lundi 24 octobre 2016

New version of Checkout4Mac (0.2)


Checkout4Mac for what ? 

How to quickly detect recent physical activities on your Mac OS X system? How to detect if someone attempted or succeeded to get an access to your Mac let in your hotel room during your dinner or party ? Just in analysing the system logs and files access dates with bash commands (like grep, find, ls, stat, awk, etc.) ... 

Proof of Concept in Python, CheckOut4Mac, has been developed in order to automate the search and identify malicious activities from 3 questions:
  • When did you leave your hotel room ? eg.: 22/6 
  • At what time did you leave your hotel room ? eg: 22 
  • How long time did you leave your hotel room ? eg: 2 
Several artefacts are exploited to answer to the question and you can check that manually:  http://sud0man.blogspot.fr/2015/05/artefacts-for-mac-os-x.html#2 
or automatically with a POC: https://github.com/sud0man/checkout4mac

HOME MENU



INTERACTIVE MENU





NON-INTERACTIVE MENU


EXTRACTED ACTIVITIES in normal mode


EXTRACTED ACTIVITIES in verbose mode



WHICH ACTIVITIES ARE EXTRACTED ?

[]STARTUP ACTIVITIES

[]SESSION ACTIVITIES

[]PHYSICAL CONNECTION ACTIVITIES

[]ESCALATION PRIVILEGES ACTIVITIES

[]APPLICATIONS ACTIVITIES





[]PERSISTENCE ACTIVITIES

[]NETWORK ACTIVITIES


22 commentaires:

  1. Ce commentaire a été supprimé par l'auteur.

    RépondreSupprimer
  2. Hey man, thought you'd like a NON-spambot comment here. This is badass work. Bad. Ass. The fact that you share it is way appreciated, too. Just wanted to let you know. Keep up the good work, bro! I don't follow many blogs, but this one I keep an eye on. You're core, homie.

    -Z-

    RépondreSupprimer
  3. Ce commentaire a été supprimé par l'auteur.

    RépondreSupprimer
  4. Ce commentaire a été supprimé par l'auteur.

    RépondreSupprimer
  5. Nice post thank you for sharing. Printer Tech Support Number 1-800-289-8149 for help you contact.Call us We are 24*7 available. https://www.printertechssupportnumber.com/

    RépondreSupprimer
  6. Nice post thank you for sharing. Antivirus Tech Support Number 1-800-524-2156 for your help.Call us We are 24*7 available. https://www.antivirustechsupports.com/avast-support/

    RépondreSupprimer
  7. Welcome to shopclueswinner.com check your lottery shopclues online lucky draw winner and win a tata safari car and others prize. just call on shopclues online prize department number 91-9835317379.

    Shopclues here thought of an Offer where you can win exceptional Shopclues prize by simply playing a game and win prizes Call @9835317379"
    Shopclues online lucky draw winner
    Shopclues winner 2020
    shopclues car lucky draw

    RépondreSupprimer
  8. Keep it up for more upates about this related blog. Get one of the best SEO Services at OGEN Infosystem the best Digital Marketing Agency in Noida at affordable price.
    SEO Services in Noida

    RépondreSupprimer
  9. Amazing blog, visit Protrek Adventure for Everest Base Camp Trek and Annapurna Base Camp Trek at the best price.
    Everest Base Camp Trek

    RépondreSupprimer
  10. Thanks for this amazing blog. Visit Create N Gift for the special Birthday Gifts for Men and Gifts for Girlfriend in India Online at affordable price.
    Birthday Gifts for Men

    RépondreSupprimer
  11. Really nice blog, thank you so much for sharing this valuable information. Visit Sarswati Enterprises for Aluminum Foil Converting Machine Suppliers in Delhi and Screw Caps Machinery Services.
    Aluminum Foil Converting Machine Suppliers in Delhi

    RépondreSupprimer
  12. Learn how to fix canon printer won't connect to wifi error from our highly skilled experts. Our team is working at day as well as night to resolve your printer errors. So hurry up get in touch with us and for more information visit our website canon printer offline.

    RépondreSupprimer
  13. If you want to know how to fix kindle fire error code 13 then get connected with our team. Our experts tell you the best way to resolve this error. You can get in touch with us any time as we are available round the clock to help you. For more information visit our website Ebook Helpline.

    RépondreSupprimer
  14. Awesome blog, thanks for this your efforts. Visit Veramed for Sensitive Skin Body Moisturizer Online and Anti Hairfall Ayurvedic Hair Care Products at best price.
    Buy Sensitive Skin Body Moisturizer Online

    RépondreSupprimer
  15. Garmin Express has used some of the best sensors and updated technology to help people with their health as well as the road they are traveling on. By Garmin Express can map your router, track them, use data to analyze your speed, it has an altimeter, Bluetooth, preloaded maps, monitor heart rate, and a list of excellent features.

    RépondreSupprimer
  16. Are you looking for an easy way to solve the problem that the canon printer won't connect to wifi? Then you are at the right place. Here you will get a detailed guide that will not only take you through the easy setup of how to connect canon printer to wifi but also throw light on other important aspects. To know more visit Printer Offline Error.

    RépondreSupprimer
  17. Looking for an expert who will guide you and tell you kindle won’t connect to wifi? Then you are landed on the right page. Our team of Ebook Helpline is always available to help you. So hurry up, get connected with us now.

    RépondreSupprimer
  18. If you have any questions regarding how to fix Brother Printer Error 04, then no need to worry; you can consult with our experts. With the help of our experts, you can learn how to easily fix these issues. To know more, just dial our toll-free helpline number at USA/CA: +1-888-966-6097.

    RépondreSupprimer
  19. Get an instant solution to fix Brother printer in Error State with printer offline tech experts. If you are not able to fix this error, then don't worry; you can take help from our experts. For more information, dial our toll-free number at USA/CA +1-888-966-6097.

    RépondreSupprimer