Thursday 6 October 15:00 - 15:30, Red room
Peter Kalnai (ESET)
Martin Jirkal (ESET)
In the last few months, two new OS X threats (dubbed OSX/KeRanger and OSX/Keydnap) were distributed as recompiled versions of the otherwise legitimate open source BitTorrent client application Transmission on the application’s official, and therefore trusted, website. Moreover, different legitimate code-signing keys were used to sign the malicious Transmission application bundles to be able to bypass Gatekeeper protection. The response from the Transmission team was instant in both cases and the malicious bundles were removed instantly from their web server, finally choosing GitHub as a file storage. We provide the technical details and the similarities between the two threats, and we investigate clues that might have led to these incidents.
The reaction from OS X users was very negative and full of anxiety about the possibility of being affected by the threat. To answer their questions, indicators of compromise should have been obtained by using live tools, followed by a careful analysis, and concluded with the manual creation of cleaning scripts. However, there existed also an alternative approach of capturing volatile physical memory data and applying it to the powerful Volatility Framework. Indeed, we performed malware executions in various test environments several times to eliminate randomness and unrelated manifestations, then we collected the outputs from relevant VF plug-ins, compared them with the outputs from the clean state before, we dumped unpacked memory blocks of malicious processes, we produced a final VF plug-in able to detect IoCs on memory dumps of compromised systems and we wrote a script that would clean any such system. Note that all these steps could actually work completely without our interaction. We sketch how this method might lead to automation of malware analysis for a platform like OS X.
Click here for more details about the conference.
 |
Peter KálnaiPeter Kálnai is a malware researcher at ESET. His job description includes reverse engineering of mainstream cyber threats for alternative platforms like OS X. He is interested in testing the Volatility Framework as a malware analysing tool. He has actively participated in international conferences including Virus Bulletin, RSA Conference, CARO Workshop, Botconf and AVAR. Currently, he is a Ph.D. student in mathematics at Charles University in Prague. In his free time he enjoys playing table football and watching stand-up comedians. |
 |
Martin JirkalMartin Jirkal is a detection engineer in the ESET virus laboratory. He is responsible for the detection of new threats and education of new ESET talents. He is a co-creator and occasional teacher of reverse engineering classes at Czech Technical University in Prague, from which he graduated. In addition to IT security and reverse engineering, he also loves complex board and role-playing games. |
