Two Ways the Quarantine Attribute Can Fail in macOS Security - Gatekeeper Bypass Vulnerabilities
Objective-See Foundation via YouTube
Learn AI, Data Science & Business — Earn Certificates That Get You Hired
Power BI Fundamentals - Create visualizations and dashboards from scratch
Overview
AI, Data Science & Cloud Certificates from Google, IBM & Meta — 40% Off
One plan covers every Professional Certificate on Coursera. 40% off Coursera Plus Annual.
Unlock All Certificates
Explore two critical Gatekeeper bypass vulnerabilities (CVE-2021-1810 and CVE-2023-27943) in this 29-minute security conference talk from Objective-See Foundation. Delve into the discovery process and root cause analysis presented by F-Secure's Senior Software Engineers Arthur Valiev and Rasmus Sten, who uncovered these vulnerabilities while developing endpoint protection software. Learn about the intricacies of LSFileQuarantineEnabled Info.plist key enforcement and how Archive Utility handles the com.apple.quarantine extended attribute. Gain insights from experienced developers who have worked with macOS security frameworks from Snow Leopard's kernel extensions to modern EndpointSecurity implementations.
Syllabus
#OBTS v6.0: "Two More Ways the Quarantine Attribute Can Fail Us" - Arthur Valiev & Rasmus Sten
Taught by
Objective-See Foundation