start	end	text
600	4740	Aloha, and welcome to my talk, Office Drama on macOS.
5680	7400	My name is Patrick Wardle.
7400	10780	I am a Principal Security Researcher at Jamf,
10780	14020	and also the creator of the Mac security website
14020	16460	and tool suite, Objective-C.
17980	24240	So today we're going to be talking about malicious office documents on macOS.
24300	29180	First, we're going to detail recent attacks targeting Mac users,
29180	33020	attacks that leverage macro-laced documents.
33120	36640	Then we'll discuss methods of analyzing these attacks.
36640	40300	For example, how to extract the embedded macros,
40300	44140	and also how to analyze the document payloads.
44440	49160	As the current attacks are kind of lame, somewhat constrained,
49160	53680	for example, by the sandbox, I wanted to dig into this a little more.
53680	57100	And we'll talk today about a new exploit chain
57100	62740	that combines what was at the time a handful of zero days
62740	67480	to bypass the sandbox and Apple's latest security mechanisms.
67480	69980	We'll end by discussing generic methods
69980	72780	to detect and thwart some of these attacks.
74000	76300	All right, so let's dive in.
76300	79560	We're going to start by looking at recent macro-based attacks
79560	82020	targeting Mac users.
82840	86320	Now, first, you might be wondering, what is a macro?
86320	91340	Well, I've added the official Microsoft documentation on the slide.
91340	95280	But in short, a macro is embedded executable code
95280	98040	in Microsoft Office documents.
98040	100820	In other words, it allows one, as I mentioned,
100820	105180	to add executable code into a file, into a document.
105680	108300	So as we can see on the slide, what I've done
108300	112480	is I've inserted a macro into a Word document
112480	115220	that will display a pop-up that says,
115220	116480	Hello World.
116560	120920	Now, we'll talk about this more later in the talk.
120920	125540	But since I've placed this code within the auto-open subroutine,
125540	130120	if the user has enabled macro, this code will be automatically executed
130120	132860	anytime they open the document.
133840	137120	Now, from a security point of view, you might be thinking,
137120	139740	this sounds like a horrible idea.
139740	141640	And you're right.
142120	145180	Placing executable code within documents,
145180	150620	really just a terrible idea, which attackers have abused for years.
150620	153600	In fact, the infamous Melissa virus,
153600	157200	which was around all the way back in 1999,
157200	159540	you guessed it, was a macro virus.
160040	164400	Now, to be fair, Microsoft has added some mitigations,
164400	167720	for example, alerts and sandboxing.
167720	172080	But as we'll see, this has not fully mitigated the threat.
174900	176980	So traditionally, these macro-based attacks
176980	182540	have targeted Microsoft Windows systems due to two main reasons.
182800	188520	First, macros are a Microsoft creation and only work in Microsoft products.
188520	191260	That is, they're not going to work in Apple's Office apps,
191260	193880	such as Pages or Numbers.
194260	197760	And then Windows computers, especially in the past,
197760	202000	were far more prevalent, especially in the enterprise.
202600	204280	Now, this is definitely changing.
204280	207740	We're seeing a lot more Macs, especially in the startup scene
207740	210180	and also in the enterprise as well.
210680	213200	And so in short, there are more Macs
213200	216800	and a lot of them are running these Microsoft Office products,
216800	220120	which means there's just more targets for hackers.
222000	226780	So now let's take a look at some recent attacks targeting Mac users,
226780	230960	attacks that leverage macro-laced documents.
231500	232820	So first in this section,
232820	236240	we're going to kind of look at these at a high level.
236240	238000	In the next section, though, we're going to dive
238000	241200	into discussing exactly how to extract
241200	246020	and analyze the payload of these malicious documents.
246020	248740	So we're going to start in 2017.
248740	251660	Here we have a document that appears to be
251660	255240	about Trump's unfortunate election victory.
255740	258440	If the user, though, went to open this document
258440	262860	and clicked allow on the enabled macro alert,
262860	265820	the system would become infected because in reality,
265820	269460	this was a malicious document containing malicious macros.
271180	276460	Moving on to 2018, we have a document that appears to be about Bitcoin,
276460	280120	which was a very hot, trendy topic at the time.
