Ransom Ain't Goin' Nowhere: Shutting Down macOS Ransomware with Native Apple Protections

Ransom Ain't Goin' Nowhere: Shutting Down macOS Ransomware with Native Apple Protections

Speakers: Calum Hall, Founder, Phorion

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=hIeNuqq12sk

Overview

In this insightful talk from Kawaiicon, Calum Hall, founder of macOS endpoint detection and response (EDR) product Phorion and a seasoned macOS security researcher, delves into the evolving landscape of macOS malware with a specific focus on ransomware. Hall argues that while macOS ransomware has not yet reached enterprise-scale prevalence, it represents a "simmering volcano" that organizations must proactively address given the significant increase in macOS adoption within corporate environments. The presentation provides a comprehensive overview of current macOS ransomware samples, outlines a robust detection strategy, and critically examines how Apple's native Time Machine and APFS snapshots can be leveraged as a powerful, yet often overlooked, defense and recovery mechanism against ransomware attacks.

The core of Hall's discussion revolves around moving beyond traditional detection limitations to achieve rapid, confident remediation. He highlights the inherent challenge of detecting ransomware quickly enough to prevent significant data loss and proposes a novel approach that integrates advanced detection techniques with the immediate recovery capabilities offered by local APFS snapshots. This method aims to nullify the impact of ransomware by restoring encrypted files to their pre-compromise state within minutes, effectively turning a potential disaster into a minor incident.

However, the talk doesn't stop at defense. Hall emphasizes the importance of understanding both sides of the security coin, revealing how the very same snapshot mechanism that protects users can be abused by attackers to bypass file access controls. This dual perspective underscores the need for comprehensive security strategies that not only embrace native protections but also anticipate and mitigate their potential exploitation. For blue teams and enterprise security professionals managing macOS estates, this talk provides actionable intelligence and a call to arms for proactive ransomware preparedness.

Background

▶ Watch: Introduction to macOS ransomware and agenda (0:00)

The macOS threat landscape has undergone a significant transformation over the past decade. Calum Hall recounts his early days in macOS security, where the primary concern was adware, epitomized by threats like Schllayer, often bundled with seemingly innocuous software like Adobe Flash Player. While disruptive for individuals, adware posed a relatively low risk to enterprise environments. Fast forward to 2023, and the landscape is dominated by info-stealers, which have become the most common macOS malware. These threats, while still impacting individuals by compromising crypto wallets, credit cards, and browser sessions, pose a far greater risk to enterprises by serving as initial entry points into corporate networks. Thankfully, info-stealers are often predictable in their targeting (e.g., crypto wallets, cookies) and can be detected with appropriate tooling.

However, the "simmering volcano" that Hall warns about is macOS ransomware. Despite a lack of widespread enterprise-scale breaches, multiple samples and scares have emerged, leading researchers to believe a significant outbreak is inevitable. This concern is amplified by the accelerating adoption of macOS devices in corporate settings. Hall cites Cisco's finding that 60% of their employees are now choosing Macs, signaling a clear trend that attackers will inevitably follow. "Attackers go where the users are," Hall states, emphasizing the need for robust ransomware protections on macOS before it becomes a pervasive problem.

Several notable macOS ransomware samples underscore this evolving threat:

• Desh David Davados Ransomware (June 2020): Discovered by Desh David Davados, this sample exhibited sophisticated capabilities, including data theft and exfiltration (grabbing notes, cookies) prior to encrypting the file system. It targeted specific, valuable file types like documents and cryptocurrency wallets, rather than indiscriminate encryption. Interestingly, the ransom note demanded a mere $50, suggesting it was likely aimed at individual users rather than enterprises. Hall notes its persistence mechanisms and multiple binaries made it particularly challenging for reverse engineering in virtual environments.
• "Knock LockBit" (Late 2023): This ransomware variant claimed affiliation with the notorious LockBit group, but security researchers largely dismissed this claim. Discrepancies in version numbers (claiming 2.0 when LockBit was at 3.0) and the apprehension of core LockBit developers earlier that year made the affiliation highly improbable. While the Windows variant of this malware targeted shadow backups, the macOS sample lacked this specific capability. The use of the LockBit name, however, served as an effective fear-mongering tactic.
• "Ransom Vibing" (Late 2023): Recently discovered and documented by Secure Annex, this curious sample appeared as a VS Code extension. Described as capable of archiving, encrypting, and exfiltrating data, it was primarily observed targeting a /tmp/testing directory. Hall cautions against immediately labeling it as a full-blown threat actor operation, suggesting it could potentially be a university project. Nevertheless, its existence demonstrates a growing interest in developing and deploying ransomware-like capabilities on macOS.

