Talks·36 min
Greg Lesnewich · Jacob Latonis
Shows how Mach-O metadata features like dylib hashes and entitlement clusters help track North Korean macOS malware families in YARA-X.
malware-analysisintelligenceopen-source+2
December 2024 · Maui, USA
Objective by the Sea v7.0
1 session · 22 talks
Sessions at this event
All OBTS v7.0 talks
1–22 of 22 talks
Talks·27 min
Kimo Bumanglag · Joseph Millman
Shows how an LLM can triage macOS command-line telemetry to flag malware and masquerading that static checks miss.
aithreat-detectionmacos+2
Talks·16 min
Examines the delivery of Apple's Rapid Security Response updates and how their timing compares to the name.
updateresponsevulnerabilities+2
Talks·28 min
Wojciech Regula
Shows how low-privileged code can drain credentials from popular macOS password managers through isolation gaps.
applicationvulnerability-researchattack+2
Talks·25 min
Mickey Jin
Traces a PackageKit logic flaw through repeated Apple patches and the bypasses that followed each fix.
vulnerability-researchexploitationvulnerabilities+2
Talks·25 min
Matthias Frielingsdorf
Walks through the analysis of an NSO BlastPass iOS exploit sample and what it reveals about commercial spyware detection.
mobilemalware-analysisexploitation+2
Talks·8 min
Martina Tivadar
Shows how a machine learning service that flags macOS malware gets built, from log collection to a deployed web app.
machine-learningmalware-analysisthreat-detection+1
Talks·27 min
Laurie Kirk
Presents an open-source iOS decompiler that unpacks IPA resources and reconstructs Swift and Objective-C code on any platform.
reverse-engineeringapplicationopen-source+3
Talks·19 min
Covers how investigators recover and examine data held in iPhone backup files for forensic work.
mobiledeviceincident-response
Talks·20 min
Brandon Dalton · Csaba Fitzl
Explains how launchd can be queried for XPC service metadata to help detect abuse of privileged macOS helper services.
macosthreat-detectionvulnerability-research+2
Talks·27 min
Jaron Bradley
Shows how mapping macOS malware into 3D space helps analysts tune YARA rules, identify families and hunt threats.
malware-analysismachine-learninghunting+1
Talks·28 min
Maddie Stewart · Suweera De Souza
Surveys the macOS infostealer market, its operators, delivery campaigns, and Cuckoo stealer's C2 protocols.
macosmalware-analysisthreat+2
Talks·29 min
Patrick Wardle
Shows how in-memory code loading still works on macOS 15 by reusing an older open-source dyld loader.
macosattackdetection+2
Talks·27 min
John McIntosh
Walks through patch diffing Apple OS updates with IPSW files, Ghidra and open-source tools, tying binary changes to CVEs.
vulnerability-researchreverse-engineeringopen-source+3
Talks·31 min
Alden Schmidt · Stuart Ashenbrenner
Traces macOS infostealer families like AMOS and Poseidon through their code, obfuscation, and infrastructure, with detection ideas.
malware-analysisthreat-detectionreverse-engineering+1
Talks·42 min
Bill Marczak · Christine Fossaceca
Traces a zero-click iOS spyware campaign from device log artifacts to a calendar invite that carried malicious XML.
mobilemalware-analysisexploit+2
Talks·17 min
Chris Lopez
Walks through how Swift binaries look in arm64 disassembly, covering strings, arrays, metadata and calling conventions.
swiftreverse-engineeringmalware-analysis+2
Talks·42 min
Aleks Nikolic
Traces a macOS font rendering bug from an undocumented TrueType instruction to memory corruption, rebuilt without a sample.
vulnerability-researchreverse-engineeringexploitation+2
Talks·45 min
Colson Wilhoit
Shows how behavior-based rules catch macOS threats that signatures and ML models miss, using real C2 tradecraft examples.
threat-detectiondetectiondefensive-security+2
Talks·39 min
Lukas Arnold
Shows how iPhone baseband traffic can be decoded and used to flag suspicious cell towers with the CellGuard app.
reverse-engineeringdetectionmobile+2
Talks·11 min
L. Wilske
Explains the timestamp formats found in iOS sysdiagnose files and how they can reveal system time and time zone changes.
mobiledeviceincident-response+1
Talks·19 min
Marcio Almeida
Shows how Apple's Shortcuts app can be abused to run commands and read files past its script-execution block.
vulnerability-researchphishingattack+2