Talks·50 min
Cedric Owens · Jaron Bradley · Patrick Wardle
Explains how a logic flaw in macOS policy code let unsigned apps bypass Gatekeeper, and how it was exploited as a zero-day.
vulnerability-researchreverse-engineeringmalware-analysis+2
October 2021 · Spain
Objective by the Sea v4.0
1 session · 16 talks
Sessions at this event
All OBTS v4.0 talks
Filters+
1–16 of 16 talks
Talks·31 min
Patrick Wardle
Walks through arm64 reversing basics and the anti-debugging and anti-VM checks in an early Apple Silicon Mac malware sample.
malware-analysisreverse-engineeringanti-analysis+2
Talks·24 min
Andy Grant
Shows how root access on macOS can grant arbitrary apps TCC permissions such as Full Disk Access without user prompts.
attackautomationsystem+2
Talks·45 min
Cat Self · Adam Pennington
Shows how MITRE ATT&CK for macOS can structure OceanLotus threat intelligence, hunting and emulation work.
frameworkintelligencethreat-detection+2
Talks·25 min
Ron Waisberg
Shows how a LaunchServices logic flaw let a sandboxed macOS app escape the App Sandbox in several ways.
vulnerability-researchsandboxexploiting+2
Talks·50 min
Joel Rennich
Shows how WebAuthn and FIDO work on macOS and how a browser extension can interfere with registration and login.
identityattackdevice+2
Talks·43 min
Christine Fossaceca
Shows how to set up Frida on a jailbroken iPhone and use it to hook and trace running iOS processes.
reverse-engineeringframeworktool+2
Talks·18 min
08tc3wbb
Shows how a kernel driver on Apple M1 Macs was exploited after Apple's earlier patches fell short.
kernelexploitvulnerability-research+2
Talks·36 min
Thomas Reed
Walks through Mac malware and adware detection data, showing where each sample appeared and what stood out.
malware-analysisdetectionthreat+2
Talks·1 hr
Runa Sandvik · Patrick Wardle
Walks through two leaked macOS implants tied to the CIA and NSA, covering triage, string decryption, and remote tasking logic.
malware-analysisreverse-engineeringintelligence+1
Talks·43 min
Csaba Fitzl
Explores how macOS mount operations enable privilege escalation and privacy bypasses, from kernel MAC hooks to real exploits.
vulnerability-researchkernelexploitation+2
Talks·26 min
Josh Long
Compares macOS security patch coverage across supported releases and asks whether older versions stay as safe as the newest.
vulnerabilitiessystemtrust+2
Talks·28 min
Chris ross
Covers macOS installer plugins as a native code route for initial access, and how Apple's changes shorten their process lifetime.
macosattackexploitation+2
Talks·32 min
Sarah Edwards
Maps what Apple Wallet stores on iOS and macOS, from passes and transactions to Apple Cash and transit trips.
deviceprivacymobile+1
Talks·28 min
Eva Galperin
Shows how stalkerware and Apple's AirTag enable intimate partner abuse, and where current mitigations fall short.
privacystalkerwareiot+2
Talks·36 min
Tony Lambert
Shows how macOS packages, disk images and developer libraries get abused to run code, with detection ideas.
macosmalware-analysissupply-chain+1