Rosetta 2 Keeping Mac Malware Alive for Years to Come
Channel: BSidesDFW
Date: 2022-11-21

BSidesDFW 2022 Track 2 Session 4 - 05 Nov 2022

Rosetta 2: Keeping Mac Malware Alive for Years to Come

In late 2020, Apple announced that they were changing their processor architecture from Intel to ARM and introduced their new chip, the M1. This switch in architecture would normally cause a plethora of compatibility issues with existing software, however Apple also released the Rosetta 2 translation layer to mitigate compatibility issues. Rosetta 2 allows for Intel-compiled binaries to run on the ARM processor through dynamic binary translation, removing the need for all applications to be updated and recompiled with Apple silicon-specific support. The announcement of these features led our team to wonder which steps, if any, would be needed to enable malware compiled for Intel systems to execute and infect systems on the new architecture. We were also curious about which of the native and Objective-C API functions commonly abused by Intel-compiled Mac malware were present and functioning on Apple Silicon. To answer these questions, we first ran many Mac malware samples originally found in the wild during targeted attacks. These samples were compiled for Intel systems, and we observed and documented their behavior on our M1 test systems. We also developed proof-of-concept applications that mimicked behavior observed in historical Mac malware, and documented which features are still available to malware authors. In this talk, we present the results of our research and analysis efforts, many of which surprised us, as well as discuss system changes in macOS that are now relevant to incident response handling and malware analysis.

@rmettig_
Raphaela is a cybersecurity researcher currently affiliated with the LSU Applied Cybersecurity Lab (ACL) whose main areas of research focus are memory forensics and malware analysis. She rceived her Bachelor of Science and Master of Science degrees in Computer Science from Louisiana State University and has also worked as a threat intelligence analyst and as a product security engineer throughout her degrees. In her free time, she enjoys playing guitar, going to concerts, and reading.
rmettig.github.io

Charles is a cybersecurity instructor at Louisiana State University (LSU) who is also affiliated with the Applied Cybersecurity Lab. He received his B.S. and M.S. in Computer Science from LSU in 2019 and 2022 respectively. He has also interned at Los Alamos National Laboratory and co-founded a software development company. In his free time, he enjoys many different forms of exercise, being in nature, and playing piano and baduk.
Charles Glass