These samples, regardless of their immediate impact or sophistication, highlight a clear trajectory: macOS is increasingly becoming a target for ransomware developers. The historical progression from adware to info-stealers, coupled with increasing enterprise adoption, makes proactive defense a critical imperative.

Key Findings

▶ Watch: Analysis of early macOS ransomware samples (4:40)

The central findings presented by Calum Hall revolve around the emerging threat of macOS ransomware and the innovative application of native Apple technologies for defense.

Firstly, Hall confirms that macOS ransomware is an undeniable, albeit currently contained, threat. While not yet reaching the enterprise-wide impact seen on Windows, its presence in various forms (from individual-targeted, low-ransom variants to those leveraging notorious group names) signals its inevitable growth. The increasing adoption of macOS in corporate environments acts as a magnet for threat actors, making proactive preparation essential.

Secondly, Hall meticulously outlines a multi-pillar detection strategy involving file modification monitoring, process legitimacy evaluation, and sophisticated file encryption analysis. A significant contribution is the emphasis on using entropy analysis, Monte Carlo integration, and the Chi-squared test to reliably distinguish encrypted data from compressed or legitimate files. This technical approach provides the confidence needed for automated responses.

However, a critical finding is the "50 files problem" – the inherent trade-off between detection confidence and speed of response. Waiting for a sufficient sample size of encrypted files (e.g., 50 or 100) to confirm ransomware activity drastically increases the true positive rate but risks significant data loss before remediation can even begin. This fundamental challenge underscores the need for a rapid recovery mechanism that can mitigate damage even if initial detection is not instantaneous.

This leads to the talk's most significant finding: Apple's Time Machine local snapshots offer a powerful, native, and often underutilized mechanism for ransomware damage mitigation and recovery. Hall demonstrates that these APFS snapshots capture a point-in-time state of the file system, are read-only, and can be mounted to restore individual files or entire directories. This capability effectively nullifies the "50 files problem" by allowing defenders to recover any data encrypted before the ransomware process is detected and terminated.

Finally, Hall reveals a crucial defensive paradox: the very mechanism designed for recovery can be exploited for offense. Attackers can leverage the ability to mount local snapshots to bypass traditional file access controls. By accessing sensitive data (like browser cookies or keychains) from a mounted snapshot rather than the live file system, an attacker can circumvent protections like Full Disk Access (FDA). This highlights that while native protections are powerful, their implementation requires a deep understanding of potential abuse cases and necessitates additional hardening measures.

Technical Deep Dive

▶ Watch: Utilizing Apple's Time Machine local snapshots (14:00)

Calum Hall's talk provides a detailed exploration of both ransomware detection methodologies and the technical underpinnings of Apple's Time Machine snapshots, culminating in a robust strategy for ransomware defense and recovery.

Ransomware Detection Strategy

The proposed detection strategy is built upon three core pillars, designed to identify and respond to ransomware activity with increasing confidence:

1. File Modification Monitoring: The initial layer involves monitoring file modification at scale. In an enterprise macOS environment, EDR or telemetry gathering solutions should track processes that write a large number of files within a short period. While activities like cloning a Git repository or installing a package can generate similar bursts of writes, this serves as an initial anomaly indicator.
2. Process Evaluation: Once suspicious file modification activity is observed, the next step is to evaluate the legitimacy of the responsible process. Key indicators include:

• Code Signing: macOS binaries are typically signed by Apple or a registered developer. An unsigned binary performing extensive file modifications is highly suspicious. However, Hall cautions that Apple itself can make mistakes, and signing isn't a perfect indicator.
• Binary Create Times: Anomalous creation times for the executable.
• Origin: Where the binary was downloaded or executed from.

