Leveraging MacOS's Networking Frameworks to Heuristically Detect Malware
summary
Claim: host‑based macOS monitoring finds malware by spotting unauthorized network activity. Uses private NetworkStatistics.framework and Network Extension to build Netiquette (snapshot like nettop), DNSMonitor (intercepts and parses DNS via libresolve, can block with NXDOMAIN) and Lulu (NEFilterDataProvider firewall with allow/deny verdicts). Demonstrations: 10–15 line Dummy reverse shell, 3CX beacon to msstorageboxes.com discovered via DNS, Kaspersky iOS compromise stays hidden 4 years; tools work and reveal exclusions Apple had that a 10‑second exploit bypasses.
AI-written summary · about
chapters (10)
- 0:00macOS malware detection intro
- 4:34macOS networking challenges
- 7:02Mac malware network behavior
- 13:55Network state with NetworkStatistics
- 20:21DNS monitor for macOS
- 27:49macOS extension approval
- 37:14DNS monitoring limits
- 37:58Full traffic monitor
- 40:28Heuristics for malicious traffic
- 46:32Conclusion
related talks
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
32mA Case Study of MacOS Supply Chain Compromise
50mFinding Vulnerabilities In iOS/MacOS Networking Code
41mMacOS Behavioral Detections using Apple Endpoint Security API
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads