4 ms·
Ok, suppose you're right. Why are they only doing it for macs then?
by llm_trw 2y ago
Ok, suppose you're right.
Why are they only doing it for macs then?
- batch12 2y agoI don't think this is limited to just Macs based on my experience with the tool. It also sends command line arguments for processes which sometimes contain secrets. The client can see everything and run commands on the endpoints. What isn't sent automatically can be collected for review as needed.
- st3fan 2y agoIt does redact secrets passed as command line arguments. This is what makes it so inconsistent. It does recognize a GitHub token as an argument and blanks it out before sending it. But then it doesn’t do that if the GitHub token appears in an env var.
- st3fan 2y agoIt may depend a bit on your organization but I bet most folks using an EDR solution can tell you that Macs are probably very low on the list when it comes to malware. You can guess which OS you will spend time on every day ...