33Explain macOS platform security: Gatekeeper, quarantine and notarisation, SIP and the sealed volume, TCC, and how attackers get around them.▼mediumNewAppleCrowdStrikeMicrosoft◆ premiumMost Mac compromises do not break these controls. They persuade the user to step around them, or borrow the permissions of an app that already has them.Open full answer →
43How do macOS privacy controls (TCC) and XPC services work, and how do attackers abuse them on a compromised Mac?▼hardNewAppleMicrosoftCrowdStrike◆ premiumOn macOS, root is not enough to read a user's documents or watch the screen. TCC decides that, and XPC is how privileged helpers talk, so both are prime targets.Open full answer →
22Where does malware hide to survive a reboot on Windows, Linux and macOS, and how do defenders find and prevent persistence?▼mediumNewCrowdStrikeMicrosoftApple◆ premiumGetting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.Open full answer →