Demystifying macOS's Background Task Management

Persistence is what lets most macOS malware survive a reboot, and Apple's Background Task Management (BTM), introduced in Ventura, centralizes persistent items and alerts users when new ones appear. The talk starts from the question of how this subsystem actually works, since its internals are undocumented and proprietary.

Chris Lopez walks through the BTM daemon and its user agent. He shows how file system events are turned into item records in a proprietary database, how access to the daemon's XPC service is limited by an entitlement, and how profile-managed and curated items are handled. Patrick Wardle then explains that the database holds serialized Objective-C objects, builds an open-source library to read it, and demonstrates a tool that lists persistent software and subscribes to the endpoint security event raised whenever something persists.

The speakers close with the weaknesses they found. A reset command in Apple's SFL tool, which requires root, can suppress user alerts. A non-privileged attack can put the user agent to sleep and kill it so the notification is never displayed. A kernel-side flaw in endpoint security event submission can drop the event when the persisting process exits quickly. The takeaway for practitioners is that BTM provides useful telemetry for defenders, but its alerts and events should not be treated as a guarantee that silent persistence is impossible.