280120	285040	Again, if the user opens the document and allows macros to run,
285040	287040	the system is owned.
287040	291480	Now this document is interesting, and we'll dig into this more shortly.
291480	294540	But the most interesting aspect of this attack
294540	299480	was that the embedded exploit code contained the ability
299480	303260	to actually bypass Microsoft Office's sandbox.
304560	311240	Moving on to 2019, we have a document from the prolific Lazarus APT group,
311240	314320	which is normally associated with North Korea.
315040	318880	This is interesting because we're actually now seeing APT groups
318880	324120	jump on the, hey, let's target macOS via macros bandwagon.
324120	327420	Again, if the user opens the document and clicks allow,
327420	329260	the system will be owned.
331260	333260	All right, so now let's talk about methods
333260	336240	of analyzing these malicious documents,
336240	339940	showing exactly how to extract embedded macros
339940	343360	and how to analyze both the macro code
343360	346980	and any embedded payloads.
348060	352860	First, we need to be able to extract the embedded macro code.
353220	358380	Now, the details of the file format of Microsoft Office documents
358380	361180	is kind of beyond the scope of this talk.
361180	364540	But the good news is you really don't have to even worry about that.
364540	367940	Turns out there are some really great tools that are able to,
367940	370880	if given a Office document with macros,
370880	372880	contributely extract those macros.
372880	375140	And that's really basically all we care about.
375520	380360	My favorite is a tool suite called OLE Tools from GitHub.
380360	385120	So we can see on the slide, we downloaded the package and installed it.
385120	391000	And then we execute the OLE VBA command with a dash C parameter,
391000	392580	passing in the document,
392580	396560	which we suspect has embedded macros that we want to analyze.
396560	400880	And the OLE VBA tool will then parse the document
400880	405140	and dump any embedded macros to standard out.
405240	409010	There's also various online sites where you can upload a document.
409860	414180	The website will then do the analysis and extract any macro code.
416130	422480	Now, we want to understand exactly what these malicious macros are doing.
422480	425800	So let's briefly return to the documents
425800	428960	that we discussed in the first part of the talk.
428960	430560	And for each of these,
430560	435600	look at exactly what the malicious macro code is doing.
435760	438480	So again, starting at the one from 2018,
438480	442680	we can use the OLE VBA tool to extract the macros.
442680	444400	And I've cleaned up the macros a little bit
444400	447000	and placed them on the screen.
447160	451680	So we can see on the slide, there is a subroutine called Fisher.
452480	456060	That is invoked via the auto open method.
456060	459740	The auto open method is a Microsoft API.
459780	465580	And as its name implies, any code placed within this API
465580	467880	will be automatically executed,
467880	472980	if and only if the user has enabled macros when opening the document.
473100	477480	So if we assume the user has clicked allow to the embedded macros,
477480	480220	let's look at what the Fisher subroutine does.
480220	482360	Again, as it will be automatically executed
482360	485280	each time the document is opened.
486160	490740	So the first thing it does is it builds a base 64 encoded string,
490740	494300	and then it decodes and executes that via Python.
495740	500460	If we manually decode this string, we can see it's Python code,
500460	504580	which is unsurprising as it's passing it to Python to execute.
504580	506860	So what is this Python code does?
506860	509460	Well, the first thing it does is it checks
509460	512600	to see if popular security products, for example,
512600	514080	little snitch is running.
514080	516860	And then it downloads a second stage payload
516860	519920	from securitychecking.org.
519980	524980	It then decrypts this payload using RC4 and executes this.
525540	528240	Now, this code might look familiar.
528240	530860	You spend a lot of time kind of looking at these attacks.
530860	534460	And that's because this payload is actually Empire,
534460	538120	which is a well-known open source Python backdoor.
538400	540160	Now, you might be wondering, okay,
540160	544380	what is it downloading and executing as its second stage payload?
544740	547980	Well, unfortunately, the command and control server
547980	550860	was offline at the time I did this analysis,
550860	555220	but it's likely that it's simply Empire's second stage payload,
555220	559100	which gives attackers full access over the infected system.
560700	562960	Moving on to the Bitcoin document.
562960	565360	Again, this one was from 2018.
565580	570620	Using the OLE VBA tool, we can, again, extract the embedded macros.
570620	573540	Interestingly, this also contains encoded Python
573880	577480	and what appears to be an embedded property list.
577520	578760	That's interesting.
579780	582380	So let's take a closer look.
582660	585220	First thing we do is we decode the Python.
585220	589560	Since it's base64 encoded, it's very trivial to do.
589560	592000	You can either do that via an online site
592000	594460	that provides base64 decoding,
594460	598260	or I just do it via the command line via a Python shell.
598640	603000	Once the code is decoded, again, we can see that on this slide,
603000	605680	it connects to an IP address,
605680	609260	executes and downloads a second stage payload.
609700	611640	Turns out this command and control server
611640	615320	was still online during the time of my analysis,
615320	619880	so I was actually able to get a copy of this second stage payload,
619880	623260	which turned out to be Metasploit's Meterpreter.
623260	627360	Again, interesting to see attackers leveraging open source agents
627360	629240	in second stage payload.
629240	633920	Meterpreter affords remote access of an infected system.
635320	638220	Now, if you recall the beginning of the talk,
638220	640280	we kind of said that the most interesting thing
640280	642260	about this particular document
642260	647840	was its ability to escape out of Microsoft Office's sandbox.
647840	652700	So recent versions of Office run in a sandbox, which is good,
652700	658020	and it means that if code is executed within the context of the process,
658020	661860	for example, macro code executing within a Word document,
661860	665520	it is highly contained. It's limited by what it can do.
665520	667460	It's still in the sandbox.
667540	670140	So it can't do things like persist the backdoor
670140	672580	or even access the user's files.
672580	675340	From a security point of view, this is very good.
676200	679440	However, Mac security researcher Adam Chester
679440	682360	found a very neat way to escape the sandbox
682360	687900	and posted a guest blog about this on my Mac security website, Objective-C.
688040	693680	In short, we found that Microsoft Office had a sandbox exception
694000	696600	that was based on a faulty regX
696600	701960	that would allow sandbox code to create a file anywhere on the system.
701960	705540	So what Adam was able to do was, via macro code
705540	708380	running in the context of the sandbox,
708380	712620	create a launch item that on the next login
712620	715820	would be executed outside the context of the sandbox.
715820	720260	And he used a property list in order to do that.
720700	724160	So I was analyzing this document. I said, okay, this code looks very familiar.
724160	727700	And I read Adam's blog and posted it on my site.
727700	731920	And it turns out that the attackers had likely also read this blog
731920	737180	and took Adam's code for verbatim, 100% copy and paste,
737180	740160	and embedded it into their Office document.
740160	743160	So this would mean that on unpatched systems,
743160	745320	they would be able to break out of the sandbox
745320	748400	and cause more havoc, more mayhem.
750000	753260	Finally, if we extract the embedded macro code
753260	757680	from the Lazarus Group document, we can see it's pretty basic.
757700	761080	This case, it's not even encoded. So what does it do?
761080	765900	Well, it simply downloads and executes a second stage persistent implant.
765900	768440	That implant is named mt.dat
768440	772580	and would give attackers persistent remote access to the system.
772600	776580	However, this document did not have any sandbox escape code,
776580	780060	which means if it was opened on a recent version of macOS,
780060	782080	this part of the attack would fail
782080	784800	because you can't obviously persist code
784800	787380	from within the context of a sandbox.
789040	793380	So that's an overview of recent macro-based attacks against macOS,
793380	799260	which gave us, I think, a pretty thorough understanding of the status quo.
799500	804900	Now let's talk about a new zero-click macro-based exploit chain.
806120	809060	And you might be wondering, why should we do this?
809160	814140	Well, all current macro-based attacks, in my opinion, are super lame.
814300	816360	Let's list the ways.
816360	820940	First, for any of these attacks, when the user goes to open the document,
820940	825620	there's a huge alert warning them that this document contains macros
825620	829040	and they probably should not allow them.
829100	831780	The user basically has to click enable.
831800	835820	Most won't, which means these attacks will fail immediately out of the box.
835820	838620	Macro code will never even be run.
838780	844180	Also, as Microsoft has now patched Adam's sandbox escape bug,
844180	846280	all the attacks remain sandbox.
