osx-security-awesome - A collection of OSX and iOS security resources

项目说明

osx-security-awesome ![Awesome]()![Travis]()

------------------------------------------------------------------------------------------

A collection of OSX/iOS security related resources

* News

* Hardening

* Malware sample sources

* DFIR

* Reverse engineering

* Presentations and Papers

* Virus and exploit writeups

* Useful tools and guides

* Remote Access Toolkits

* Worth following on Twitter

------------------------------------------------------------------------------------------

News

---------------------------------------------------------------------

Linking a microphone

* The Story of C or how a in OSX's Speech system allowed apps with access to the microphone to escape sandbox restrictions

iOS write-up

* A repository of iOS write-ups as they are released
* Also includes conference papers

iOS display bugs

* Regularly updated list of iOS display bugs

Mac Virus

* Frequently updated blog that provides a good summary of the latest unique mac malware.

Intego Mac Security Blog

* Intego's corporate Mac security blog often contains recent and in-depth analysis of mac malware and other security issues

Objecti

* Objecti's blog often contains in-depth breakdowns of malware they' engineered and they'.

The Safe Mac

* Resource to help educate Mac users about security issues. Contains historical as well as timely security updates.

Mac Security

* Another Mac security blog. This often includes more in-depth analysis of specific threats.

OSX Daily

* Not strictly security-specific but it contains jailbreaking information which has security implications

Hardening

macops

* Utilities, tools, and scripts for managing and tracking a fleet of Macintoshes in a corporate en collected by Google

SUpraudit

* System monitoring tool

EFIgy

* A RESTful API and client that helps Apple Mac users determine if they are running the expected EFI firmware gi Mac hardware and OS build

Launchd

* E you need to know about the launchd service

OSX startup sequence

* Step-by-step guide to the startup process

Google OSX hardening

* Google's system hardening guide

Run any command in a sandbox

* How to for using OSX's sandbox system

Sandblaster

* Re the Apple sandbox
* Paper

OSX El Capitan Hardening Guide

* Hardening guide for El Capitan

Hardening hardware and choosing a good BIOS

* Protecting your hardware from "evil maid" attacks

Malware sample sources

Objecti

* Curated list of malware samples. Use this list if you're looking for interesting samples to reverse engineer

Alien Vault

Contagio malware dump

Digital Forensics / Incident Response (DFIR)

APOLLO tool

* Python tool for ad forensics analysis
* Presentation slides
* Source code

* Python tool for proacti tool for malware and trojans
* Source

lynis

* Security auditing tool for UNIX-based systems, including macOS

AutoMacTC

* Modular forensic triage collection framework from CrowdStrike

Legacy Exec History

* OSQuery module to give you a report of 32bit processes running on a 10.14 machine

Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage

Artefacts for Mac OSX

* Locations of sensiti

Pac4Mac

* Forensics framework

Inception

* Physical memory manipulation

* Memory analysis toolkit

Mac4n6

* Collection of OSX and iOS artifacts

Keychain analysis with Mac OSX Forensics

OSX Collector

* Forensics utility de by Yelp

OSX incident response

* OSX incident response at GitHub Slides

iOS Instrumentation without jailbreaking

* How to debug an iOS application that you didn't create

Certo

* Paid service for analyzing the iTunes backup of your iOS device

Blackbag Tech free tools

OSX (Mac) Memory Acquisition and Analysis Using OSXpmem and

mac-apt

* Mac Artifact Parsing Tool for processing full disk images and extracting useful information
* The author also has a collection of DFIR scripts

Reverse engineering

New OS X Book

* Frequently updated book on OSX internals

Collection of OSX reverse engineering resources

* Another Awesome-style list dedicated to OSX reverse engineering resources

The iPhone Wiki

Reverse engineering OSX

OSX crackmes

* A collection of puzzles to test your reverse engineering skills

Introduction to Reverse Engineering Cocoa Applications

* Walkthrough for Coca applications

iOS Kernel source

* Source code for iOS kernel

Reverse Engineering Challenges

* Very good list of crackme challenges that is categorized by level and OS

Awesome Re

* Awesome list dedicated to re

Presentations and Papers

Area41 2018: Daniel Roethlisberger: Monitoring MacOS For Malware And Intrusions

Windshift APT

* Deep-di by Objective See

Automated Binary Analysis on iOS – A Case Study on Cryptographic Misuse in iOS Applications

* Examining iOS applications for poorly guarded secrets

Writing Bad @$$ Malware for OSX

* Slides and another related video.

