From u0 to Millionaire - Attacking Interprocess Communication...
summary
The talk explains how macOS interprocess communication using XPC/NSXPC works and demonstrates widespread vulnerabilities in third-party macOS apps (antivirus, messengers, firewalls) that allow privilege escalations from user to root. It shows a technique for injecting an unsigned dynamic library on macOS Catalina and outlines how to patch these vulnerabilities.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:34Interprocess communication mechanisms
- 9:58Privileged macOS components
- 12:05First validation flaws
- 17:23XPC vulnerability exploitation
- 21:47Business impact of XPC attacks
- 23:10Process identifiers category
- 27:52Code injection category
- 32:46Bypassing Harper validation
- 37:10Security summary and guide
- 42:29Q&A
related talks
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
57mExploring Yosemite: Abusing Mac OS X 10.10
36mmacOS Vulnerabilities Hiding in Plain Sight
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
45mmacOS application isolation and its exploitation
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs