Patrick Wardle - Harnessing Weapons of Mac Destruction - DEF CON 27 Conference

[@asafcohen3562]

Conference about computers please fix your audio guys for the next generation

[@renakunisaki]

Maybe next year...

[@alkeryn1700]

The audio was fine i don't see what's the issue (yes i was at dc 27)

[@tacosauce890]

@@alkeryn1700 the video of the presenter himself drops out sporadically, taking the audio out with it - slides don't drop out with presenter video/ audio

[@alkeryn1700]

@@tacosauce890 Oh ok, i didn't watched the whole thing so i didn't got a drop tho many of defcon vids have that issue ^

[@tacosauce890]

@@alkeryn1700 sadly, yes, the majority of the talk is there, thankfully, but it still detracts from it a bit

[@Shmack_]

Thanks for getting videos up quick. I couldn't get time off class to come.I remember a few defcons ago it was like 8mo after defcon til you posted talks.

[@Gamah1991]

There's always a few teaser talks released right after the conference... Expect it to be febuary/march before the rest come.

[@PixelHamster]

consider fixing your recording setup before messing up all the videos of defcon 27 Edit: yhea so the conference has ended like 10 days ago

[@roadrunner9704]

#DEFCONConference Great presentation also good to notice bevahiour based malware and the methods to detect this behaviour.

[@Trooper_Ish]

Crikey, Spy vs Spy was good.

[@MushVPeets]

B-but Macs don't get viruses!1!!1! :(

[@Panglos]

Welcome to the 20th century. Mac malware rarely involves viruses. Virtually all of the threats Mac security software detects and removes are aimed at Windows, and are dispatched in order to prevent their spread to that platform.

[@johannes.pilkahn]

LOL

[@Anon-tj7qb]

Must of been a horrible pain to do that malware research without having the ability to virtualize Mac OS and having no snapshots. Cudos to getting that working if you did.

[@Jeppelelle]

Weird sentiment, if the pentester refuse to use tools and environments that would make their life easier then thats their own fault

[@Anon-tj7qb]

@@Jeppelelle Give Apple a call about virtualization support even if you pay them it's not for pentesting malware research is different.

[@Jeppelelle]

@@Anon-tj7qb Why would i give Apple a call when its been possible to virtualise OS X and macOS for well over a decade now? Also, if one couldn't (everyone can) then one would still have the option to snapshot the FS or any FS container of their choosing.

[@Anon-tj7qb]

@@Jeppelelle Of course its possible its a pain to support you have to modify more things to get it supported etc. There is a difference betweent supported and a hack. Not withstanding their license agreement. Its a business case is all im saying. I said its a pain, not that its impossible.

[@Jeppelelle]

@@Anon-tj7qb What are you mumbling about? You obviously don't know what you are talking about since nothing of what you have said so far is true.

[@mollemannen]

the biggest threat is the user. gl hf on behavior there.

[@recklessroges]

Or block everything by default and have a binaries and firewall whitelist.

[@JoneKone]

... Now.. is this a case of Script kiddies getting older =D And suddenly there is a purpose for them..

[@WorldRecordRapper]

Über1337

[@samiraperi467]

"Mac Destruction" wasn't quite what I expected.

[@awesomekuro]

the audio isn't shit, they are getting hacked by a 12 year old boi

[@pinguimgutembergcarvalho7775]

Poxa já não gosto de ler. Mas para entender preciso ler em inglês, vou acabar aprendendo inglês ouvido. Detalhe inglês não quero ser um analfabeto pois só usaria 0,000000001 do meu celebro, coloca mulheres falando aí uso 100% do meu celebro pois seria um prazer.

[@LemonChieff]

Is this blackhat? What am I watching? Please don’t steal code. Write your own.

[@brainletmong6302]

Watch me make a strawman: "Reeee are you telling us not to use libraries? Then go back to writing assembly reeeee"

[@davidgildegomezperez4364]

The purpose is not to do it, but the implications of someone doing this and how to prevent it.

[@LemonChieff]

​@@davidgildegomezperez4364 If you reverse engineer a piece of software you must have access to it. After that "repurposing" that malware makes no sense if your intention is to prevent "it". The point of the demo is to show how he can reuse malware. The problem is that he makes no mention of why this would be necessary (since it's not) and he doesn't show, explain, describe or even talk of ways to counter it. It's basically a blackhat presentation. I rest my case. The information is valuable but it lacks realistic context. TLDR: Look what I can do. Keep looking. I'm done. Bye.

[@davidgildegomezperez4364]

@@LemonChieff if you reverse engineer a piece of software you must have access to it. That's the most silly thing I have ever heard, if you have access to the source you don't need to reverse engineer anything. On top of that, all the InfoSec that is related to malware does it on a daily basis. Maybe I have misunderstood you, please clarify.

[@bobkmak3470]

ViralTaco It’s still interesting. I don’t see an issue with it. Even though it’s not very practical