Stephan Berger - Deconstructing Modern macOS Initial Access Vectors

Heat. Heat. [music]

[music]

Yes, thank you. Thank you for coming to my talk. Yes, Max don't get hacked. We will see. Why is that not true? So, my name Thanks you for the introduction. My name is Stefan. You call me Steven. I'm from Switzerland. I love mountains. I love hiking. I love IT security. I love digital forensics. And that's basically all you have to know about me. You can follow me on social media. Otherwise, get in touch after the conference. Um, so sneak peek of what to expect from this presentation. It's it's silly because if you think that might be the most technical talk you will hear all day, it's not true because what you are seeing here, this is from 8 years ago

and it's from from the SANS incidents um internet storm center and it's really funny because previous days we see multiple Mac OS malware attacks originating within cryptoreated Slack. So what you're seeing here is how users on Mac OS get infected. If you are familiar within with terminals with shell scripting or whatever what you're seeing here is copy code download something from the internet make it executable and run it. I mean just looking at it as an IT professional would say malicious malicious malicious fast forward to up to date it might be still the same infection chain as we will see later on to give you expectation. So bit of expectation management right now. Last year or two

years ago, I attended a training class. It was called evading edrs. And I can assure you my brain melted after every day because it was so damn complicated. Windows malware was so super evasive and can be so complicated. And in the next 40ish minutes, we will see how easy Mac OS malware is compared to Windows malware. So don't please be [laughter] please so to set the expectation to set the stage Mac OS malware is not that complicated because like here is another example it can't get easier than that this is from Reddit couple it's it's still um pretty fresh post here the question is did I just run malicious code did I just run a

malicious script what would you say just looking at it the user said hey I came across this site here and then the following because I visited that site and on the site it was written run that command. What the user did he run the command just looking at it is download something with curl and execute it with pipe to pash. I mean could it get easier than that? How do you prevent that from users? because that is really the lowest bar you can get from an infection vector and still we will come to that or speak later about that. Click fix also enter the arena when it comes to Mac OS systems. So click fix is no longer a windows only

problem. It's but it's the same thing here again. Copy and paste the following code into terminal bash do something download something etc etc. Always the same things when it comes to Mac OS security we must think about three steps. So first thing is delivery. as an attacker, as a red teamer or just a criminal, I want to get the user to download something, to execute something and then to do something with that code or the execution. So the first thing we will talk about is the delivery vector. How do the um the malicious payload reach the user? Is it via email? Is it via clickfix? Is it via I don't know download link? Something. And then the

second thing we will talk about is the container. what did the user receive. When you come from a strictly Windows background, you might be surprised what Mac OS is is is completely a different game. So when you know zip files, you don't know maybe DMG files. When it comes to Mac OS security, when you know um I don't know packages from Mac OS, it might be the same as an MSE package, but not not vice versa. So it's really complicated. We don't have that much time, so bear with me if I cut things short here. Um, this is exactly the next slide. I talked a lot about that stuff, so you can watch it on YouTube. I did a last last year a

presentation at Civcon which goes more into details about the forensic side of Mac OS. Um, and also on my on my blog post, you'll find different [laughter] when you're attended my presentation yesterday, you know, I wrote a blog post about it. So, you find different stuff on my blog post as well. Uh let's speak quickly about Mac OS protections because yes it's not true that MacOSS is safe by design so Mac does get hacked and also as a criminal why do I want to get my implant running on a Mac code why is it a juicy target for attackers because like my colleague Oen the the last thank you for attending the talk because he also said attackers

especially stealers they love to steal cookies. They love to steal passwords. And it's the same on Mac OS because if I infect a Mac OS device, what I get are credentials. Credentials for hopping into a network. Maybe VPN credentials, maybe Azure credentials, maybe AWS credentials. I can pivot to a different organization easily if I steal code for example. So this makes Apple or Mac OS devices a prime target for attackers. And here is it's not true that Mac OS is an unsafe operating system because Apple invested a lot of money to make Mac OS a secure operating system. And here is really roughly the chain of protections. So first things first a user downloads something. When you download something

