OBTS: Mac, Where’s my Bootstrap? What is the Bootstrap Server & How Can U Talk To It? Csaba & Dalton
Slides: https://objectivebythesea.org/v7/talk...
Talk Description:
As a process, what do we know about the world we’re executing in? The macOS bootstrap server, launchd, plays a crucial role in managing system, user, and application services. We will start by taking a detailed look at launchd, the first process at boot, its role in managing the lifecycle of services, and how every process can talk to it.
Building from there we’ll demonstrate how you can leverage XPC and Mach APIs to extract valuable metadata for threat detection. To showcase this ability we’ll introduce the audience to the undocumented launchd routines and subsystems that enable this capability.
Lastly, we’ll take a look at how these components fit into Sonoma's new XPC_CONNECT event from Endpoint Security and where Apple could do better.
Speakers' Bio:
👤 Brandon Dalton (@PartyD0lphin) is a macOS security researcher, author of Red Canary Mac Monitor, and a MITRE ATT&CK contributor. He’s held positions across government, academia, and the private industry.
Having worked at organizations like the NSA and Red Canary, he has tracked attackers, exploited native security controls, and extensively spoken to current attacker capabilities and techniques against the macOS platform.
👤 Fitzl Csaba, (@theevilbit) graduated in 2006 as a computer engineer. He worked for 6 years as a network engineer, troubleshooting and designing big networks. After that, he worked for 8 years as a blue and red teamer focusing on network forensics, malware analysis, adversary simulation, and defense bypasses.
Then he moved on to the macOS world and developed a 'macOS Exploitation and Penetration Testing' training at OffSec. Currently he works as a Principal macOS Security Researcher at Kandji. He gave talks and workshops at various international IT security conferences, including Hacktivity, BlackHat, Troopers, SecurityFest, DEFCON, and Objective By The Sea.
Csaba spends his free time with his family, hikes and runs in the mountains.
Support the Objective-See Foundation:
https://www.objective-see.org/
https://x.com/objective_see/
/ objective-see