Talks·22 min
Rousana Charles
Proposes a behavior-based rubric for scoring macOS grayware, illustrated with the Adload family's evolution over time.
malware-analysisthreat-detectionrisk+2
October 2025 · Ibiza, Spain
Objective by the Sea v8.0
1 session · 31 talks
Sessions at this event
All OBTS v8.0 talks
1–24 of 29 talks / 31
Talks·23 min
Stuart Ashenbrenner · Alden Schmidt
Traces a North Korean macOS intrusion from fake meeting lure through process injection to a keylogger and crypto-wallet stealer.
malware-analysisreverse-engineeringthreat+2
Talks·51 min
Dillon Franke
Shows how coverage-guided fuzzing of macOS Mach message handlers in coreaudiod led to a sandbox escape exploit.
vulnerability-researchfuzzingexploiting+2
Talks·35 min
Colson Wilhoit
Shows how attackers can hide payloads inside Docker and Apple's container framework to evade macOS endpoint telemetry.
containerattackdetection+2
Talks·24 min
Kseniia Yamburh · Nazar Grycshuk
Shows how machine learning clusters and classifies macOS malware that vendors only label as generic.
malware-analysismachine-learningdetection+2
Talks·21 min
Gergely Kalman · Csaba Fitzl
Walks through developing a macOS privilege escalation and sandbox escape exploit via a race condition in a root helper daemon.
vulnerability-researchsandboxexploit+2
Talks·39 min
Examines whether dylib hijacking remains a viable way to attack macOS today or has been mitigated.
macosvulnerability-researchexploiting+1
Talks·19 min
Shows how Apple's FSKit can build userspace filesystems that serve as canary traps for catching infostealers and malware.
threat-detectionmalware-analysisframework+2
Talks·24 min
Anje Knottnerus
Shows how simple statistics over endpoint logs can expose C2 beaconing on macOS using callback and jitter estimates.
threat-detectiondetectionnetwork+1
Talks·27 min
Analyzes the authentication protocol used in Apple's Private Cloud Compute.
cloudidentityvulnerability-research+2
Talks·26 min
Jaron Bradley
Shows lightweight macOS detections for Bonjour scanning, infostealers, Flutter-wrapped backdoors and remote-worker laptop farms.
threat-detectiondetectionthreat+2
Talks·21 min
Brandon Dalton
Shows how the open-source Mac Monitor exposes Apple's Endpoint Security event stream to analysts, with new 2.0 features.
threat-detectionopen-sourcetool+2
Talks·22 min
Olivia Gallucci
Maps macOS logging, Endpoint Security and TCC telemetry onto infostealer persistence and shows ways to spot it.
threat-detectionmalware-analysismonitoring+2
Talks·24 min
Paweł Płatek
Walks through a macOS user-to-root exploit chaining four bugs, a libmalloc technique, and a PAC bypass.
vulnerability-researchexploitmemory+2
Talks·55 min
Jonathan Levin
Traces how Apple silicon protections, from KTRR to SPTM, progressively isolate sensitive parts of the XNU kernel.
kernelhardwareexploit+2
Talks·41 min
Matthias Frielingsdorf
Shows how a simulated iOS spyware tool can surface forensic traces that help investigators hunt compromises in device dumps.
mobilemalware-analysisthreat-detection+2
Talks·29 min
Presents a zero-click remote code execution exploit against Apple Compressor.
vulnerability-researchexploitationexploit+1
Talks·33 min
John McIntosh
Shows how automation and language-model agents map Apple security advisories to binary-level code changes.
vulnerability-researchreverse-engineeringautomation+1
Talks·27 min
Ferdous Saljook
Shows how a revoked ad hoc signed app can still run on macOS through a Gatekeeper logic flaw, and how to spot it.
vulnerability-researchmalware-analysisthreat-detection+2
Talks·37 min
Ian Beer
Shows how a read-only XNU virtual memory flaw that zeroes pages can be turned into a root exploit on macOS.
vulnerability-researchkernelexploiting+2
Talks·43 min
Christine Fossaceca · Jonathan Bar Or
Shows how Spotlight importer plugins can read TCC-protected files on macOS, and how defenders can spot the technique.
vulnerability-researchprivacyexploiting+2
Talks·31 min
Sarah Edwards
Shows how Apple's Powerlogs database records app focus, travel, connectivity and system state, and why its timestamp drift matters.
mobileprivacydevice+2
Talks·40 min
Nils Rollshausen
Shows how reverse-engineered Apple Watch pairing protocols let a fake watch pull data from a paired iPhone.
reverse-engineeringvulnerability-researchdevice+3
Talks·21 min
Yarden Hamami
Shows how an old sandbox decompiler was revived to read modern iOS sandbox profiles and present their rules readably.
reverse-engineeringmobilekernel+2