Digital Forensics / Incident Response (DFIR)

APOLLO tool

• Presentation slides
• Source code

[AutoMacTC](https://github.com/CrowdStrike/automactc)

• Modular forensic triage collection framework

[mac-apt](https://github.com/ydkhatri/mac_apt)

• DFIR scripts

[OSX incident response](https://www.youtube.com/watch?v=gNJ10Kt4I9E)

• Slides

[venator](https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56)

• Source

Hardening

[Sandblaster](https://github.com/malus-security/sandblaster)

• Paper

Other OSX Awesome lists

[EvilOSX](https://github.com/Marten4n6/EvilOSX) - Pure python post-exploitation toolkit

• ashishb/osx-and-ios-security-awesome

Presentations and Papers

[Attacking OSX for fun and profit tool set limiations frustration and table flipping Dan Tentler](https://www.youtube.com/watch?v=9T_2KYox9Us)

• Follow-up from target

[SandScout: Automatic Detection of Flaws in iOS Sandbox Profiles](http://www.icri-sc.org/fileadmin/user_upload/Group_TRUST/PubsPDF/sandscout-final-ccs-2016.pdf)

• Presentation

[Security on OSX and iOS](https://www.youtube.com/watch?v=fdxxPRbXPsI)

• Slides

[Thunderstrike](https://trmm.net/Thunderstrike_31c3)

• Video

[Writing Bad @$$ Malware for OSX](https://www.youtube.com/watch?v=fv4l9yAL2sU)

• Slides

Useful tools and guides

[Remote Packet Capture for iOS Devices](https://useyourloaf.com/blog/remote-packet-capture-for-ios-devices/)

• Python utility
• Another python utility

[xnumon](https://www.roe.ch/xnumon)

• source

Virus and exploit writeups

[ChaiOS bug](https://www.grahamcluley.com/chaios-bug-crash-ios-macos-messages/)

• previous - security-blog/crash-text-message-iphone/) rendering Arabic characters

Exploiting the Wifi Stack on Apple Devices

• Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
• Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)
• Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices
• Over The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices
• Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

[Flashback](https://www.cnet.com/news/more-than-600000-macs-infected-with-flashback-botnet/)

• Detailed analysis

[I can be Apple, and so can you](https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/)

• Creating signed and customized backdoored macos apps

[iWorm](https://www.thesafemac.com/iworm-method-of-infection-found/)

• Detailed analysis

Meltdown

• Measuring OSX meltdown patches performance
• iPhone performance after Spectre patch
• Proof of concept

[Proof of Concept for Remote Code Execution in WebContent](https://github.com/externalist/exploit_playground/blob/master/CVE-2018-4233/pwn_i8.js)

• MachO tricks - Appears to be slides from a presentation that ends with the CVE listed above