At the Defcon hacker conference this past weekend, Mac security researcher Patrick Wardle presented findings that show that macOS isn’t as secure as it could be. The Background Task Manager, a tool used by macOS to monitor for “persistent” software, can easily be bypassed so that malicious software can run without the user knowing it.
A persistence event is common with software, and Background Task Manager watches for them and alerts the user when one occurs. As reported by Wired, Wardle discovered ways to disable the notifications that Background Task Manager sends to the user. One method requires root access, which means that the threat agent needs full control of the Mac to disable the alert, but Wardle found two other methods that can be deployed remotely. That makes it a lot easier for an attacker to disable the notifications and allows the malware to run unnoticed.
Wardle has a wide knowledge of Mac security and is quite familiar with persistent events, having developed a free notification tool called BlockBlock for the Mac through his Objective-See foundation. “[Background Task Manager is] a good thing for Apple to have added, but the implementation was done so poorly that any malware that’s somewhat sophisticated can trivially bypass the monitoring,” said Wardle, who had found problems with Background Task Manager when it was first released with macOS Ventura.
Read more at Macworld.com