from within Safari, Chrome or whatever from Mac OS, what Mac does is it kind of attached a stamp to your downloaded file. It's called a quarantine flag like mark of the web when you come from a Windows background. It just tells the application the operating system. This one here was downloaded from the internet. Then comes gatekeeper. We will talk about gatekeeper in a in a slide. Just bear with me. And code notoriization. X protect is the antivirus engine from ML which also does the checks. And then come TCC. So to go into a little bit of details here, gatekeeper is like a bouncer in a nightclub. So if you want to go to a nightclub, the bouncer might check your

identification card. Are you old enough? Are you dressed well enough? Are you probably sober enough to enter the club? And Apple gatekeeper does the same thing. It checks, hey, do you come from the internet? Might be bad. Do you have a signature? Is it revoked? Is it legit? If all these checks are passed, the malicious code in quotes or the legitimate code might run. It really depends here if it's legit or not. Attackers are using or misusing exactly that technique to run code as we will see later on. So keep that in mind. What we are seeing here is if you if you have used Mac OS in the past, this is a classic example of all the prompts you

might have received in the past. program cannot be open because it's from an undefended developer. Mac OS cannot verify that this app is free from malware. This is not a hard check. Social engineering is really a thing when it comes to Mac OS infection vectors. Attackers are misusing that prompt. I have a slide for that later on. One of the really cool things when it comes to Mac OS protection is that thing here that guy transparency consent and control. When do you have a Windows computer and you install malware and you run that thing with administrative rights? The malware basically have all the permissions to run on it. When it compares that to TCC, what it does is

especially it grants you rights only to certain parts of the operating system. So you run it and then maybe the implant the malicious code might only have access to room A but to enter room B there is another bouncer who checks hey okay you have an entry ticket for room A but you don't have an entry ticket for room B so I must check you again and you must especially grant access to room B do you want to do that so this is another hurdle for Mac OS or for malware running on Mac OS it's pretty cool so you see here this is from malware. The right on the right hand side the image terminal app would like to access file

in your documents folder. Why? For stealing purposes of course. All right. Delivery. Probably the most interesting part here is how you as network defenders or you as red teamers maybe can deliver that stuff to users. What you are seeing here is Google ads and we responded to an incident this week where a malicious download or a malicious ad was used to trick a user to download something from a malicious website of course. So what the user did in this week's incident was he was searching for was it remote monitoring a legitimate software from Windows hosted on a Windows website but the first thing he saw on Google was a malicious advertisement. So the user clicked the first thing he saw on Google

was led to a fake website and downloaded malicious code. This one here is super super effective. Don't underestimate that infection vector. It might sound silly, but users are trained to really click on the first link they see. I had a discussion yesterday if it's would be fruitful to block a malicious or just advertisement. If you have a proxy, if you're proxying the traffic in your network, I might suggest that you block out um just advertisement. Get rid of that stuff. closely related to malicious ads are fake applications because like I said before the user in this week's incident was in the intention that he was downloading a legitimate application he was not downloading a malicious

application alleg malicious a legit application because how can you be sure as a user that you are really landed on the right page what we are seeing here is hey it's like for business.net looks legit, right? Of course. Yes. And this is the thing I think when you're talking about corporate security. I'm I'm in a constant discussion about people who are doing like social engineering or fishing test for a living because I said we are spending so many dollars, euros, whatever just for fishing trainings. There are so many more infection vectors. Do you train also your people to to spot that stuff here? How can you make sure this is a legitimate application? And this one here is really cool. This

one is you see here clear system data on Mac sponsored results first hit. It doesn't lead to a malicious website. It does lead to chatgpt.com. Legit? Maybe. No, of course it's not. So when you as a user click on a link sponsored result Chachi PT and the link goes to a legitimate website, what we are seeing here on the right hand side is a really nice guide for a user. So I as a user I'm I'm I'm on a legitimate website and I'm reading a somehow looking legitimate guide how to clean up stuff on my Mac. This is from a recent campaign from Amazon InfoStealer. Super super trendy info stealer and it's super successful. Why? Because how can you

