Month: March 2018

Uncategorized

defending against EvilOSX, a python RAT with a twist in its tail

I am often torn between sharing such a dangerous tool and just keeping it among the hands of few. But then I think, well, a way to protect yourself and your systems is at least offered here. So, here we go. To use the words of philastokes from APPLEHELPWRITER, “Stay safe, folks!”


Intro
EvilOSX is a malware project hosted on GitHub that offers attackers a highly customisable and extensible attack tool that will work on both past and present versions of macOS. The project can be downloaded by anyone and, should that person choose, be used to compromise the Macs of others.

What particularly interested me about this project was how the customisation afforded to the attacker (i.e., anyone who downloads and builds the project, then deploys it against someone else) makes it difficult for security software like my own DetectX Swift to accurately track it down when it’s installed on a victim’s machine.

In this post we’ll explore EvilOSX’s capabilities, customisations, and detection signatures. We’ll see that our ability to effectively detect EvilOSX will depend very much on the skill of the attacker and the determination of the defender.

For low-skilled attackers, we can predict a reasonably high success rate. However…

View original post 2,321 more words

Advertisements
macbookOS XSecurityUncategorized

When Was The Password Last Changed On This Mac?

In one more of these wonderful scripts that can do crazy things,  philastokes from APPLEWRITERHELPER, has handed you the keys to the kingdom. With this simple script, you can find our the last time the passwords for a set number of users was changed on a Mac running OS. And that right from your Terminal.

Sometimes it can be useful to know when the user’s password was last changed. For example, you might want to enforce a policy of having users (or yourself!) change login passwords after a given period. Alternatively, if you or one of your users is experiencing login difficulties, you might want to check that the password […]

#one liner command line to get last password set times for all users on the mac

# see http://applehelpwriter.com/2018/03/14/6228
echo; echo Password Last Changed:; u=$(dscl . list /Users | egrep -v ‘^_|daemon|nobody’); for i in $u; do printf \\n$i\\t; currentUser=$i;t=$(dscl . read /Users/”$currentUser” | grep -A1 passwordLastSetTime | grep real | awk -F’real>|</real’ ‘{print $2}’); date -j -f %s “$t” 2> /dev/null; done

via how to find when the login password was last changed —