Hall uses Google Updater as an example of a legitimate process that can exhibit "crazy" and suspicious behavior, underscoring that there's "no such thing as a silver bullet" in security.

1. File Encryption Analysis: This is the most critical and technically sophisticated layer. After identifying an untrusted process modifying numerous files, the contents of those files are analyzed to determine if they are encrypted. The challenge lies in distinguishing legitimate data from encrypted data with high confidence, especially differentiating encryption from compression. Hall suggests two well-known mathematical tests:

• Entropy Analysis: This involves evaluating the randomness of bytes within a file. Encrypted data typically exhibits high entropy (appears highly random), whereas plain text or compressed data has lower entropy.
• Monte Carlo Integration and Chi-squared Test: These statistical tests can be applied to further differentiate between encrypted and compressed data. While both can appear random, their statistical properties differ. Hall humorously recommends consulting ChatGPT for simplified explanations if one is "terrible at math."

Detection Challenges

Several challenges complicate ransomware detection:

• File Size for Confidence: Entropy analysis requires a file of reasonable size (e.g., more than 100 bytes) to confidently determine if it's encrypted. Small files yield unreliable results.
• Developer Anomalies: Legitimate applications can sometimes exhibit behaviors that mimic malicious activity, leading to false positives (e.g., Google Updater).
• True Positive Rate vs. Speed: Achieving a high true positive rate (confidence) often requires observing more encrypted files. This leads to the "50 files problem": waiting for 50 or 100 files to be encrypted before taking action ensures higher confidence but means potentially losing valuable data. Ransomware often encrypts files randomly, not sequentially, making this a significant gamble.

Time Machine and APFS Snapshots

To address the "50 files problem" and provide a robust recovery mechanism, Hall introduces Apple's Time Machine and its underlying APFS snapshots.

• Time Machine Overview: Introduced in 2007, Time Machine is Apple's built-in backup solution. Its key feature is the use of local snapshots, which Hall likens to Windows Volume Shadow Copies.
• APFS Snapshot Mechanism:
• Point-in-Time Capture: An APFS snapshot captures the state of the file system at a specific moment.
• Copy-on-Write: Instead of creating a full copy of the data, the system marks the original data blocks as read-only. If a file is subsequently modified, the changes are written to a new location on disk, leaving the original data blocks (referenced by the snapshot) untouched. This makes snapshots highly efficient in terms of storage.
• Frequency: Snapshots are automatically taken hourly, and also before major OS events (like updates) and full backups.
• Retention: Typically, local snapshots are retained for a 24-hour period, though Apple's cleanup mechanisms can sometimes orphan them sooner.
• Storage: Snapshots reside on the APFS data volume and are not mounted by default.
• Access: They can be accessed via volumes/Apple Time Machine Local Snapshots when Time Machine needs them, or manually mounted using the tmutil utility. Manual mounting requires Full Disk Access (FDA), which Hall notes is often granted to terminals and other applications, making it a "pretty low bar" for an attacker.

The read-only nature of these snapshots is paramount: once a snapshot is taken, the data it points to cannot be altered, even if ransomware is actively encrypting the live file system. This makes them an invaluable resource for recovery.

Demo / Proof of Concept

▶ Watch: Ransomware remediation strategy with local snapshots explained (17:00)

Calum Hall's presentation includes two critical demonstrations: one showcasing the integrated ransomware detection and recovery process, and another illustrating the potential for snapshot abuse by attackers.

Ransomware Detection and Recovery Demo

The first demonstration highlights the effectiveness of combining rapid detection with Time Machine snapshot recovery.

