4 ms·
How? XProtect prevents execution of known binaries based on checksums without impacting system performance. How could anything be more effective?
by jasonvorhe 8y ago
How? XProtect prevents execution of known binaries based on checksums without impacting system performance. How could anything be more effective?
- mey 8y agoMy understanding is XProtect works off signatures and only for data coming in from certain pathways (registered quarantine agents, chrome/safari etc). This doesn't protect against using a vulnerability in an app (chrome/safari) to trigger another process to download a malicious payload. Being signature based instead of behavior based limits it's ability to detect evolving attacks. The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-gatekeeper/ https://www.sentinelone.com/blog/how-malware-bypass-macos-ga...