spot that stuff? Maybe maybe it's always the same thing. Paste this into terminal and press return. Who does that? If you're using a Mac, who does that? Um, yep. I don't have a solution to that problem because apparently we will come to that. Mac or Apple might have a solution to that. Um, a new infection vector which also popped up in in the last few or just one or two years is malicious skills. Everybody, my mother, my brother, my grandmother maybe is using AI. AI really became a thing not only for techies but also for normal people. What normal people are doing right now is installing claw, is installing codecs, whatever. Cloning repositories from GitHub. Within

these repositories is a thing called skills. Skills are essentially just on top of something you can use. within these kills are malicious comments which will again infect your system. But keep in mind all these repos there are faked to look legitimate. So almost 400 stars on GitHub again. How can you spot that stuff? It's pretty difficult. This one here is pretty good. I read that this week or last week from Rob Rob Tele is one of the most of the most famous guys in IT security or forensics. What will I do on a Monday? And he said look for claw files. Look for skills. Do your edr check cla skills. Maybe you have a blind

spot here. And I think this is a pretty cool slide or a cool um cool thought. Maybe you should also start checking that one. If you're doing scanning, AB scanning, do you also score um like scan cloud files or just VS Code files and cursor directories? Uh yep, I'm sure. Or just raise your hand please if you have never heard of clickfix because I gave that presentation last year last week on our other Bites conference. You never heard of B click fix? So it's really a thing. It's so basic in a nutshell what the users or we as users are heavily trained to solve captures, right? Cloudflare captures. So when you want to to do maybe a puzzle,

maybe you have to like solve an equitation, two plus blue is four. And now because users are so heavily trained to solve captures, Cloudflare captures what the attackers it started on Windows it progressed to Mac OS. What you're seeing here is really simple that you have to verify that you are a human and it's again step by step. What you have to do is verification requires one manual step. You have to open terminal and guess what? You have to copy paste again that silly comment we saw before. It's again that guy here that bash do something do something. It's always the same thing. We are not talking about like evasion of an edr. We are not

talking about crazy sis calls you have on in the Windows world. This is really just bash download something execute something. It couldn't be easier. Um, this one here is just another example of the clickfix technique. I think it's pretty cool because what the attackers did, it's it's not clickfix anymore because a lot of users or a lot of techies know about clickfix. What we are seeing here is uh reclaim d space again on Mac. So the user ended up chat GPT but now we don't have to open a terminal. Not again that terminal not copy pasting. All the user has to do is click on a link. Clicking on a link. And you see here do you want

to allow this website to open script editor? A website want to open script editor? [snorts] Yes. No. Maybe. [laughter] Always allow. Allow. Cancel. Probably most users or most victims will just click allow because as we know from years of years of years of infection users just clicking clicking clicking allow that stuff run that stuff. And now comes the beautiful part. If the user click on allow or just open script editor what he will see is wechathat. And then here you have press that that little guy here to install WeChat. It's a beautiful pretext to infection chain. You are not downloading something from the internet. You are not pasting something from the internet. All the user did was open the application or

just visit the chat GPT, click on open script editor and then push the run button. I think it's beautiful because it's so easy. And how can you how can my mother possibly spot such a thing? Because next next next, who cares? Okay, so now we we talked about the infection vectors. Now let's get a bit um yourself of a knowledge about containers. When you're coming strictly from a Windows world, you might have never heard of Apple disk images. So it's really brief. So bear with me please because we don't have much time. Apple disk images is basically in a nutshell like a container like an archive file. It could be used for shipping legitimate software because

it's easy to pack, easy to ship and then as a user I double click it and it open as a virtual mount disk. So easy. If you ever used Apple disk or Apple um devices before, you know it. You open it and then you have like a an application and then you can move that application to the application folder. That's legitimate use now because we saw that guy before that gatekeeper that clicking stuff is not possible anymore since two years or so or that technique was possible since two years because what the attacker did they send or they love to send just DMG files the user had to open it and the user had to doubleclick it. Double clicking was