1. Ransomware Execution: Hall initiates a custom "test ransomware" targeting a specific directory on a macOS host. This allows for controlled testing without the risks associated with real-world samples.
2. Partial Encryption and Detection: As the ransomware begins its work, approximately half of the files in the target directory are encrypted before the EDR solution detects the malicious activity and immediately kills the ransomware process. This scenario perfectly illustrates the "50 files problem" – some data is inevitably encrypted before the threat is neutralized.
3. Alert Visualization: The demo then shifts to the EDR interface, displaying an alert detailing the detected ransomware activity. This includes identifying the responsible binary and a comprehensive log of file creation and rename events attributed to the ransomware. This telemetry is crucial for understanding the scope of the damage.
4. Automated Recovery: Hall then triggers an automated recovery action. This process involves:

• Identifying Encrypted Files: Using the collected telemetry, the system pinpoints all files that were modified or created by the ransomware.
• Mounting Snapshot: The latest available local Time Machine snapshot (taken within the last two hours in this scenario) is mounted. Hall reiterates that these snapshots are read-only, ensuring their integrity even if the ransomware were still active.
• Restoration: The system proceeds to:
• Delete any newly created encrypted files.
• Copy the original versions of the modified/encrypted files from the mounted snapshot back to their original locations.
• Rename any files that were renamed by the ransomware back to their original names.

1. Data Restored: The demonstration concludes with the target directory fully restored, all encrypted files reverted to their original state. Hall emphasizes that the system is "exactly where it was a maximum of two hours ago," effectively nullifying the ransomware's impact.

Offensive Snapshot Abuse Demo

The second demonstration illustrates how the same powerful snapshot mechanism can be repurposed by an attacker to bypass macOS file access controls.

1. Blocked Access: Hall first attempts to directly read his Chrome cookies database from its standard location (~/Library/Application Support/Google/Chrome/...). As expected, due to file access controls (likely Full Disk Access restrictions on the terminal), the command results in an "authorization denied" error.
2. Snapshot Creation: Using the tmutil snapshot command, Hall quickly creates a new local APFS snapshot of the device. This command executes rapidly, highlighting the ease with which snapshots can be generated.
3. Snapshot Mounting: He then extracts the timestamp of the newly created snapshot and uses tmutil mountlocalsnapshots / to mount it to a temporary directory. Again, this action is swift.
4. Bypass Achieved: With the snapshot mounted, Hall changes the file path in his cat command to point to the Chrome cookies database within the mounted snapshot (e.g., /tmp/snapshot/Users/calum/Library/Application Support/Google/Chrome/...). This time, the command executes successfully, and the contents of the Chrome cookies database are displayed on screen.

This demonstration powerfully illustrates that while Time Machine snapshots are a robust defensive tool for data recovery, they also introduce a potential attack vector. Attackers who gain sufficient privileges (like Full Disk Access) can leverage snapshots to access sensitive user data that would otherwise be protected by live file system access controls.

Defensive Implications

▶ Watch: Offensive: Bypassing file access controls using snapshots (22:50)

Calum Hall's talk provides a clear roadmap for macOS defenders, urging proactive measures and a comprehensive understanding of both the benefits and risks associated with native Apple protections.

1. Prepare for Ransomware Now: The most critical implication is to not wait for macOS ransomware to become a widespread enterprise problem. Given its prevalence on Windows and in cloud environments, and the increasing adoption of Macs in corporate settings (e.g., Cisco's 60% Mac user base), it's highly likely to become a significant threat. Defenders should implement capabilities now rather than reacting after a breach. This involves treating macOS as a first-class citizen in security planning, not a "second-ass citizen" with fewer dedicated tools.
2. Evaluate Detection Capabilities: Blue teams must assess their current tooling and telemetry to determine if they can detect macOS ransomware. This means identifying telemetry gaps (e.g., granular file modification logs, process execution details) and tooling gaps (e.g., EDR solutions capable of macOS-specific ransomware analysis). The ability to perform entropy analysis, Monte Carlo integration, and Chi-squared tests on suspicious files is crucial for high-confidence detection.
3. Automate Local Snapshots: Leveraging Apple's native Time Machine local snapshots is a low-hanging fruit for damage mitigation. Defenders should implement automated mechanisms to take snapshots periodically (e.g., every two hours) using built-in commands like tmutil snapshot. This ensures that a recent, safe copy of files is always available for recovery, effectively nullifying the "50 files problem" by making any pre-detection encryption reversible.
4. Protect Snapshots from Offensive Abuse: While powerful for defense, snapshots present a new attack surface. Defenders must implement measures to protect them:

