Patrick Wardle

@patrickwardle

🛠 🍎 👾 Objective-See'ing & DoubleYou'ing

Maui, HI

objective-see.org

Replies Reposts Media

Pinned
Patrick Wardle
@patrickwardle
Apr 25, 2024
Stoked for the next (ad)venture: "DoubleYou" techcrunch.com/2024/04/25/ex-… Cofounded w/ long-time friend @hexlogic, we're empowering those building security tools for Apple devices 🍎🛡️ And by bootstrapping this venture, our core value of democratizing security remains our focus!
Ex-NSA hacker and ex-Apple researcher launch startup to protect Apple devices | TechCrunch
From techcrunch.com
22
Patrick Wardle
@patrickwardle
6h
Hacker? Signals are your friends 👀
Patrick Wardle
@patrickwardle
19h
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️ Privileged attacker? SIGSTOP the tool ...⏳💥😂 Mitigation (per @PeteMarkowsky) subscribe to/block signals! docs.google.com/presentation/d…
Patrick Wardle
@patrickwardle
19h
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️ Privileged attacker? SIGSTOP the tool ...⏳💥😂 Mitigation (per @PeteMarkowsky) subscribe to/block signals! docs.google.com/presentation/d…
1
Patrick Wardle
@patrickwardle
Sep 15
And protection will only improve when Apple makes the `es_event_paste_t` Endpoint Security event available to 3rd-party security tools!! 🤞🏼 #SharingIsCaring See: objective-see.org/blog/blog_0x87…
Objective-See Foundation
@objective_see
Sep 15
"ClickFix attacks infecting PCs and Macs are going viral" Nice to see a shoutout for BlockBlock 😍 ...which yes, provides some literal “block block-ing” of these attacks! 🛡️🍎 arstechnica.com/security/2026/…
Patrick Wardle
@patrickwardle
Sep 14
macOS RC release notes: "Resolved Issues: Fixed: launchd no longer supports loading launchd property list files with the quarantine extended attribute. (166415497)" So if a plist has the qattr, does this mean: a) launchd *will* load it? b) launchd will *not* load it? 🤔🤨
2