Main Stage·41 min
Jaron Bradley · Alex Radocea
Shows how a macOS trust flaw let an attacker with code execution pull iCloud Keychain secrets, and how Apple patched it.
DEF CON 34 talks are here: 354 talks, summarized and searchable.
Browse DEF CON 346 talks in the archive.
1–6 of 6 talks
Main Stage·41 min
Jaron Bradley · Alex Radocea
Shows how a macOS trust flaw let an attacker with code execution pull iCloud Keychain secrets, and how Apple patched it.
Talks·26 min
Jaron Bradley
Shows lightweight macOS detections for Bonjour scanning, infostealers, Flutter-wrapped backdoors and remote-worker laptop farms.
Talks·27 min
Jaron Bradley
Shows how mapping macOS malware into 3D space helps analysts tune YARA rules, identify families and hunt threats.
Talks·42 min
Jaron Bradley · Ferdous Saljooki
Follows the reverse engineering of a Rust-based macOS backdoor attributed to BlueNoroff, from initial triage to C2 emulation.
Talks·26 min
Jaron Bradley · Ferdous Saljooki
Explains two macOS Gatekeeper bypasses in Safari and Archive Utility that let unsigned apps run unchecked.
Talks·50 min
Cedric Owens · Jaron Bradley · Patrick Wardle
Explains how a logic flaw in macOS policy code let unsigned apps bypass Gatekeeper, and how it was exploited as a zero-day.