CookieMonstruo: Apple Flavour
summary
Demonstrates that browser session cookies on macOS are recoverable and reusable end to end by extracting the Chrome safe storage key from the user keychain, decrypting it with Chainbreaker, and running CookieMonstruo to dump and import cookies into another browser and IP, successfully hijacking sessions for Facebook, Google and others in a live demo. Shows XProtect is reactive only, cites market share numbers (about 81% Windows vs ~15% macOS) and notes social engineering via keychain extraction via fake prompt plus CookieMonstruo + Chainbreaker + Empire is the practical attack path.
AI-written summary · about
chapters (11)
- 0:00Introduction and personal story
- 2:54From red to blue in IT security
- 7:10PCI compliance and Mac antivirus debate
- 10:32Marketing and myths about Mac security
- 15:23XProtect and third-party antivirus on Mac
- 19:09Introducing Cookie Monster for Apple
- 27:58Live hacking demo begins
- 33:05Compromising Bob’s Mac and extracting data
- 42:44Session hijacking and account takeover
- 51:46Conclusions and security recommendations
- 53:36Q&A and closing remarks
related talks
47mCookie Monster — Stealing Cookies from the Browser
28mStealing Chrome cookies without a password
35mHow to Take Cookies from the Cookie Monster: Genesis Market Takedown
40mHow the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
49mCookie Security Myths and Misconceptions
21mDeath to Cookies