OS X EXPLOITS AND DEFENSE
CONTENTS CHAPTER 1 MACINTOSH OS X BOOT PROCESS AND FORENSIC SOFTWARE INTRODUCTION THE BOOT PROCESS THE MACINTOSH BOOT PROCESS EFI AND BIOS: SIMILAR BUT DIFFERENT DARWIN THE OS X KERNEL MACINTOSH FORENSIC SOFTWARE BLACKBAG FORENSIC SUITE DIRECTORY SCAN FILESPY HEADERBUILDER OTHER TOOLS CARBON COPY CLONER MACDRIVE6/7 SUMMARY CHAPTER 2 PAST AND CURRENT THREATS BEFORE THE FLOOD THE 21ST CENTURY THREATSCAPE APPLE VULNERABILITY/UPDATE RETROSPECTIVE EXPLOIT DEVELOPMENT AND RESEARCH CHAPTER 3 MALICIOUS MACS: MALWARE AND THE MAC TAXONOMY OF MALWARE VIRUSES WORMS TROJAN HORSES ROOTKITS AND STEALTHKITS BOTS AND BOTNETS MEMETIC MALWARE PRE-OS X MAC MALWARE HYPERCARD INFECTORS APPLICATION AND SYSTEM VIRUSES TROJANS MACRO MALWARE CONTENTS HETEROGENEOUS MALWARE TRANSMISSION WORMS: AUTOSTART AND AFTER OS X AND MALWARE CASE STUDY–OSX/DNSCHANGER SELF-LAUNCHING VS USER-LAUNCHED WHAT DOES THAT MEAN? MEDIA ATTITUDES SCHADENFREUDE OR ARMAGEDDON? IS THAT IT THEN? THE FUTURE MESSAGE TO THE USER COMMUNITY MESSAGE TO APPLE (AND MICROSOFT!) WATCH AND LEARN SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 4 MALWARE DETECTION AND THE MAC SAFE OUT OF THE BOX? ANTI-MALWARE TECHNOLOGY MORE ABOUT EICAR CLASSIC ANTI-MALWARE DETECTION TECHNIQUES SIGNATURE SCANNING HEURISTICS REVEALED ANTI-MALWARE PRODUCTS ANTI-MALWARE BEFORE OS X DISINFECTANT ANTI-MALWARE AND OS X AVAST! CLAMAV CLAMXAV INTEGO VIRUSBARRIER MACSCAN MCAFEE VIREX/VIRUSSCAN FOR MAC SOPHOS SYMANTEC PRODUCT TESTING CONTENTS CHAPTER 5 MAC OS X FOR PEN TESTERS THE OS X COMMAND SHELL COMPILING AND PORTING OPEN SOURCE SOFTWARE OS X DEVELOPER TOOLS PERL CONFIGURING CPAN USING CPAN’S INTERACTIVE MODE USING CPAN IN COMMAND-LINE MODE INSTALLING XWINDOWS COMPILING PROGRAMS ON MAC OS X COMPILING VERSUS PORTING INSTALLING PORTED SOFTWARE ON MAC OS X WHY PORT: A SOURCE INSTALL GONE BAD! OPENDARWIN FINK INSTALLING BINARY PACKAGES USING APT-GET INSTALLING SOURCE PACKAGES USING FINK INSTALLING SOURCE OR BINARY PACKAGES USING FINK COMMANDER USING THE “TOP 75 SECURITY TOOLS” LIST CATEGORY: ATTACK (NETWORK) CATEGORY: ATTACK (SCANNER) CATEGORY: ATTACK (WEB) CATEGORY: CRYPTO CATEGORY: DEFENSE CATEGORY: DEFENSE / FORENSICS CATEGORY: EVASION CATEGORY: FOOTPRINTING CATEGORY: MONITOR (SNIFFING) CATEGORY: MULTIPURPOSE CATEGORY: PASSWORD CRACKING CATEGORY: PASSWORD CRACKING (REMOTE) CATEGORY: PROGRAMMING CATEGORY: SCANNING INSTALLING AND USING THE “BIG” TOOLS WIRESHARK INSTALLING WIRESHARK ON MACOS X FROM SOURCE INSTALLING WIRESHARK