Methods of Malware Persistence on OSX

Ad Mac OSX Rootkits

The Python Bytes Your Apple

* Fuzzing and exploiting OSX kernel bugs

Breaking iOS Code Signing

The Apple Sandbox - 5 years later

Practical iOS App Hacking

Beha Detection and Pre of Malware on OS X

Security on OSX and iOS

* Slides

Thunderstrike

* Video, hacking Mac's extensible firmware interface (EFI)

Direct Memory Attack the Kernel

Don't trust your eye, Apple graphics is compromised

* security flaws in IOKit's graphics acceleration that lead to exploitation from the browser

Fuzzing and Exploiting OSX for Fun and Profit Complementary Active & Passi

Strolling into Ring-0 via I/O Kit Drivers

Juice Jacking

Attacking OSX for fun and profit tool set limiations frustration and table flipping Dan Tentler

* Follow-up from target

Building an EmPyre with Python

PoisonTap

Storing our Digital Lives - Mac Filesystems from MFS to APFS

* slides

Collection of mac4en6 papers/presentations

The Underground Economy of Apple ID

iOS of Sauron: How iOS Tracks E You Do

macOS/iOS Kernel Debugging and Heap Feng Shui

Billy Ellis iOS/OSX hacking YouTube channel

A Technical Autopsy of the Apple - FBI Debate using iPhone forensics | SANS DFIR Webcast

Jailbreaking Apple Watch at DEFCON-25

SandScout: Automatic Detection of Flaws in iOS Sandbox Profiles

* An exploration of the sandbox protections policies
* Presentation

Virus and exploit writeups

Detailed Analysis of macOS/iOS C

* Exploration of QuartzCore/CoreAnimation flaw leading to a malicious application being able to read restricted memory.

kernelcache laundering

* Load iOS12 kernelcaches and PAC code in IDA

blanket

* Proof of concept for C: Mach port replacement in launchd on iOS 11.2.6

Proof of Concept for Remote Code Execution in WebContent

* MachO tricks - Appears to be slides from a presentation that ends with the C above

There's Life in the Old Dog Yet: Tearing New Holes into Intel/iPhone Cellular Modems

* How the public warning system can be used as an attack

I can be Apple, and so can you

* An exploration of a code signing in macOS that has persisted for 11 years
* Creating signed and customized backdoored macos apps

Le emond on macOS for persistence

APFS credential leak

* A flaw in Unified Logs leaks the password for encrypted APFS

A fun XNU infoleak

Meltdown

* CPU flaw allowing kernel memory to be accessed by hijacking speculative
execution
* Proof of concept
* Apple's statement
* Measuring OSX meltdown patches performance
* iPhone performance after Spectre patch

Flashback

* Detailed analysis

Flashback pt 2

iWorm

* Detailed analysis

Thunderbolt

* Firmware bootkit

Malware in firmware: how to exploit a false sense of security

* A post on the resurgence of bootkits and how to defend against them

Proton RAT

* Exploration of a Remote Access Toolkit

Mokes

MacKeeper

OpinionSpy

Elanor

Mac Defender

Wire Lurker

KeRanger

* First OSX ransomware

Proof-of-concept USB attack

Dark Jedi

EFI attack that exploits a in suspend-resume cycle Sentinel One write-up

XAgent Mac Malware Used In APT-28

* Samples

Juice Jacking

Local Pri Escalation for macOS 10.12.2 and XNU port Feng Shui

Ian Beer, Google Project Zero: "A deep-dive into the many flavors of IPC a on OS X."