prevented and then here is the pretext of a malicious campaign. They attackers used social engineering to trick users to run that stuff. So it was easy as okay gatekeeper blocked it. All you have to do is right click on it and then click open. Now it's a bit trickier because you have to go to system settings privacy to allow the app to run. But we will see later on how the attackers also accomplish that. Packages. I think this one here is also a pretty cool slide. Uh, Windows malware hooking undocumented Windows API functions to evade machine learn based EDR detections. Mac malware just to bash scripts in a trench code hiking in a pkg file.

What does that mean? So packages are like DMG files just a container for shipping software. Speaking in a Windows world language packages are closely closely related to MSI files just to install something. What you are seeing here is also beautiful because as an attacker I can take a legitimate application like Slack pack that stuff that legitimate application in a package but add a script to it. These scripts you see here this is also from um um from a malware campaign runs one install script. What you can do with a package is you can either run a pre-install script or a post-install script. So the user like we see before we saw before is searching for Slack on a fake Slack website. He

downloads a package. The installer might install Slack but in the background something else might run as well like a bash script stealing all your data. And this is pretty cool also coming from a from a defensive perspective. Maybe you want to block packages on your proxy. Maybe you should look into packages when you have an AV solution which scans for files. Do you scam bash files? Could your AV detect just a malicious bash files? So bash scripts is the next topic. What you're seeing here is exactly that post install script we saw before. And what the installation is doing here, it's just one little code X code select install install something and the malware will run on your system.

It will get installed. And we are not talking here about malicious executables. We know from the Windows world. This one here is really bash code as simple as it could get. If you have an edr on Mac OS, again it's pretty difficult to spot that stuff.

Um, when it comes to user awareness, again, users are trained not to enter their credentials in fishing pages. But what we are seeing here, this is not a disk image. So when you're coming from a Mac OS background, we all know about I'm moving my application to the application folder for installation. This here is a pretty cool trick because it mimics the same installation dialogue. But we are seeing here a zoom app which you have to put into the terminal. So it it abuse the trust or the functionality you as a user known about Mac OS. And this is not this is not an application. This is just a bash script you have to um pull into terminal

and then again some malicious code will run. So drag and drop pretty easy. What you're seeing here is just executing code basically like I said in the introduction of this talk. It's not rocket science. I hope you're not disappointed by 40 after 40 minutes because [laughter] it's always some code pretty pretty nifty social engineering techniques and then something something happen on your device. So for the guys who don't know click fix here is another uh slide download for Mac OS. So pretty easy [laughter] again after all this is not rocket science but extremely successful now because click fix is really really a thing on Windows and also on the Mac OS world and then Apple came along and said

okay we have to do something about that stuff. How could we protect our users better against clickfix? They said okay we try to protect our users because also designers not only techies but also common people are using Mac devices because for again my mother it might be really hard to say is this really something I should care or do I have to run that stuff. So Mac they came up with a solution which blocks copy pasting stuff from the internet into your terminal like again as a regular user nobody is opening a terminal ever. So what they did was they implemented that stuff in over 70 applications. So when you are copy pasting something from Chrome, Safari,

um I don't know from your mail brow from your mail program etc etc the list is long it might get blocked. Now here comes the catch. If you have ever opened your terminal on your MacBook if you have installed something like Xcode on your MacBook etc. you will not get or we you will not receive a warning. So it's really hard aggressive checks. Yeah, exactly. you're nodding your head because if that's really the solution Apple came up with to be better with that stuff I think okay um I had a talk I think it was last last week or so when we said okay because the attacker are adapting as well so the social engineering pretext