846280	850100	Again, means even if the user does enable the macro code,
850100	852500	they're incredibly limited about what they can do.
852500	855980	They can't persist code or access user files.
856260	861200	And then finally, on macOS Catalina, the most recent version of macOS,
861200	862900	Apple has really upped the bar
862900	865420	and introduced some new security mechanisms,
865420	869940	such as notarization, which means the second stage payloads
869940	875020	may not necessarily be even allowed to execute by the system.
875280	879840	So again, the current attacks, my opinion, basically useless.
881580	886340	Now, whenever companies such as Microsoft or Apple patch stuff
886340	890220	or implement new security mechanisms, I like to poke on that
890700	896160	because often they do so incorrectly, insufficiently.
896160	901180	So let's walk through now this kind of zero-click exploit chain.
901420	903200	So the exploit starts with a really neat bug
903200	906660	that was found a while ago by two security researchers
906660	910740	and then kind of improved upon by other researchers at Cert.
910740	913380	So this first bug is not mine.
913680	919160	What these researchers found was that even if macros are turned off,
919160	922340	they could create a document that contained macros
922340	925960	that would be automatically executed with no alerts,
925960	930060	no prompts. That's hot.
930620	931840	How do they do this?
931840	938080	By abusing a incredibly old Microsoft file format called SYLK files.
938080	942670	How old? Like from the 1980s, before I was even born.
943300	947180	And they also used a macro language not written in VBA,
947180	952960	but something called XLM, not XML, XLM.
952960	958280	Now, Microsoft loves to support old file formats for compatibility reasons.
958280	963940	So yeah, these old file formats still work even in recent versions,
963940	965920	specifically in Excel.
966760	970520	So as I mentioned, the researchers found that they could create
970520	976240	these XLM macros in these SYLK file formats
976240	978900	that would be automatically executed,
978900	983200	ironically, if the user had set never run macros to true.
983700	986460	So the researchers published some great details
986460	988980	about these older formats and some of their findings.
988980	992020	So if you're interested, I've posted a link on the slide
992020	994840	to their very thorough technical write-ups.
996100	1000860	So what I did was I created a simple proof of concept based on their code.
1000860	1004480	We'll see a malicious document is downloaded from the internet.
1004480	1007860	And when it is opened, CALC is automatically executed.
1008900	1013180	Now, the main takeaway from here is that there are no macro alerts,
1013180	1014820	right, no prompts, nothing.
1014820	1019680	Just as soon as the document is opened, CALCulator pops.
1021900	1024040	Now, that's well and good,
1024040	1028500	but as we noted on recent versions of Microsoft Office,
1028500	1033520	the applications are sandboxed, meaning, sure, we can pop CALCulator
1033520	1038460	and that's neat for a demo, but we can't persist the backdoor.
1038460	1040840	We can't access the user's files.
1040840	1044680	This is the point of a sandbox. It contains malicious code,
1044680	1047200	even if such code finds a way to execute.
1047540	1053640	So, in short, we need a new sandbox escape in order to do any real damage.
1054180	1058800	So I started by looking at Microsoft's patch for Adam's bug.
1059100	1063800	And I noticed that they actually didn't fix the faulty regex.
1063800	1067820	Instead, they just simply blocked certain locations,
1067820	1070460	such as the launch agent directory,
1070460	1074180	which is where Adam's proof of concept created a launch agent,
1074180	1076080	which on the next login would be executed
1076080	1079680	outside the context of the sandbox.
1080060	1082640	So this means we can create arbitrary files
1082640	1085440	as long as they start with tilde dollar sign,
1085440	1089440	meaning they conform to this faulty regex, almost anywhere.
1089440	1091440	Again, almost anywhere because Microsoft
1091440	1095120	added some specific locations that they blocked.
1096880	1098520	Now, our goal, of course,
1098520	1100840	is to execute something outside the sandbox
1100840	1104380	so we can persist and do evil things.
1104380	1106780	We just noted we can write specially named files
1106780	1110300	to arbitrary locations from macro code
1110300	1113200	that's running within the context of the sandbox.
1113200	1115700	As Microsoft didn't fully patch that.
