |
|
|
204 | (1) |
|
Checking the System Model Name |
|
|
205 | (1) |
|
Counting the System's Logical and Physical CPUs |
|
|
206 | (1) |
|
Checking the System's MAC Address |
|
|
207 | (1) |
|
Checking System Integrity Protection Status |
|
|
208 | (1) |
|
Detecting or Killing Specific Tools |
|
|
208 | (1) |
|
|
209 | (2) |
|
Preventing Debugging with ptrace |
|
|
211 | (1) |
|
Bypassing Anti-Dynamic-Analysis Logic |
|
|
212 | (1) |
|
Modifying the Execution Environment |
|
|
213 | (1) |
|
Patching the Binary Image |
|
|
213 | (2) |
|
Modifying the Malware's Instruction Pointer |
|
|
215 | (1) |
|
Modifying a Register Value |
|
|
216 | (1) |
|
A Remaining Challenge: Environmentally Generated Keys |
|
|
216 | (1) |
|
|
217 | (1) |
|
|
217 | (2) |
|
PART III ANALYZING EVILQUEST |
|
|
219 | (62) |
|
10 Evilquest's Infection, Triage, and Deobfuscation |
|
|
221 | (22) |
|
|
221 | (2) |
|
|
223 | (1) |
|
|
223 | (1) |
|
|
224 | (1) |
|
|
225 | (4) |
|
Extracting Embedded Information from the patch Binary |
|
|
229 | (2) |
|
Analyzing the Command Line Parameters |
|
|
231 | (1) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
Analyzing AntiAnalysis Logic |
|
|
233 | (1) |
|
Virtual Machine-Thwarting Logic? |
|
|
233 | (1) |
|
Debugging-Thwarting Logic |
|
|
234 | (4) |
|
|
238 | (4) |
|
|
242 | (1) |
|
|
242 | (1) |
|
11 Evilquest's Persistence and Core Functionality Analysis |
|
|
243 | (38) |
|
|
243 | (1) |
|
Killing Unwanted Processes |
|
|
244 | (2) |
|
|
246 | (1) |
|
Persisting the Copies as Launch Items |
|
|
247 | (2) |
|
Starting the Launch Items |
|
|
249 | (3) |
|
|
252 | (1) |
|
The Local Viral Infection Logic |
|
|
253 | (1) |
|
Listing Candidate Files for Infection |
|
|
254 | (1) |
|
Checking Whether to Infect Each File |
|
|
255 | (2) |
|
|
257 | (3) |
|
Executing and Repersisting from Infected Files |
|
|
260 | (2) |
|
Executing the Infected File's Original Code |
|
|
262 | (1) |
|
The Remote Communications Logic |
|
|
263 | (1) |
|
The Mediator and Command and Control Servers |
|
|
263 | (2) |
|
|
265 | (1) |
|
|
266 | (2) |
|
|
268 | (1) |
|
|
268 | (1) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
The File Exfiltration Logic |
|
|
271 | (1) |
|
Directory Listing Exfiltration |
|
|
271 | (1) |
|
Certificate and Cryptocurrency File Exfiltration |
|
|
272 | (3) |
|
|
275 | (2) |
|
|
277 | (1) |
|
Better Anti-Analysis Logic |
|
|
278 | (1) |
|
Modified Server Addresses |
|
|
279 | (1) |
|
A Longer List of Security Tools to Terminate |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
280 | (1) |
|
|
280 | (1) |
|
|
281 | (1) |
Conclusion |
|
281 | (1) |
Endnotes |
|
282 | (1) |
Index |
|
283 | |