33Explain macOS platform security: Gatekeeper, quarantine and notarisation, SIP and the sealed volume, TCC, and how attackers get around them.▼mediumNewAppleCrowdStrikeMicrosoft◆ premiumMost Mac compromises do not break these controls. They persuade the user to step around them, or borrow the permissions of an app that already has them.Open full answer →
43How do macOS privacy controls (TCC) and XPC services work, and how do attackers abuse them on a compromised Mac?▼hardNewAppleMicrosoftCrowdStrike◆ premiumOn macOS, root is not enough to read a user's documents or watch the screen. TCC decides that, and XPC is how privileged helpers talk, so both are prime targets.Open full answer →