Malware Behavior on macOS

Presented at Objective by the Sea version 2.0 (2019), June 2, 2019, 3:40 p.m. (30 minutes)

Malware on macOS is typically pretty easy to spot. However, this doesn't have to be the case, and speaks more about the laziness of malware creators than the inherent security of macOS. If all you're looking for are launch agents, launch daemons, and login items, you'll be missing a lot. Learn more about interesting persistence methods, suspicious behaviors, and other techniques used by existing Mac malware - or that could potentially be used in the future by Mac malware - so that you can learn better malware hunting techniques.

Presenters:

• Thomas Reed - Director of Mac & Mobile at Malwarebytes
  Thomas Reed has been a Mac user since 1984, and is a self-taught developer and security researcher. He is the founder of The Safe Mac and creator of the AdwareMedic adware removal tool for Macs. He is currently Director of Mac & Mobile at Malwarebytes, where he directs product development and Mac security research. His hobbies include hiking and photography, and he is happily married with four children.

Links:

• https://objectivebythesea.org/v2/talks.html#reed
• https://objectivebythesea.org/v2/talks/OBTS_v2_Reed.pdf

Similar Presentations:

• DerbyCon 3.0 All in the Family (2013) / The Malware Management Framework, a process you can use to find advanced malware. We found WinNTI with it!
• Objective by the Sea version 4.0 (2021) / Mac detections by the numbers
• Black Hat Asia 2018 / Mac-A-Mal: An Automated Platform for Mac Malware Hunting