The Art of Mac Malware, Volume 2 Detecting Malicious Software (Patrick Wardle)（Z-Library）

® The Art of Mac Malware Detecting Malicious Software Patrick Wardle VOLUME 2“If you want to study these techniques, you’d better learn from the best.” —Maria Markstedter, founder of Azeria Labs and Forbes Person of the Year in Cybersecurity THE F INEST IN GEEK ENTERTA INMENT ™ www.nostarch.com ® Wardle The Art of Mac Malware Detecting Malicious Software ® As renowned Mac security expert Patrick Wardle notes in The Art of Mac Malware, Volume 2, the substantial and growing number of Mac users, both personal and enterprise, has created a compelling incentive for malware authors to ever more frequently target macOS systems. The only effective way to counter these constantly evolving and increasingly sophisticated threats is through learning and applying robust heuristic-based detection techniques. To that end, Wardle draws upon decades of experience to guide you through the programmatic implementation of such detection techniques. By exploring how to leverage macOS’s security-centric frameworks (both public and private), diving into key elements of behavioral-based detection, and highlighting relevant examples of real-life malware, Wardle teaches and underscores the efficacy of these powerful approaches. Across 14 in-depth chapters, you’ll learn how to: Capture critical snapshots of system state to reveal the subtle signs of infection Enumerate and analyze running processes to uncover evidence of malware Parse the macOS’s distribution and binary file formats to detect malicious anomalies Utilize code signing as an effective tool to identify malware and reduce false positives Write efficient code that harnesses the full potential of Apple’s public and private APIs Leverage Apple’s Endpoint Security and Network Extension frameworks to build real-time monitoring tools This comprehensive guide provides you with the knowledge to develop tools and techniques, and to neutralize threats before it’s too late. About the Author PATRICK WARDLE is the founder of Objective-See, a nonprofit dedicated to creating free, open source macOS security tools and organizing the “Objective by the Sea” Apple security conference. Wardle is also the co-founder and CEO of DoubleYou, a cybersecurity startup focused on empowering the builders of Apple-focused security tools. Having worked at both NASA and the National Security Agency and having presented at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. VOL 2

THE ART OF MAC MALWARE, VOLUME 2

® T H E A R T O F M A C M A LW A R E Vo l u m e 2 D e t e c t i n g M a l i c i o u s S o f t w a r e by Patr ick Wardle San Francisco

[E] THE ART OF MAC MALWARE, VOLUME 2. Copyright © 2025 by Patrick Wardle. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. First printing ISBN-13: 978-1-7185-0378-6 (print) ISBN-13: 978-1-7185-0379-3 (ebook) Published by No Starch Press®, Inc. 245 8th Street, San Francisco, CA 94103 phone: +1.415.863.9900 www.nostarch.com; info@nostarch.com Publisher: William Pollock Managing Editor: Jill Franklin Production Manager: Sabrina Plomitallo-González Production Editor: Jennifer Kepler Developmental Editor: Frances Saux Cover Illustrator: Garry Booth Interior Design: Octopod Studios Technical Reviewer: Tom McGuire Copyeditor: Lisa McCoy Proofreader: Audrey Doyle Indexer: BIM Creatives, LLC Library of Congress Control Number: 2024034450 For customer service inquiries, please contact info@nostarch.com. For information on distribution, bulk sales, corporate sales, or translations: sales@nostarch.com. For permission to translate this work: rights@nostarch.com. To report counterfeit copies or piracy: counterfeit@nostarch.com. No Starch Press and the No Starch Press iron logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. ®

To my loving and patient parents, Stephen and Norma. And to Andy #UnaMas para siempre.

