Nothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
summary
Shows concrete macOS techniques to detect malware by observing host network activity: enumerates sockets via proc_pid APIs, extracts remote endpoints and bytes, and uses a private NetworkStatistics framework (nettop → netbottom → the UI tool dut) to get per-connection byte counts. Demonstrates a working DNS proxy (proxying, parsing with libresolv, identifying processes via audit tokens) and a full filter-based firewall (Lulu) that can block flows; details entitlements, limitations, and successful detections (e.g., 3CX/3cx supply-chain indicators).
AI-written summary · about
chapters (9)
- 0:00Introduction to the topic
- 2:29Network monitoring overview
- 7:25Malware analysis examples
- 13:07File descriptor enumeration
- 17:29Network statistics framework
- 22:17DNS monitoring techniques
- 35:40Firewall development
- 37:52Detecting malicious activity
- 42:02Conclusion and Q&A
related talks
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
44mNetsec is Dead(?): Modern Network Fingerprinting for...
50mFinding Vulnerabilities In iOS/MacOS Networking Code
51mHow to Detect Malware in Encrypted Traffic WITHOUT Decryption
50mDynamic Analysis of MacOS Malware Using SpriteTree
59mCatching Malware En Masse: DNS and IP Style