Detecting objective-C malware through memory forensics

In this paper, we focus on new methods for detecting userland malware written in Objective-C on Mac OS X. As the paper illustrates, Objective-C provides a rich set of APIs that malware can use to manipulate and steal application data and to perform other malicious activities. Our novel memory forensics techniques deeply examine the state of the Objective-C runtime inside of targeted processes, identifying a number of suspicious activities, from keystroke logging to pointer swizzling. We then examine our techniques against memory samples infected with malware found in targeted OS X attacks.