Anti Forensics techniques for OSX (Vincenzo Blackhat DC)

Vincenzo Lozzo gave a talk titled "Let your Mach-O Fly" in Blackhat DC 2009, detailing an attack using which it could be possible for a hacker to make digital forensics on a compromised OS X machine very difficult. The attack which relies on an in-memory injection technique allows unauthorized software to be installed on a Mac without leaving traces of the attack code or other tell-tale signs that the machine has been compromised. However, the pre-requitiste for this attack is that the attacker must first have a reliable exploit in common applications such as Safari, iTunes etc. In his paper, Vincenzo writes that even though OS X's address space layer randomization was designed with the intention of thwarting in-memory injection attacks, an attacker can still bypass this protection by tracing the "dynamic linker" on the platform. Interestingly, as the dynamic linker always has the same loading address, it can be used to figure our the offsets where the other libraries needed for a given attack are loaded. 

The detailed white paper  about the entire attack is available here. The video below shows Vincenzo do a demo of the attack.

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the co-founder of Axonize. Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net