Mac, Where’s my Bootstrap? What is the Bootstrap Server & How Can U Talk To It?

The talk opens with XPC, the Mach-based inter-process communication used across Apple platforms, and why privileged third-party helper services are attractive targets. The speakers walk through the checks a service should perform on connecting clients, such as code-signing requirements, bundle and team identifiers, version and hardening, and audit tokens, and note how easily these are missed. They then cover the Endpoint Security XPC_CONNECT event introduced in Sonoma and what it leaves out.

The main gap is that the event gives a service name and domain but not the program path of the service, which detection needs in order to verify code signing on both ends. The speakers explain launchd domains, including system, user, login, GUI and per-process PID domains, and show how launchctl and a community reimplementation of its queries can be used. Some undocumented routines return data through shared memory as C strings, so parsing requires careful handling. The speakers present a free tool that resolves service paths from these events and runs a basic detection. They demonstrate it against a public proof-of-concept exploit, which produced alerts for a mismatched team ID and for a replaced helper binary.

To close, they recommend that Apple include the service program path and team ID in the XPC connection event so detection is simpler, and they announce a planned macOS vulnerability research training.