Andy Grant - Unpacking PKGs: A Look Inside macOS Installer Packages
Dissects macOS PKG installer internals to reveal how malware authors abuse the package format for persistence and privilege escalation.
Summary
macOS PKG Package Abuse
Andy Grant (Security Research Engineer, NCC Group) presents a deep technical analysis of the macOS PKG installer format and how malware authors abuse it for code execution, persistence, and privilege escalation.
PKG Format Internals
The macOS PKG format (an XAR archive containing a Bill of Materials, component archives, and pre/post-flight scripts) provides attackers with multiple code execution hooks: preinstall and postinstall scripts run with root privileges during installation and are commonly exploited by malware bundled with pirated software.
Code Signing and Notarization Gaps
Grant demonstrates that signing a malicious PKG with a valid Apple Developer certificate satisfies macOS Gatekeeper checks. Until 2019, malicious PKGs with valid developer signatures bypassed notarization review, enabling macOS malware distribution through official channels.
Forensic Analysis and Detection
The talk provides forensic analysis techniques for identifying malicious PKG installers — inspecting pre/postinstall scripts, embedded binary payloads, and anomalous LaunchAgent/LaunchDaemon installations triggered by installer scripts.
Related talks
Main Stage·49 min
Patrick Wardle
Demonstrates how macOS malware authors abuse legitimate Apple APIs and signing to create persistent, undetected implants.
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.
Main Stage·31 min
Patrick Wardle
Patrick Wardle analyzes emerging macOS macro-based Office malware campaigns, dissecting Apple sandbox escapes and synthetic click persistence tricks.