Fire & Ice - Making and Breaking macOS Firewalls

Explore the intricacies of macOS firewall development and vulnerabilities in this 25-minute Black Hat conference talk. Dive into core concepts like kernel-level socket filtering, user-mode component communication, secure privileged code installation, and self-defense mechanisms implementation. Learn about firewall vulnerabilities, including methods to bypass Lulu, generic bypasses, DNS and browser exploitation, and kernel-based bypasses. Gain insights from security expert Patrick Wardle as he covers topics such as registering socket filters, implementing callbacks, and protecting the UI from synthetic events. Enhance your understanding of macOS security through this comprehensive exploration of firewall creation and exploitation techniques.

Intro
Outline
The Goal
Registering a Socket Filter
Socket Filter Callbacks
Firewall Vulnerabilities
Bypassing Lulu
Generic Bypasses
Abusing DNS
Abusing Browsers
Kernel-based Bypasses
Finale