trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

Implement detection of filesystem anti-forensics #34

Closed mike-myers-tob closed 4 years ago

mike-myers-tob commented 4 years ago

Although macOS uses APFS now, not HFS+, there may be methods of filesystem anti-forensics similar to the use of Alternate Data Streams on NTFS volumes, by which an attacker might hide their presence on the filesystem.

Research and further detail is needed here, to determine what exactly should be getting detected. It might build upon issue #23

The feasibility challenge is that any kind of whole-filesystem activity monitoring is performance prohibitive.