Red Team | Subverting macOS Apps and Security Controls

Red Team | Subverting macOS Applications and Security Controls through 0-Day Vulnerabilities 🎙️ Carlos Garrido, Red Team Operations Leader, Pentraze Cybersecurity 📍 Presented at SANS Hack & Defend Summit 2025 macOS combines a layered security model with a variety of enforcement mechanisms, including consent-based controls, code integrity validation, sandboxing, and runtime protections. This talk focuses on the discovery of real-world 0-days in macOS applications, with special emphasis on local privilege escalation (LPE) vulnerabilities that enable adversaries to gain elevated access and control over the system. In addition, we'll explore how core security mechanisms in macOS-such as Transparency, Consent, and Control (TCC), Hardened Runtime, Authorization Services, and others--can be bypassed or misused through subtle implementation flaws, enabling broader system compromise during post-exploitation. Key topics include: - How race conditions in code signature validation can be exploited to bypass security decisions and interact with privileged services. - How Transparency, Consent, and Control (TCC) can be bypassed by leveraging trusted applications to access additional system resources beyond their intended scope. - How flaws in authorization logic can allow privileged operations outside the intended security boundaries. - How insecure interprocess communication (XPC) can be leveraged to escalate privileges and interact with elevated services. - Why achieving root privileges on macOS is not necessarily the final objective, but a pivot for extending capabilities and enabling deeper exploitation and impact. Attendees will gain insight into exploitation strategies, a reverse-engineering approach tailored for macOS, and how to chain vulnerabilities to operate effectively within the platform's built-in security model. Each concept will be backed by real-world demonstrations and offensive research findings. This session is intended for Red Team operators and offe