mardi 9 juillet 2013

CheckOut4Mac - v0.1

How to quickly detect recent activities on your Mac OS X system? How to detect if someone attempted or succeeded to get an access to your Mac let in your hotel room during your dinner or party?

Just by analysing the system logs and files access dates with bash commands 
(like grep, find, ls, stat, awk, etc.)

For example, to identify opened emails on July 8 from 8 am to 8:59 am:
grep /Users/sudoman/Library/Mail/V2/IMAP-yyyy\ -type f -name *.emlx -exec stat -f '%Sa %N' '{}' + |grep -i 'Jul  8 08:'|grep 2013

Or to identify attempts to unlock session without success on July 8:
grep -i -B 9 'The authtok is incorrect.' /var/log/system.log|grep-i 'Jul  8'|grep 'Got user'|awk '{print$1,$2,$3,$9,$10}'

You can find a lot of others fun tricks commands here:

Proof of Concept in Python, CheckOut4Mac [], uses these commands and has been developed in order to automate the search and identify malicious activities from 3 questions:
[1] When did you leave your hotel room? eg: 22/6
[2] At what time did you leave your hotel room? eg: 22
[3] How long did you leave your hotel room? eg: 2

You can download readme here : README

CheckOut4Mac checks the following events for a specific date and/or specific hour:

  [a]Startup dates
  [b]Stopping dates
  [c]Hibernation dates
  [d]Out of hibernation dates

  [a]Locked session dates
  [b]Attempt to unlock session without success
  [c]Unlocked session with success

  [a]USB connections
  [b]USB plugged devices
  [c]File system events
  [d]Firewire connections with another machine or storage media
  [e]Firewire connections with another machine or storage media
  [f]Firewire connections to dump RAM (just a  supposition)

  [a]Opened/Closed TTY terminals
  [b]ROOT commands executed with success
  [c]Attempt to execute commands with SUDO without success
  [d]User, password modification and creation

  [a]Opened applications => not always with success (I search another solution)

  [a]Modified files (like autorun App, LaunchAgents or LaunchDaemons)
  [b]Added files (like trojan or malware App)
  [c]Accessed files (like your secret files)
  [d]Accessed Mails (last access dates)

  [a] Ethernet/WiFI connections (activation of 'enX' interface)
  [b] WiFI access points (last connection dates)