Presented at
VB2019,
Oct. 3, 2019, 4 p.m.
(30 minutes).
It's no secret that many nation-states possess offensive *macOS* cyber capabilities, though such capabilities are rarely publicly uncovered. However, when such tools are detected, they provide unparalleled insight into the operations and techniques utilized by advanced adversaries. In this talk, we'll comprehensively dissect one such tool: the first-stage *macOS* implant utilized by the WINDSHIFT APT group (who targeted individuals of a certain Middle-Eastern government). After analysing the malware's unique infection vector, we'll discuss its method of persistence, and capabilities. To conclude, we'll present heuristic methods of detection that can generically detect this, as well as other advanced *macOS* threats.
Presenters:
-
Patrick Wardle
- Jamf
Patrick Wardle Patrick Wardle is Chief Research Officer at Jamf and founder of Objective-See. Having worked at NASA and the NSA, as well as having presented at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. Patrick is passionate about all things related to macOS security and thus spends his days finding Apple 0-days, analysing macOS malware and writing free open-source security tools to protect Mac users. @patrickwardle
Links:
Similar Presentations: