Predator Malware: Trust Broken At The Core
summary
Static analysis of the 2023 Predator loader uses strings, otool, codesign, IDA/Ghidra and reveals a configured multi-stage loader that spawns Watcher and helper processes, enforces 14 command-line arguments to choose mode, executes from private/var/tmp execution, checks locales (blocks Israel and US), aborts on developer mode or proxy, downloads an agent, registers a kernel read/write primitive, monitors crash logs to suppress evidence, targets iOS 16+ arm64e, and leaves many unused code paths; detection requires forensic diagnostics/backups rather than standard MDM.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker background
- 2:12What is commercial spyware
- 8:16Predator 2021 analysis
- 13:52Predator 2023 vulnerabilities
- 20:10Static analysis of 2023 sample
- 33:53Detecting Predator malware
- 35:37Security vs. privacy trade-offs
- 37:22Summary and future steps
- 39:11Q&A session
related talks
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
53mAndroid: He protec, but he also attac
47mPrevalent Characteristics in Modern Malware
26mWhen Models Write Malware: Defending Against On-demand Exploits
49mThe State Of Malware From The Eye Of The Tiger
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
25mBootStomp: On the Security of Bootloaders in Mobile Devices