A Case Study of MacOS Supply Chain Compromise
summary
Uses osquery for cross‑host state and timelining, Santa for execution events plus binary hashes and signer info, and OpenBSM/audit for file and network activity so process trees show who wrote what and what phone‑home IPs were used. Claims reduce detection from weeks to a day with continuous telemetry and daily key‑value rollups. Demonstrates HandBrake backdoor (Proton RAT) stealing SSH keys, 1Password vaults and keychain data, hashes that remain undetected in VirusTotal for weeks, and WHOIS/IP pivots revealing newly registered, privacy‑protected C2 domains.
AI-written summary · about
chapters (11)
- 0:00Introduction to MacOS monitoring
- 2:53Why supply chain attacks matter
- 7:13Tools for host investigations
- 10:21OSQuery for system state
- 13:59Santa for execution monitoring
- 14:45Audit for network and file activity
- 17:57Proton RAT deep dive
- 20:26Telemetry and logging strategies
- 23:13Enriching DNS and IP data
- 24:59Analyzing handbrake compromise
- 28:59Key takeaways and trends
related talks
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
13mKeynote: Hacking the OSS Supply Chain
29mStealing All macOS Sensitive Info with a Single Vulnerability
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
50mDynamic Analysis of MacOS Malware Using SpriteTree
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack