Patrick Wardle - Harnessing Weapons of Mac Destruction
Demonstrates how macOS malware authors abuse legitimate Apple APIs and signing to create persistent, undetected implants.
Summary
macOS Offensive Tradecraft
Patrick Wardle (Principal Security Researcher, Jamf, founder of Objective-See) presents advanced macOS offensive techniques used by state-sponsored actors and commodity malware authors.
Code Signing and Notarization Bypass
Wardle demonstrates techniques to sign malicious payloads with developer certificates or abuse the ad-hoc signing mechanism, and discusses gaps in Apple's notarization service that allowed signed malware to pass automated scanning.
LaunchAgent and LaunchDaemon Persistence
Detailed coverage of macOS LaunchAgent/LaunchDaemon persistence, including user-level and system-level plist injection, and how macOS System Integrity Protection (SIP) creates a false sense of security when attackers already have user-level code execution.
Keychain and iCloud Credential Theft
Wardle shows how malware with local privilege escalation can dump plaintext credentials from the macOS Keychain by abusing accessibility APIs and injection into trusted processes, bypassing keychain access prompts.
Related talks
Main Stage·22 min
Andy Grant
Dissects macOS PKG installer internals to reveal how malware authors abuse the package format for persistence and privilege escalation.
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.
Main Stage·31 min
Patrick Wardle
Patrick Wardle analyzes emerging macOS macro-based Office malware campaigns, dissecting Apple sandbox escapes and synthetic click persistence tricks.