1116080	1118680	Also, it turns out in the sandbox,
1118680	1121260	we can both download and execute scripts,
1121260	1124460	as we can see in the process monitor on the slide.
1124460	1128380	Now, these scripts themselves will be sandboxed, right?
1128380	1130500	They're children of a sandbox process,
1130500	1133700	which means themselves are also sandboxed.
1133700	1135780	But that's still a start, right?
1135780	1138500	We can execute, for example, Python scripts,
1138500	1141300	which gives us a very extensible programming language
1141300	1143460	to perhaps do some sorts of evil things.
1145140	1147060	So via a Python script,
1147060	1151800	which we, again, download and execute within the sandbox,
1151800	1155680	we can create something called a login item.
1156120	1159040	Now, login items are automatically executed
1159040	1161620	the next time the user logs in.
1161640	1167320	And since it started by Mac OS, instead of us via the sandbox,
1167320	1169320	it's not going to be sandbox.
1169380	1171200	So when the user's logging in,
1171200	1174200	Mac OS goes and looks at the register login items
1174200	1177120	and just executes and starts all of them.
1177120	1181500	Again, there's no tie back to the Microsoft Office macro code,
1181500	1183280	the sandbox, nothing.
1183360	1187660	So that means this will be executed outside the context of the sandbox.
1188040	1191640	To confirm, we can persist terminal.app.
1191640	1195920	Sure enough, when we re-log in, terminal is executed.
1195920	1199280	And when we look at it in Activity Monitor,
1199280	1201780	we can see that it runs outside the sandbox.
1203240	1205220	So this is good, right?
1205220	1207700	We now have a way to bypass the sandbox.
1207700	1213740	But unfortunately, we run smack into Catalina's new security mechanisms,
1213740	1218700	which are file quarantines and new notarization requirements.
1218700	1221300	In a nutshell, notarization basically says,
1221300	1224840	hey, Apple has to bless the file before it's run.
1224840	1228120	Obviously, Apple's not going to bless our back door.
1228120	1232460	So even if we go and persist the back door as a login item,
1232460	1234900	Mac OS will simply refuse to execute it
1234900	1237240	because, unfortunately, it is not blessed.
1237240	1238560	It is not notarized.
1239880	1241840	This is a bummer.
1242180	1243680	And so what do we do, right?
1243680	1248020	We got to figure out a way to bypass now quarantine and notarization.
1248640	1251980	Now, hope is not lost, right?
1252200	1255720	This is 2020, things look bleak, but we got to stay optimistic,
1255720	1259160	especially when we are looking and developing exploits.
1259160	1264360	Because if, and this is a big if, if we can create a launch agent,
1264360	1268480	we can specify arguments and persist
1268840	1273100	a persistent interactive non-sandbox reverse shell via bash.
1273820	1277520	Now, this is a big if, but again, there's a few kind of takeaways here.
1277520	1280180	First, being able to specify arguments is huge.
1280740	1286660	And then also, if we can specify or persist rather an interactive shell,
1286660	1289020	it's going to be running outside the sandbox,
1289020	1293680	which is going to do things like allow us to remove quarantine attributes,
1293680	1297400	which means that notarization checks will not even be performed.
1298180	1299780	This would be great.
1299780	1303680	But recall that Microsoft's patch for Adam's bug
1303680	1308200	explicitly blocks the creation of launch agents.
1308560	1309640	Bummer.
1310140	1312620	So we kind of have like all these pieces,
1312620	1315000	but we just can't quite put them together.
1315440	1316540	Frustrating.
1316540	1320400	So we can escape the sandbox via a login item,
1320400	1323300	but login items can't take arguments.
1323300	1328060	And they also can't be a random binary because notarization will block it.
1328060	1332640	So in other words, all we can do is persist an Apple binary.
1332640	1334980	Again, with no arguments.
1335080	1339880	And sure, we can bypass notarization by the creation of a launch agent,
1339880	1345140	but we can't create one from the sandbox due to Microsoft's partial patch.
1345240	1348900	So in other words, what we need is a way for the system
1348900	1352260	or for an Apple binary with no arguments
1352260	1356240	is to create a launch agent for us.
1357860	1360040	This is where things get beautiful.
1360060	1362320	So I had a random idea.