About the Author Patrick Wardle is the founder of Objective-See, a nonprofit dedicated to creating free, open source macOS security tools and organizing the “Objective by the Sea” Apple security conference. He is also the co-founder and CEO of DoubleYou, a cybersecurity startup focused on empowering the builders of Apple-focused security tools. Having worked at both NASA and the National Security Agency and having presented at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. About the Technical Reviewer Tom McGuire has been working in the security industry since the late 1990s. He is the chief technical officer of a cybersecurity firm and a senior instructor at the Johns Hopkins Whiting School of Engineering, where he teaches reverse engineering, operating system security, cryptology, and cyber risk management. When not doing security stuff, he can be found hanging out with his family and watching the Red Sox.

B R I E F C O N T E N T S Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi PART I: DATA COLLECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Chapter 1: Examining Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Chapter 2: Parsing Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Chapter 3: Code Signing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Chapter 4: Network State and Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Chapter 5: Persistence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 PART II: SYSTEM MONITORING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139 Chapter 6: Log Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Chapter 7: Network Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Chapter 8: Endpoint Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Chapter 9: Muting and Authorization Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 PART III: TOOL DEVELOPMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231 Chapter 10: Persistence Enumerator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Chapter 11: Persistence Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 Chapter 12: Mic and Webcam Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 Chapter 13: DNS Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 Chapter 14: Case Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329

C O N T E N T S I N D E T A I L FOREWORD xvii ACKNOWLEDGMENTS xix INTRODUCTION xxi What You’ll Find in This Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxiii Who Should Read This Book? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxiv The Code and Malware Specimens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxv Development Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxvi Code Signing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxvi Entitlements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii Safely Analyzing Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxix Books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxix Websites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxix PART I: DATA COLLECTION 1 1 EXAMINING PROCESSES 3 Process Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Audit Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Paths and Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Identifying Hidden Files and Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Obtaining the Paths of Deleted Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Validating Process Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Process Arguments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Process Hierarchies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Finding the Parent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Returning the Process Responsible for Spawning Another . . . . . . . . . . . . . . . . 16 Retrieving Information with Application Services APIs . . . . . . . . . . . . . . . . . . 17 Environment Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Code Signing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Loaded Libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Open Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 proc_pidinfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 lsof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Execution State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Execution Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Start Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 CPU Utilization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

xii   Contents in Detail 2 PARSING BINARIES 39 Universal Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Inspecting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Parsing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Mach-O Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Load Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Extracting Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Finding Dependency Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Analyzing Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Extracting Symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Detecting Packed Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Dependencies and Symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Section and Segment Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Entropy Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Detecting Encrypted Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3 CODE SIGNING 75 The Importance of Code Signing in Malware Detection . . . . . . . . . . . . . . . . . . . . . . . 76 Disk Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Manually Verifying Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Extracting Code Signing Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Extracting Notarization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Running the Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Reverse Engineering pkgutil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Accessing Framework Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Validating the Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Checking Package Notarization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Running the Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 On-Disk Applications and Executables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Running Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Detecting False Positives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Code Signing Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 4 NETWORK STATE AND STATISTICS 101 Host-Based vs . Network-Centric Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Malicious Networking Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 Capturing the Network State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Retrieving Process File Descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Extracting Network Sockets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Obtaining Socket Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Running the Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Enumerating Network Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Linking to NetworkStatistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Creating Network Statistic Managers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Contents in Detail   xiii Defining Callback Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Starting Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Running the Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 5 PERSISTENCE 119 Examples of Persistent Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Background Task Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Examining the Subsystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Dissecting sfltool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Writing a Background Task Management Database Parser . . . . . . . . . . . . . . . . . . . . 130 Finding the Database Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Deserializing Background Task Management Files . . . . . . . . . . . . . . . . . . . . 131 Accessing Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Identifying Malicious Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Using DumpBTM in Your Own Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 PART II: SYSTEM MONITORING 139 6 LOG MONITORING 141 Exploring Log Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 The Unified Logging Subsystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Manually Querying the log Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Reverse Engineering log APIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Streaming Log Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Extracting Log Object Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Determining Resource Consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 7 NETWORK MONITORING 155 Obtaining Regular Snapshots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 DNS Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Using the NetworkExtension Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Activating a System Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Enabling the Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Writing the Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Filter Data Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Enabling Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Writing the Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Querying the Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Running the Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

