Episode 237: Notes from Blackhat – Attacking Device Management

Black Hat comes around every year and we sometimes end up having to respond quickly, like making sure we’ve patched all the things! Today we’re joined by Luke Roberts and Calum Hall who presented research on bending the mdmclient and custom agents to their will in order to see how an attacker might go after Apple devices.

Hosts:

• Tom Bridge, Principal Product Manager, JumpCloud – @tbridge777
• Marcus Ransom, Apple Systems Architect, CompNow – @marcusransom
• Emily Kausalik-Whittle, Apple Enterprise Management Engineer, Jamf – @emilyooo
• Charles Edge, CTO, Bootstrappers.mn – @cedge318

Guests:

• Luke Roberts – @rookuu_
• Calum Hall – @_calumhall

Links

• https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Come-To-The-Dark-Side-We-Have-Apples-Turning-MacOS-Management-Evil.pdf
• https://grahamgilbert.com/blog/2021/01/14/a-pragmatic-approach-to-endpoint-security/
• https://xkcd.com/327/
• https://objective-see.com
• https://github.com/its-a-feature/Mythic
• https://github.com/MythicAgents/typhon
• https://github.com/MythicAgents/orthrus

Listen:

Sponsors:

Patreon Sponsors:

The Mac Admins Podcast has launched a Patreon Campaign! Our named patrons this month include:

Weldon Dodd, Damien Barrett, Justin Holt, Chad Swarthout, William Smith, Stephen Weinstein, Seb Nash, Dan McLaughlin, Joe Sfarra, Nate Cinal, Jon Brown, Dan Barker, Tim Perfitt, Ashley MacKinlay, Tobias Linder Philippe Daoust, AJ Potrebka, Adam Burg, & Hamlin Krewson

Sponsor the Mac Admins Podcast:

If you’re interested in sponsoring the Mac Admins Podcast, please email podcast@macadmins.org for more information.

Social Media:

Get the latest about the Mac Admins Podcast, follow us on Twitter! We’re @MacAdmPodcast!