Synthetically Breaking macOS - Patrick Wardle - Ekoparty Security Conference - 2019

Explore an in-depth analysis of macOS security vulnerabilities in this conference talk from Ekoparty 2019. Delve into Patrick Wardle's research on exploiting a subtle code-signing flaw in macOS that allows unprivileged attackers to programmatically interact with the UI. Learn how this capability can be used to bypass Mojave's security mechanisms with a single synthetic click. Discover the intricacies of Apple Scripts, synthetic events, and macOS internals. Examine the process of finding the database and understanding matched code requirements. Witness a live demonstration of synthetic events and their implications. Gain insights into Apple's bug bounty program and discuss methods for preventing synthetic clicking. Benefit from the expertise of Patrick Wardle, Chief Research Officer at Digita Security and founder of Objective-See, as he shares his extensive knowledge in macOS security.

Introduction
Apple Scripts Synthetic Events
Apples Response
macOS Internals
Finding the Database
Matched Code Requirements
Demo
Synthetic Events
Why not to pick on Apple
Apple Bug Bounty Program
Preventing Synthetic Clicking
Conclusion