1362320	1364640	What happens if you create a login item
1364640	1367320	that is not a binary or an application?
1367320	1370580	Like, what happens if you persist a zip file?
1370580	1372500	How does the system handle that?
1372500	1375400	Again, recall we can create these login items from the sandbox.
1375400	1378260	They can't take arguments and they can't be random binaries.
1378260	1383420	But what happens if we persist a zip file, right?
1383560	1386560	Well, it turns out on login,
1386560	1389720	the file's default handler will be invoked,
1389720	1393780	which for a zip file, macOS will automatically execute
1393780	1398060	the Apple's archive utility to unzip the file.
1398060	1401080	Basically says, okay, this is not an executable,
1401080	1403560	so I'm going to invoke the handler.
1403560	1407180	In this case, it's the archive utility because we persisted a zip file,
1407180	1409120	which will extract that.
1409300	1412840	Now, remember we want to create a launch agent,
1412840	1416740	but due to Microsoft's recent patch,
1416740	1420440	we cannot directly write to the user's launch agent directory.
1420980	1424820	But if it doesn't exist, which on a default version of macOS it does not,
1424820	1430320	we can drop the zip file one directory up in the user's library directory.
1430320	1433120	This is allowed from the sandbox.
1433720	1437360	So now we can place the zip file in the library directory,
1437360	1442020	and we can persist this as a login item.
1442140	1443780	So we're making progress.
1443780	1448340	So what do we put in the zip file? A directory named launch agents.
1448360	1451980	And in that, a launch agent property list.
1452060	1455560	So now when we persist this zip file as a login item,
1455560	1460400	on next login, the archive utility will automatically be invoked.
1460400	1463260	This is allowed because it's an Apple sign process,
1463260	1467060	and it will run outside the context of the sandbox,
1467060	1470700	which means it can do things like unzip our file
1471220	1473200	and create the launch agent directory
1473200	1476400	and our launch agent property list for us.
1477500	1481680	That is awesome. So this completes the full exploit chain.
1481680	1486960	The user starts by opening this SLK file containing the XLM macro,
1486960	1489140	which will execute automatically.
1489140	1491780	Again, no alert, so just open the document.
1492580	1498680	This downloads and persists the specially crafted zip file as a login item.
1498680	1501840	On next login, the archive utility will be automatically invoked,
1501840	1505220	and in the background, we'll extract this zip file,
1505220	1508540	thereby creating a launch agent for us.
1508540	1513160	And on next login, the login agent will be automatically executed
1513160	1517060	with our arguments, which we can put in the property list,
1517060	1521480	and we'll execute our bash-based interactive backdoor.
1522620	1526400	So this bash backdoor runs outside the sandbox,
1526400	1530300	meaning it can download and unquarantine files.
1530300	1535640	Unquarantine files are not constrained by Apple's notarization requirements.
1535640	1539820	So we have this interactive shell outside of the sandbox.
1540220	1544320	What do we do? Well, we decided to persist something.
1544320	1547840	And I thought it'd be extra funny to persist a repurposed,
1547840	1551180	clearly not notarized version of Wingtail.
1551180	1553860	And you can see on the slide, when I finally got this all working
1553860	1558420	in the Slack channel at work, I was clearly pretty stoked.
1559820	1563240	All right, so let's now talk, kind of shift gears
1563240	1565720	and talk about defending against these attacks
1565720	1569400	and some generic methods of detection.
1570320	1573820	First thing, as a responsible security researcher,
1573820	1578020	I reported all these vulnerabilities to Microsoft and Apple.
1578160	1580640	Microsoft responded and said,
1580640	1582880	this is a known issue on the Apple side.
1582880	1586400	And I was like, well, yeah, because I told Apple as well.
1586400	1592360	So I have no idea what Microsoft did, no CDE, no bug bounty. Bummer.
1592620	1597400	Apple said, thank you for your report, and then nothing.
1598000	1601880	I waited a long time and checked back in with Apple and said,
1601880	1606140	oh, yeah, we patched that back in, you know, 10.15.3.
1606140	1611520	Again, no CDE, no bug bounty, classic Cupertino.
1613600	1617040	Let's talk briefly, though, about how to detect this,
1617040	1621100	these attacks and perhaps other Mac malware as well.