• Monitor tmutil Usage: Track and alert on manual usage of the tmutil utility, especially for snapshot creation or deletion. Legitimate manual snapshot activity should be rare in an automated enterprise environment.
• Block Snapshot Deletion: Implement policies or controls to prevent unauthorized deletion of local snapshots, as an attacker would likely attempt to destroy recovery points.
• Monitor Manual APFS Mounts: Alert on any manual mounting of APFS snapshots, particularly if it occurs outside of a controlled recovery process. This is a strong indicator of suspicious activity.
• Review Full Disk Access (FDA) Grants: Conduct thorough hunting to identify all applications, especially terminals and scripting environments, that have Full Disk Access. Restrict FDA to only those applications that absolutely require it, as FDA is a prerequisite for mounting snapshots and exploiting them.

1. Broaden File Access Authorization Rules: Traditional file access controls often focus on standard user directories (e.g., /Users/). However, as shown in the demo, attackers can bypass these by accessing data from a mounted snapshot (e.g., /volumes/Apple Time Machine Local Snapshots/...). Defenders should broaden their file access authorization rules to include generic paths and potential snapshot mount points, ensuring protections extend beyond the live file system.
2. Red Team Testing: Hall strongly encourages red teamers to test these defensive measures. "If you run a blue team, especially if you're using any tools to protect your cookies, get one of your red teamers to go and test this. It is a lot of fun." This adversarial mindset is essential for validating defenses and identifying weaknesses before attackers do.

By embracing these defensive implications, organizations can significantly enhance their macOS security posture, transforming a reactive stance against ransomware into a proactive, resilient strategy.

Key Takeaways

• Proactive Preparedness is Paramount: macOS ransomware, while currently a "simmering volcano," is an inevitable and growing threat. Organizations must prepare now by implementing robust detection and recovery capabilities, treating macOS security with the same rigor as other platforms.
• Native Apple Snapshots are a Powerful Defense: Apple's Time Machine local APFS snapshots offer an underutilized and highly effective mechanism for ransomware damage mitigation. Their read-only nature ensures data integrity, enabling rapid recovery of encrypted files to their pre-compromise state.
• Comprehensive Detection is Multi-Layered: Effective ransomware detection involves monitoring file modifications, evaluating process legitimacy (signed vs. unsigned binaries), and performing sophisticated file encryption analysis using techniques like entropy analysis, Monte Carlo integration, and the Chi-squared test.
• Balance Speed and Confidence in Detection: The "50 files problem" highlights the critical trade-off between achieving high confidence in ransomware detection and minimizing data loss. Leveraging snapshots for recovery allows for a more aggressive detection posture without sacrificing data integrity.
• Snapshots Present an Attack Vector: The same snapshot capabilities that protect data can be abused by attackers to bypass traditional file access controls (e.g., Full Disk Access) and exfiltrate sensitive information from mounted snapshots.
• Robust Defense Requires Holistic Security: Defenders must automate snapshot creation, actively protect these snapshots from deletion and unauthorized mounting, broaden file access authorization rules to cover snapshot locations, and meticulously audit applications with Full Disk Access. Red team testing is crucial to validate these defenses.

About the Speaker(s)

Calum Hall is the co-founder of Phorion, a macOS endpoint detection and response (EDR) product. With a career deeply rooted in macOS enterprise security, Calum is a dedicated macOS security researcher at heart. While currently working in the blue team world, his passion for offensive security heavily influences his approach to understanding and defending macOS environments. His expertise lies in attacking and defending macOS enterprise estates, and he has shared his research at prestigious conferences such as Black Hat, Objective by the Sea, and Kawaiicon.