Gone Apple Pickin': Red Teaming macOS Environments in 2021
Cedric Owens details modern attack paths in non-Active Directory macOS environments, including Gatekeeper bypasses, cloud IdaaS targeting, and post-exploitation tradecraft.
Summary
Attacking macOS Enterprise Environments
While most enterprise environments traditionally rely on Active Directory and Windows, many modern technology companies operate predominantly on macOS managed via cloud and identity-as-a-service (IdaaS) platforms.
Initial Access and Gatekeeper Bypasses
Cedric Owens explores common attack surfaces in macOS deployments, detailing weaponization techniques and a novel Gatekeeper bypass vulnerability used to execute untrusted payloads without user warnings.
Post-Exploitation and Lateral Movement
The presentation covers post-exploitation methodology tailored for macOS endpoints, including credential access, bypassing Transparency, Consent, and Control (TCC), and pivoting through CI/CD pipelines.
Detection Opportunities and Defensive Hardening
Owens highlights high-signal telemetry sources for defenders, providing actionable detection strategies and behavioral analytics to catch macOS offensive operations.
Related talks
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.
Main Stage·44 min
Nick Powers · Steven Flores
Nick Powers and Steven Flores show how Microsoft ClickOnce technology can be abused for stealthy phishing initial access, bypassing Mark-of-the-Web and AppLocker.
Main Stage·21 min
Rich Kelley
Rich Kelley introduces Harness, a remote PowerShell payload execution and management framework designed for stealthy interactive post-exploitation.