* Deep dive into the interprocess communication and its design flaws

PEGASUS iOS Kernel Explained

Analysis of iOS.GuiInject Adware Library

Broadpwn

* Gaining access through the wireless subsystem

Reverse Engineering and Abusing Apple Call Relay Protocol

* Details the discovery of a in Apple's Call handoff between mobile and desktop through analyzing network traffic.

Exploiting the Wifi Stack on Apple Devices

Google's Project Zero series of articles that detail in the wireless stack used by Apple Devices
* Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
* Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)
* Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices
* Over The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices
* Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

ChaiOS bug

* A message that crashes iMessage
* Looks similar to previous bugs rendering Arabic characters

Useful tools and guides

Mac@IBM

* Mac enrollment helper provided by IBM

mOSL

* Audit and fix macOS High Sierra (10.13.x) security settings

Darling

* Darwin/macOS emulation layer for Linux

Kemon

* Open source kernel monitoring

jelbrektime

* De jailbreak for Apple Watch

Booting Secure

* Deep dive into Secure Boot on 2018 MacBook Pro

Tutorial - emulate an iOS kernel in QEMU up to launchd and userspace

* Tutorial on getting an iOS kernel to run in QEMU

xnumon

* Monitor macOS for malicious activity
* source

DetectX

* Audits system artifacts to help you identify unknown and no

Are you really signed?

* Utility to test for code-sign bypass

osx security growler

* Mac menubar item that lets you know about security events on your system

mac-a-mal

* Automated malware analysis on macOS

jrswizzle

* method interface exchange

MacDBG

* C and Python debugging framework for OSX

bitcode_retriever

* store and retrie from Mach-O binary

machotools

* retrieve and change information about mach-o files

onyx-the-black-cat (outdated original)

* kernel module for OSX to defeat anti-debugging protection

create-dmg

* CLI utility for creating and modifying DMG files

dmg2iso

* convert dmg to iso

Infosec Homebrew

* Homebrew tap for security-related utilities

Awesome OSX Command Line

* Collection of really useful shell commands

Keychain dump

* Dump keychain credentials

KnockKnock

* Listing startup items. Also includes information

Lingon-X

* GUI for launchd

Hopper

* Excellent OSX debugger (requires license)

Symhash

* Python utility for generating imphash fingerprints for OSX binaries

KisMac2

* Wireless scanning and packet capturing

Passive fuzz framework

* Framework is for fuzzing OSX kernel based on passi hook mechanism in kernel mode

Platypus

* GUI for generating .app bundles

createOSXinstallPkg

* CLI for generating .pkg installers

PoisonTap

Chipsec

* System firmware checker by Intel

Re Mac OS X Kernel Rootkits by Phrack Magazine

* A collection of OSX rootkit ideas

iPhone Data Protection in Depth

Cycript

* Remote control library for fuzz testing iOS apps

ChaoticMarch

* Blackbox fuzz testing for iOS apps (requires jailbreak)

iOS backup decrypt script

* Contains a script for decrypting an encrypted iOS backup archive

Remote Packet Capture for iOS Devices

* Use a remote interface to capture packets from a tethered iOS device
* Python utility
* Another python utility

Pareto Security

* A MenuBar app to automatically audit your Mac for basic security hygiene.

Mana Security

* Management app for indi. It helps to keep macOS and installed applications updated.

cnspec

* Open source and misconfiguration scanning for macOS hosts + much more.

Raccoon

* CLI toolkit for macOS security audits, fleet management via SSH, baseline drift detection, and remediation reports. Zero dependencies, agentless.

Intro To IOS Malware Detection

* iOS malware, its types, methods of gathering forensics information

Ipsw Walkthrough

* Part one that covers basic uses

Mobile CTF challenges

Lockpaw

* macOS menu bar screen guard that locks and unlocks your display with a hotkey. Open source, no telemetry.

Remote Access Toolkits

Empyre

Bella

Stitch

Pupy

EggShell sur tool - Works on OSX and jailbroken iOS

E - Pure python post-exploitation toolkit

Worth following on Twitter

*
*
* @0xAmit
*
*
*
*
*
*
*

Other OSX Awesome lists

* ashishb/osx-and-ios-security-awesome

项目信息

开发语言：未知

Star 数：790

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of OSX and iOS security resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。