Demystifying (and Bypassing) macOS's Background Task Management
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.
Summary
Rearchitecting Persistence in macOS Ventura
Malware relies on persistence mechanisms to maintain execution across system reboots. In macOS Ventura, Apple introduced Background Task Management (BTM) to alert users to persistent items.
Reverse Engineering BTM Internals and SQLite Stores
Patrick Wardle explores the undocumented daemon architecture, private XPC endpoints, and internal databases that macOS uses to track LaunchDaemons, LaunchAgents, and login items.
Open-Source Enumeration Tooling for Forensics
Because Apple's proprietary framework broke existing heuristic detection pipelines, Wardle releases open-source tools to programmatically extract and inspect all registered persistent items.
Trivially Bypassing BTM Alerts
Analyzing subtle design oversights in user notification handling demonstrates how malicious binaries can silently install persistent launch components without triggering security alerts.
Related talks
Main Stage·21 min
Patrick Wardle
Patrick Wardle presents specialized reverse engineering techniques and tooling to automatically extract obfuscated AppleScript and shell payloads from macOS malware.
Main Stage·40 min
Alessandro Magnosi · Arash Parsa · Athanasios Tserpelis
Introduces Full Moon and Half Moon call stack spoofing techniques to evade EDR inspection, alongside the Eclipse kernel detection algorithm.
Main Stage·42 min
Laurie Kirk
Laurie Kirk unveils runtime manipulation techniques in native C++ via JNI to alter Android execution flow, defeating emulators and decompilers.