1621340	1624600	So the first thing let's talk about is process monitoring,
1624600	1627820	leveraging Apple's new endpoint security framework.
1628360	1631160	It turns out it's pretty easy to create a process monitor
1631160	1634560	to detect something I call suspicious children.
1635120	1637560	Suspicious children processes.
1637560	1642300	As we can see on the slide, we can now detect when an Office application,
1642300	1648160	for example, Excel, spawns a child process that is, well, suspicious.
1648520	1652260	So regardless of the reason, you know, of the exploit,
1652260	1654120	if it was a macro, buffer overflow,
1654120	1660660	if you see Excel spawning curl and then Python, you know, that's bad news.
1660660	1662780	Something is amiss.
1664340	1667060	We can also detect a wide range of attacks,
1667060	1670100	including the exploit chain we just talked about this,
1670100	1673660	by monitoring the file system for persistence.
1673660	1675780	Persistence is just the way that malware
1675780	1678820	or perhaps an exploit chain escapes out of the sandbox
1679100	1681580	or ensures that it's automatically re-executed
1681580	1685680	when the system is rebooted or the user re-logs in.
1685680	1688420	So again, we can use Apple's new endpoint security framework
1688420	1693580	and we can monitor for files specifically related for ones to persistence.
1693840	1695480	So here, for example, on the slide,
1695480	1699480	we can detect now that a login item was created
1699480	1703200	that does not point to an application or a binary,
1703200	1706040	which is normally the case when a login item is created,
1706040	1707920	but instead to a zip file.
1707920	1710660	This is a huge red flag and kind of, you know,
1710660	1714600	shows that our exploit is executed.
1716200	1719900	So at Jamf, we implement such monitoring logic
1719900	1722480	in a framework we call MonitorKit.
1722480	1727960	We then feed that monitoring data, as well as our analytics and rules,
1727960	1731960	into Apple's game logic engine for evaluation.
1731960	1736160	This gives us a powerful endpoint detection capability,
1736160	1739120	uniquely tailored for macOS.
1739120	1742580	And kind of neat, not to really brag, but based on our current rules,
1742580	1745320	we were actually able to detect this exploit chain
1745320	1748960	with no a priori knowledge. Pretty neat.
1750000	1752820	All right, so let's wrap everything up.
1753160	1756700	So today we kind of talked about the current state of affairs
1756700	1759140	in the land of macro-based attacks.
1759140	1762400	And we showed that they are becoming more and more popular
1762400	1766160	in the sense of targeting specifically macOS users.
1766160	1770020	But luckily, current attacks are rather light.
1770020	1773460	However, we should not be lulled into a sense of complacency
1773460	1775920	because we showed it was pretty easy
1775920	1779520	to actually create a zero-click exploit chain
1779520	1782820	that, if the user would open a document,
1782820	1785000	would both escape the sandbox
1785000	1789840	and bypass all of Apple's recent security mechanisms.
1789840	1794160	Again, at the time, on a fully patched macOS system.
1794280	1796220	However, we ended by showing that by leveraging
1796220	1798920	Apple's new endpoint security framework,
1798920	1802760	we can generically detect these and other attacks.
1803680	1807080	I really want to thank a variety of people.
1807080	1810560	First and foremost, you all for virtually attending my talk.
1810560	1812520	Hope you're all staying safe and healthy.
1812640	1816520	Also to Jamf for putting up with my many shenanigans.
1816660	1820860	And also all the amazing companies that support Objective-C.
1821860	1823740	Oh, and one more thing.
1823740	1826260	Today I am announcing my new book,
1826260	1829060	The Art of Mac Malware Analysis.
1829060	1832020	My dog is very excited about it as well.
1832480	1837640	I've published the first part online at taumm.org,
1837640	1840940	and the rest of the chapters will be published shortly as well.
1841360	1844240	All 100% free. Sharing is caring.
1844260	1848060	So if you're interested in learning more about Mac malware,
1848060	1851540	exploits, persistence, debuggers, disassembling,
1851540	1853640	check out the site.
1854280	1855920	So again, that is a wrap.
1855920	1858060	Thank you so much for attending my talk.