YOU CAN'T SEE ME: A MAC OS X ROOTKIT USES THE TRICKS YOU HAVEN'T KNOWN YET

No ratings

Presented at BlackhatAsia 2014 by

Sung-ting Tsai

Ming-chieh Pan

Attacking Mac OS X has become a trend as we see more and more malware with advanced attack techniques on Mac OS X. In order to gain persistent control and avoid detection, malware have started to adopt rootkit tricks. We will quickly review existing rootkit on Mac OS X, including both user and kernel mode, and approaches to detect them. In the major part of the presentation, we will disclose several new and advanced rootkit techniques by digging into more kernel objects and data structures. And we will demonstrate how to evade existing detection and memory forensics tools, such as Volatility. Not only hiding things, tricks to gaining permission will also be discussed. It is not necessary to be root to get into kernel. Also, we will introduce techniques to start rootkit, special ways to load kernel modules, and anti-tracing techniques. The techniques we introduced have been tested on Mac OS X 10.9. There are new security features to verify 3rd party kernel modules in OS X 10.9, and we will tell you how we bypass.