ON MACOS X USING DARWINPORTS NESSUS CONTENTS SUMMARY LINKS TO SITES CHAPTER 6 WARDRIVING AND WIRELESS PENETRATION TESTING WITH OS X WARDRIVING WITH KISMAC STARTING KISMAC AND INITIAL CONFIGURATION CONFIGURING THE KISMAC PREFERENCES SCANNING OPTIONS FILTER OPTIONS SOUND PREFERENCES TRAFFIC KISMAC PREFERENCES MAPPING WARDRIVES WITH KISMAC IMPORTING A MAP USING A GPS READY TO IMPORT USING THE KISMAC INTERFACE THE KISMAC WINDOW VIEW BUTTONS ADDITIONAL VIEW OPTIONS WITH KISMAC PENETRATION TESTING WITH OS X ATTACKING WLAN ENCRYPTION WITH KISMAC ATTACKING WEP WITH KISMAC REINJECTION ATTACKING WPA WITH KISMAC OTHER ATTACKS BRUTEFORCE ATTACKS AGAINST 40-BIT WEP WORDLIST ATTACKS OTHER OS X TOOLS FOR WARDRIVING AND WLAN TESTING CHAPTER 7 SECURITY AND OS X LEOPARD AND TIGER EVASION APPLICATION FIREWALL ISIGHT VOYEURISM RELIABLE LOCAL STACK BUFFER OVERFLOW EXPLOITATION CONTENTS DYLIB (DYNAMIC LIBRARY) INJECTION AND OTHER NIFTY TRICKS RETURN TO DYLD STUBS AND LIBSYSTEM FOR TIGER LEOPARD AND ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR) MONTH OF APPLE BUGS PRESSURE ON VENDORS AND EFFECTS OVERVIEW OF THE OUTCOME THE BEGINNING: QUICKTIME RTSP URL HANDLER FLAW A IPHOTO PHOTOCAST XML FORMAT STRING VULNERABILITY THE EXPLOIT OF THE APES APPLE DMG AND FILESYSTEM-RELATED KERNEL VULNERABILITIES APPLETALK ATPSNDRSP( ) HEAP BUFFER OVERFLOW VULNERABILITY A MDNSRESPONDER IN SCARLET THE FIRST FLAW: 1990 STYLE STACK BUFFER OVERFLOWS ROCK THE SECOND FLAW: WHEN YOU GO BEYOND THE LIMITS ABUSING THE MDNSRESPONDER FOR REMOTE ROOT PROFIT CHAPTER 8 ENCRYPTION TECHNOLOGIES AND OS X INTRODUCTION: OS9 TO OS X OS X SECURITY AND ENCRYPTION: ENCRYPTION WITHIN OS X THE SYSTEM KEYCHAIN BETTER KEYCHAIN SECURITY OS X SECURITY AND ENCRYPTION: OS X PASSWORD ENCRYPTION SYMMETRIC CIPHERS ASYMMETRIC CIPHERS HASHES PASSWORD CRACKING SHADOWS AND DES SHA-1 WINDOWS LAN MANAGER SALT AND RAINBOW TABLES DISK IMAGES AND SECURE VIRTUAL DISKS FILEVAULT AND ENCRYPTED DMG FILES AES FILEVAULT PLAINTEXT MEMORY INSECURE HARDWARE FIREWIRE DMA PATCHING DMA ALTERNATIVE RAM ATTACKS ALTERNATIVE ENCRYPTION SYSTEMS WIRELESS ENCRYPTION WEP INITIALIZATION VECTORS WEP THREATS WI-FI PROTECTED ACCESS (WPA) WPA THREATS ENTROPY, PASSWORDS, AND WPA SECURE COMMUNICATION SECURE SOCKET LAYER DIFFIE AND HELLMAN, PUBLIC KEY EXCHANGE MAN IN THE MIDDLE CERTIFICATE AUTHORITIES SECURE COMMUNICATIONS: SUMMARY OF SUGGESTIONS: SECURE SHELL AND TUNNELING OPEN SOURCE EFFORTS SSH SSHD VPN ENCRYPTION VPN PPTP, L2TP, AND OPENVPN IPSEC IPV6 REFERENCES