could be open up your terminal close your terminal open up your terminal again and paste that stuff inside [laughter] Then you circumvented that check and it's all gone. It's tricky. Yeah, this is might be the only forensic slide I have because all that stuff, most of these infection vectors are utilizing the bash are utilizing terminal. So you as a forensic analyst, you still find traces of that stuff. It might be too late that the malicious code um already stole the passwords, the the cookies, whatever. But you still might traces of it because bash I wrote also a blog post about that. You find it interestingly if you never worked with Mac OS before or you coming strictly

again from a Windows world, there is a thing called Apple script. So Mac OS has its own scripting language and when you're coming from a detection engineering background that might be interesting because on an Apple on a Mac OS device you have not only um bash installed but you might also have Python installed or Rabby or other scripting languages. So Apple gives you as an attacker a really a playground of options how to run your code and Apple script is heavily used by all these dealers. What you're seeing here on the left hand side is just how that code looks. This is oscript apple script code. In a nutshell, what a code does it collecting

um your browser history, your keychain, your passwords, whatnot, and send it out again like my colleague again demonstrated pretty good. Send it just out, ship it off to a Telegram B or whatever that happens within minutes and all your credentials are gone. And again, I mean that that stuff here, we are not talking about crazy AP techniques. What the attackers are doing is you get that pretext. So you download something from a malicious website or you click on something and then you see that dialogue here and then you have all the steps you need to take as an user to run that application. We saw before Mac OS has different techniques and protections gatekeeper notoriization

TCC. the attacker know all that stuff. What do you then they try to to to tell the user exactly what they have to do. If the application is not running, go to settings privacy security scroll down, click on open anyway, and there you go, the application runs. Like I said before, there is a guy called TCC which prevent access to certain rooms on your Mac OS device. So if you go through that list here, you have access to room A. But now as an attacker, I want to get access to room B. For that, I need the password of the user. And now comes the Oh, I'm sorry. The quality is a bit bad here on the screen.

It's pretty easy to pop a dialogue on Mac OS and the attackers are using that a lot like we're seeing here. So to launch the application, you need to update the system settings. Please enter your password with something. This happens all the time with Mac OS dealers. They are prompting the user for the passwords all the time. And the users comply, they enter the password, they press enter, and now the malware have full access to your device. It couldn't get easier than that. Um the next thing here because Apple scripts is not only copy pasting you as an attacker, red teamer or whatever. Blue teamer with interests could also send SCP files to users. So the

infection vector shift from just clicking on a link to open up an email attachment for example. But we see the same thing we saw before. What you're seeing here is the Apple script editor, Microsoft Team SDK. It looks legit. Update Teams SDK to newer version. It's always misusing the trust of the user to run something and again and again the cycle just repeats. It's always the same. All you all you have to do is because when you open up that SCP file all you do have to click here on that button and then off you go the malware will run. This is another example. Zoom meeting SDK support update Zoom meeting.

You should be you should be an expert by now what that script is doing. Basically always the same do shell script curl. So coral is the command to download stuff from the internet. It downloads something from a remote web page and then do shell script run script. [laughter] Basically just the same pattern all over again. And Apple thought yes okay script editor might be a thing. We might do want to be clever. And they also engineered something to protect users from opening that stuff. So what you're seeing here is an additional warning prompt is presented to the users. This script is from an unidentified developer. Do you want to run it? But then again, maybe is that really enough to protect

users from running that stuff? I'm just thinking about if you are like in corporate security and you are part of a security team which have to protect Mac OS users, how do you protect your user base from all that stuff? because it's not as easy as it might seems because again I personally receive all the time all these fishing campaigns do not enter your passwords do not click on that stuff here but all this stuff this is different game so maybe you have to also think about that if you want to really defend your network uh supply chain is really really a big topic when it comes to Mac OS security I have just a few slides on that topic

because maybe you've heard of this one here. It was called the uh X C Eccon but anyway this was a really famous campaign which was going on since a few years I think because you have a thing called Xcode under Mac OS and Mac OS is a famous environment so for developers so you can run code develop code with Xcode under Mac OS Yes. And now the North Korean or allegedly the North Korean they set up fake coding interviews. So they set up a company and they said, "Hey, we are hiring people. Do you want to work with us?" And then some people from really famous companies, they said, "Oh, this looks interesting. I want to work for

this company." They schedule a meeting. And once they are on the meeting, the the North Korean or just the attacker said, "Okay, I have a coding question or a coding challenge for you. Download this repo and just follow along the task." Within the repo, there might be like functions you have to code out and whatever. Just looking at the barebones script, it looks like really a coding challenge. Nothing malicious there, but within. So the Xcode project was not malicious but within the Xcode projects file is a thing called project PBX project whatever and within these projects files you can also define scripts which will run when you build your project. This was a super effective and also trendy

campaign used by allegedly North Koreans. And again, if you are defending networks, you might take that into account. It's not just looking at the code. It's really making sure that you know all the angles attackers can use or misuse to infect that stuff. I think the funny funny and also hilarious part of all that things is even as sophisticated as these attackers might be the bottom thing which runs on your system is always because this one here is I found out on GitHub it's an old commit from um from such a repository used by attackers what will run on your system is base 64 4 decode base 64 decode decode decode echo pi pi pipe pipe to bash. It's it's just

code running on your system. It's nothing special as sophisticated as all these Mac OS infection vectors might seem from a higher level. At the end of the day, at the at the bottom line, it's always code. It's always something something running on your system with bash with with just a malicious executable. Exactly. So this one here just to wrap up here. This is a long living campaign super successful. So Microsoft T Micro and another guys Palo Alto spoke about it. It's basically just downloading code build it script runs infect your computer. Um, but all is not lost when it comes to forensics. That's why I love my job. And if you attended my workshop yesterday, I

gave a workshop about anti-forensic techniques. It's super hard to really stay under the radar that not to leave breadcrumbs, not to leave traces as an attacker. However, in that case here, it might be too late. So, if you have an infection of a Mac OS device, it might be really wise to rotate all passwords, making sure the user is not logging on via VPN from uh like shady locations and stuff. But to give you a little overview, we we could find traces of all that stuff on the download browser history of course origin with a quarantine flag mounting a DMG file leave traces in LO files. PKG files installation leave traces in log files execution endpoint security. So Mac OS

has a really cool feature called ES logging all that stuff. Apple script leave traces persistent leave traces so you know where I'm heading to. So if you are interesting in securing your Mac OS fleet you have a really good groundwork already present. So you will not start from the beginning. So you can really start what just front end on the deep end and get yourself comfortable with all that stuff. I am absolutely on time. 3 minutes left. Over and out. Thanks for the attention. >> [applause]

>> Great job. So, let's see if the crowd have any questions for you.

Anybody? Here we go.

>> Hello. Well, yeah. Okay. Thank you. If we are using some kind of um endpoint privilege management um tool, for example, something from Cyber Arc, something from Beyond Trust, uh admin by request, how does this uh fit into here? Will it uh protect uh some of the techniques? >> It depends. [laughter] No, that's the thing I said yesterday in my workshop a lot of times is test it out. Don't assume something when it comes to network detections or just detection techniques. My my recommendation to people is always install your EDR, install your protection layers on a VM, on a machine and follow along these techniques I just presented. Download your malware from the internet, run it,

look at the traces. It's really hard to say from from this layer here. I don't know. Maybe

All right. Hello. Hello. Uh, edrs yada yada yada. For the average corporate Joe and Joanna, why don't we just disable stuff? >> Yeah, you tell me. [sighs] I'm just working as a consultant. I don't know. No, of course. My No, my recommendation is always disable stuff. Always block it. Hard block it. Windows world app locker. remove admin rights, just block everything. And then comes the customer and said, "But our users demand it. Our users are not comfortable with that stuff." And it's just exceptions, exceptions, exceptions. At the end of the day, you have an infection. Yep. [snorts] I'm on your page. [laughter] Anybody else? Okay. Thank you all for listening. Thank you for the presentation. And uh we'll

see you after the coffee break. Bless. [applause]