Главная
Study mode:
on
1
Announcements
2
Trivia
3
Introduction
4
What is auditing
5
Why are we talking about auditing
6
Mac security tools
7
Auditing mechanisms
8
FS events
9
FS events example
10
kadiebug
11
subscribe
12
DTrace
13
OpenBSDM
14
Audit Commit
15
Audit Control Files
16
Audit Logs
17
Whats Next
18
Security Tools
19
Conceptual Overview
20
Connecting to the Audit Pipe
21
Configuring the Audit Pipe
22
Reading Data
23
Tokenization
24
Tokenization Example
25
Process Info Library
26
OpenBSM Auditing
27
Kernel Panic Log
28
Disassembly
29
Kernel Panic Diagram
30
OffByOne Read
31
Kernel Information Leak
32
How Apple Patched
33
Kernel Bug
34
Create Null Terminator
35
Debugging
36
Mapping Register Values
37
BCopy
38
Heap Overflows
39
Kernel Heat Overflows
40
Recap
41
Look for bugs in betas
42
Python script
43
Max Security
44
kernel panic
Description:
Explore the intricacies of OpenBSM auditing on macOS in this comprehensive 51-minute talk by Patrick Wardle. Dive into the goals, capabilities, and components of OpenBSM, examining its kernel-mode implementation and learning how to build powerful user-mode macOS monitoring utilities. Discover file, process, and networking monitors based on the OpenBSM framework and APIs. Investigate kernel bugs found during an audit of the audit subsystem, including an off-by-one read error, a kernel info leak, and an exploitable heap overflow. Gain insights into finding and exploiting various bug types that persisted in the macOS kernel for years. Benefit from Wardle's extensive experience in cybersecurity, including his work at NASA and the NSA, as he shares his expertise on automated vulnerability discovery and Mac malware threats.

Getting Cozy With OpenBSM Auditing On MacOS

0xdade
Add to list