xiv   Contents in Detail 8 ENDPOINT SECURITY 179 The Endpoint Security Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Events of Interest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Clients, Handler Blocks, and Event Handling . . . . . . . . . . . . . . . . . . . . . . . 185 Creating a Process Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Subscribing to Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Extracting Process Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Extracting Process Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Stopping the Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 File Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 9 MUTING AND AUTHORIZATION EVENTS 205 Muting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 Mute Inversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 Beginning Mute Inversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Monitoring Directory Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Authorization Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 Creating a Client and Subscribing to Events . . . . . . . . . . . . . . . . . . . . . . . . 213 Meeting Message Deadlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Checking Binary Origins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Blocking Background Task Management Bypasses . . . . . . . . . . . . . . . . . . . . 219 Building a File Protector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 PART III: TOOL DEVELOPMENT 231 10 PERSISTENCE ENUMERATOR 233 Tool Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Command Line Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 Persistent Item Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238 Exploring the Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 Background Task Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 Browser Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Dynamic Library Insertion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Dynamic Library Proxying and Hijacking . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 11 PERSISTENCE MONITOR 253 Entitlements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 Applying for Endpoint Security Entitlements . . . . . . . . . . . . . . . . . . . . . . . . 254 Registering App IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Contents in Detail   xv Creating Provisioning Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Enabling Entitlements in Xcode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Tool Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Background Task Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 XPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Creating Listeners and Delegates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Extracting Audit Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Extracting Code Signing Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 Setting Client Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Enabling Remote Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 Exposing Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 Initiating Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 Invoking Remote Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 12 MIC AND WEBCAM MONITOR 279 Tool Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Mic and Camera Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 Audio Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 Camera Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 Device Connections and Disconnections . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 Responsible Process Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Triggering Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 Stopping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 13 DNS MONITOR 297 Network Extension Deployment Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 Packaging the Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 Tool Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 The App . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 The Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 Interprocess Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Building and Dumping DNS Caches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 Blocking DNS Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Classifying Endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311 14 CASE STUDIES 313 Shazam’s Mic Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 DazzleSpy Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 Exploit Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 Persistence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 Network Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

xvi   Contents in Detail The 3CX Supply Chain Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 File Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Network Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Process Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Capturing Self-Deletion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 Detecting Exfiltration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 INDEX 329

F O R E W O R D I first encountered Patrick while writing a book about ARM assembly internals and reverse engineering. Apple had recently released its ARM- based Apple Silicon chip, and Patrick was the first to publicly analyze what was then the only known malware sample compiled for it. I could tell Patrick was someone who stayed ahead of the curve and embraced technological changes, so we started collaborating on a chapter about reversing ARM64 macOS malware. As the macOS ecosystem and architecture evolved, Patrick continued to research macOS threats despite architectural changes, consistently contrib- uting to the malware analysis and detection community. His free resources, including timely and comprehensive research on the latest macOS threats, the nonprofit conference Objective by the Sea, numerous educational ini- tiatives, and open source detection tools, have impacted countless people in this industry. Writing security tools for macOS requires both time and resilience. We all know how quickly technology can advance, and Apple Silicon intro- duced changes so profound that they affected the processor architecture. Whether you are new to the field or an experienced professional, keeping up with changes to the ecosystem you focus on is crucial for success. Patrick has come up with novel ways to make threat detection possible on macOS. (You know you’re doing something right when major antivirus companies attempt to use your detection code commercially, without permission.)

xviii   Foreword In The Art of Mac Malware, Volume 2, Patrick tackles proactive defense, focusing on specific programming techniques and macOS internals for detecting and countering threats. This book’s in-depth approach sets it apart: instead of merely analyzing a single malware sample, it describes the APIs and techniques necessary to identify infection patterns, automate macOS threat detection, and develop custom tools. You’ll learn how to cre- ate software that identifies infections in real time, moving beyond postmor- tem analysis. If you want to study these techniques, you’d better learn from the best— someone who has built such tools, has battle-tested them in practice, and con- tinues to adapt to any changes that could render these techniques ineffective. Maria Markstedter Founder of Azeria Labs and Forbes Person of the Year in Cybersecurity