Detecting objective-C malware through memory forensics

Abstract

Major advances in memory forensics in the past decade now allow investigators to efficiently detect and analyze many types of sophisticated kernel-level malware. With operating systems vendors now routinely enforcing driver signing and integrating strategies for protecting kernel data, such as Patch Guard, userland attacks are becoming more attractive to malware authors, as evidenced in the notorious Crisis malware. We therefore turn our attention to improving memory forensics techniques for analysis of malware in userland.In this paper, we focus on new methods for detecting userland malware written in Objective-C on Mac OS X. As the paper illustrates, Objective-C provides a rich set of APIs that malware can use to manipulate and steal application data and to perform other malicious activities. Our novel memory forensics techniques deeply examine the state of the Objective-C runtime inside of targeted processes, identifying a number of suspicious activities, from keystroke logging to pointer swizzling. We then examine our techniques against memory samples infected with malware found in targeted OS X attacks.