'Tis the season.
Here is a nice collection of ~100 Mac OS malware and Word document exploits carrying MacOS payload (all are CVE-2009-0563) along with links for OSX malware analysis.
Please send your favorite tools for OSX if they are not listed.
CVE-2009-0563
CVE-2009-0563Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
Links
Some OSX malware analysis tools and links
- http://computer-forensics.sans.org/community/papers/gcfa/mac-os-malware-analysis_2286
- http://en.wikibooks.org/wiki/Reverse_Engineering/Mac_OS_X
- http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html
Tools
- Activity Monitor (Max OSX Utilities folder)
- MacMemoryze (support for Mountain Lion) free,
- Volatility (partial support for Mountain lion) free
- fseventer (graphical event representation) - works on Mountain lion
- Wireshark
- IDA pro
- OSXpmem (kernel extension)
- http://osxbook.com/ OSX internals
- 2009 Mac OS X Malware Analysis Author: Joel Yonts
- Apple OS X ABI Mach-O File Format Reference
- FileXray $79 but looks like it is worth it if you do OSX forensics
- ...let us know what you use
Malware in the provided package - links to research and news articles
- OSX_AoboKeylogger http://aobo.cc/
- OSX_BackTrack-A
- OSX_Boonana http://contagiodump.blogspot.com/2010/11/nov-14-javaboonana-facebook-trojan.html
- OSX_ChatZum http://www.thesafemac.com/chatzum-discovered-in-another-installer/
- OSX_Clapzok http://www.intego.com/mac-security-blog/clapzok-a-multi-platform-virus/
- OSX_Crisis http://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/
- OSX_Dockster_Backdoor http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html
- OSX_FkCodec http://www.thesafemac.com/osxfkcodec-a-in-action/
- OSX_Flashback http://www.symantec.com/security_response/writeup.jsp?docid=2012-041001-0020-99
- OSX_Fucobha_IceFog http://www.securelist.com/en/blog/208214064/The_Icefog_APT_A_Tale_of_Cloak_and_Three_Daggers
- OSX_GetShell http://www.symantec.com/security_response/writeup.jsp?docid=2013-020412-3611-99
- OSX_Hacktool_Hoylecann
- OSX_HellRaiser http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
- OSX_HellRTS http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
- OSX_Hovdy_Backdoor http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Hovdy-A.aspx
- OSX_Inqtana http://www.symantec.com/security_response/writeup.jsp?docid=2006-021715-3051-99&tabid=2
- OSX_Iservice http://www.symantec.com/connect/blogs/osxiservice-it-s-not-going-iwork-you
- OSX_Jahlav http://macscan.securemac.com/osxjahlav-c-dnschanger-trojan-horse/
- OSX_Kitmos http://blog.sbarbeau.fr/2013/05/osx-kitmos-analysis.html
- OSX_Lamadai http://www.welivesecurity.com/2012/03/28/osxlamadai-a-the-mac-payload/
- OSX_Leverage_A_Backdoor http://www.alienvault.com/open-threat-exchange/blog/osx-leveragea-analysis
- OSX_LocalRoot https://www.trustedsec.com/august-2013/osx-10-8-4-local-root-privilege-escalation-exploit/
- OSX_Macarena_A http://www.securelist.com/en/analysis/204791948/Mac_OS_X#macarena
- OSX_MacDefender http://www.intego.com/mac-security-blog/macdefender-rogue-anti-malware-program-attacks-macs-via-seo-poisoning/
- OSX_MacKontrol http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
- OSX_Macsweeper http://en.securitylab.ru/viruses/311798.php
- OSX_Miner_DevilRobber http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Miner-D/detailed-analysis.aspx
- OSX_Olyx_Backdoor http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html
- OSX_OpinionSpy http://www.f-secure.com/sw-desc/spyware_osx_opinionspy.shtml
- OSX_PSides
- OSX_Genieo http://www.thesafemac.com/malicious-genieo-installers-persist/
- OSX_PUP_PerfectKeylog http://www.blazingtools.com/mac_keylogger.html
- OSX_Renepo / Pintsized http://www.intego.com/mac-security-blog/pint-sized-backdoor-for-os-x-discovered/
- OSX_Revir http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html
- OSX_Safari
- OSX_SniperSpy http://www.sniperspymac.com/download.html
- OSX_Wirenet http://www.webroot.com/blog/2012/09/14/wirenet-the-password-stealing-trojan-lands-on-linux-and-os-x/
- OSX_Yontoo http://www.macrumors.com/2013/03/21/new-yontoo-adware-trojan-targets-major-browsers-on-os-x/
- OSXWeapoX http://www.virusradar.com/OSX_Rootkit.Weapox.A/description
- ------------------------------------
- CVE-2009-0563 Word exploit
- MacControl payload http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
- OSX.SabPub payload http://www.securelist.com/en/blog/208193470/New_Version_of_OSX_SabPub_Confirmed_Mac_APT_attacks
- OSX/Dockster.A payload http://www.intego.com/mac-security-blog/new-targeted-attack-on-tibetan-activists-using-os-x-discovered/
- OSX_Docklight payload http://contagioexchange.blogspot.com/2012/05/019-speechdoc-macosxms09-027a-word.html and http://blogs.technet.com/b/mmpc/archive/2012/04/30/an-interesting-case-of-mac-osx-malware.aspx