DEF CON 31 - Demystifying (& Bypassing) macOS's Background Task Management - Patrick Wardle

To retain a foothold on an infected system, most Mac malware will persist; installing itself in a manner that ensures it will be automatically (re)launched each time the infected system is rebooted.

In macOS Ventura, Apple's rearchitected core persistence mechanisms and added a new security mechanism that alerts the user any time an item is persisted. As the former is both undocumented and implemented in a proprietary manner this poses a problem for existing security and forensics tools (that aim …

apple bypassing con def def con def con 31 mac mac malware macos macos ventura malware management patrick wardle persistence retain security system task ventura wardle