Apple Stack Hardening: Security Essenials for macOS, iOS & AppleID - DeFi Security Summit 2025

Transcript

Hey guys, how are you? Uh we are Pablo and Bruno from the OBSC team and today we are going to see a bit about security in Apple devices, right? Mac OS, iOS, Apple ID and related stuff. The idea is to make this uh as uh interactive as possible. So any question you have, any idea you have, any critic, whatever, just ask us. So we make it more more interesting. You you are going to have um the link now of a checklist to follow with all the the settings that we are trying to cover. Uh you're going to see that there

are several settings that we that we are not talking on the stock but you will have it included on the checklist. So you can uh do like the full hardening in the way that that uh that it's possible. Uh unfortunately we don't have so many time to cover like all the topics but we will try to guide you through the whole process so you can know what you have to do with in with the time to do it. Okay. Uh yeah. So well the first thing is that um you have to understand you which is your thread model your thread model scenario. uh it's not

the same uh like if you are the founder of a company and you can be highly targeted by a highly sophisticated thread actors or maybe the the most the most probable thing that can happen to you is that someone steal your stole your device while you are walking on the street. um or be target by like by common fishing um scams that that we see. So it's uh really important to know what which are the resources that you are uh protecting. Uh also like to know know your scammer uh try to understand which

kind of thread actors are you most probable exposed to h and try to recognize like methods pathway that this thread actor use. Um so yeah it's really important to know uh which kind of attacks you are most pro more probable uh to be a victim of. Yeah. >> Yeah. And one one important thing that we are going to see is that we are going to see many ways of hardening your device. But if you are here you we we are all targets right for sophisticated thread actors like North Korea and some Russian groups. Part of our thread model should be that your devices will be eventually compromised right it doesn't

matter how sophisticated you are. If we are here for sure we are highly sophisticated but anyways part of the thread should be that it will eventually be compromised right we will talk about COD exploits for example there are some things that we can do against COD exploits but if someone has enough money and enough time they will um they will be able to compromise our devices. So having said that, having said that it's important to know what we have in our device, right? Like a very simple and basic thing, right? If we still have private keys in our

device, eventually we are going to get wrecked, right? So having said that, let's go and let's start seeing uh the box for today. I just ask. >> Okay. So, here's there is the QR code so you can scan it and have access to the checklist. >> Yeah. Anyways, for for the for the ones that are here then we are going to share all of this. Okay. >> Have you read it? >> Yeah. Okay. Let's continue.

>> Okay. Perfect. >> Okay. So first we are going to see uh Apple ID security settings uh because this is the the settings of the your Apple account. It's the same. It's going to protect also your uh f phone and Mac, let's say. Um yeah, what one important thing about your your your Apple ID is to understand what information we have stored there, right?

And the fact that the Apple ID can be used in order to attack you, right? Uh so one of the first first things that we're going to see is that your Apple ID should be private, right? If my email account is pitogmail.com, my Apple ID must never be paltogmail.com. Nobody should know my Apple ID. Why many zero the exploits right exploit a vulnerability in Mac OS iOS Android that is related to sending you an special image in iMessage right so if it's if a sophisticate threat actor has your Apple ID they just need to send you an image

in iMessage even when you are not using your phone not using your laptop your device will download that image will render it when it's being rendered the device is exploited automatically because of the rendering engine and your device is totally compromised right so first thing is your Apple ID 100% private yep >> just by rece like in iMessage uh WhatsApp telegram and signal images are downloaded automatically right so in WhatsApp telegram and signal we can configure not to download them automatically, right? That you should do

it. In iMessage, you cannot do that. So, what we recommend regarding iMessage and FaceTime is just not using them, disabling them, but we are going to see a bit more about that later. But we are going to see many times that for very important accounts, it's not related to this, but we can talk it anyways, your Apple ID, your password manager, the username for your the the email that you use for your 2FA app and that kind of stuff. You should use cold email accounts that are accounts that are secret configured with UB keys and only logged in in iPhones or iPads, never in a computer. Right.

Perfect. Um well uh in this first setting, what you need to do is um go to iCloud account and go to the setting of find my Mac or find my device. Uh this should be on because uh it will allow you to track the device if it's uh lost or stolen and because with uh this setting uh to find the the device uh it also works with the encryption that we are going to see later. So when you enable like uh file bolt that is the feature that allows you to encrypt the your whole disk. You will be able to um from another uh device connected to your

account encrypt your whole device and no one uh will be a the no one will be able to use your uh your stolen or or lost device. Well, this is the part that we were talking about uh your Apple ID. Uh first of all, you will see that for sure when you when you see the details of your Apple ID, you will have an email and the phone number, right? The phone number here can be removed, right? So, you should remove it. Any platform where you have a phone number configured is a platform that I could personally take over in three days. me

palito it's very easy right so phone numbers must be removed from everywhere right Apple has a big issue and it's that from this part that we are seeing email and phone number you can remove your phone number you must first remove it from facetime then from then from iMessage in your phone in your laptop and then it will allow you to remove it from there but then we will see that there's another section inside uh two factor authentication right where you will not be able to to remove it and we'll see what you have to do. So, first have a private Apple ID and remove the other phone the other email addresses that you have there that are doxed about you and remove the phone number that you

have. Then obviously password update your password have something this is pretty basic but we're going to say it again. All passwords must be unique. The number one issue we find related to h to this kind this kind of hacks is having a very complex password but repeating it right. So we just need to hack one website where you are registered with that password. We take it from there and we use it in the rest of the platforms. Yeah. So here is the place where you are not going to be able to remove uh your phone number. So the only solution here uh is to use a private phone number, a phone number that is not tied to your

identity. And this is a concept uh that should be applied on any uh important service that you are h required and you are enforced to use a phone number. Uh the best way is to get just a phone number under the name of another person that is not tied to you. That if someone wants to target you, uh it will be uh almost impossible for them to know that that phone number it's the one that you are using like >> yeah that go back a second. I want to say something about that. So, so you all know like phone numbers are not safe at all, right? There's hundreds

of ways to hack a mobile phone number very easy. So, as we were saying, your public phone number must not be here because everyone already knows which is which one it is and they can very easily sim swap it or intercept the SMS. every SMS that we receive with codes from Apple Google Microsoft Airbnb banks or whatever go through seven or six servers and many of them are compromised today. We know that because you can go in the in the Telegram groups and intercept any of those SMS. So having a cold phone number means that you will need to have a phone number that is private. Nobody knows that it's yours.

If you live in the US, the best alternative is to use Google Fi. If you don't live in the US, you cannot. Second alternative, there's a company called Ephani. Ephani.com/opseek. You will have a discount there. It's a company that sells you phone numbers that are pretty expensive, $1,000 per year, but they have an 11 layer process when you want to reset the SIM, right? So they are pretty secure and they have been designed for people that are targets of SIM swaps. And then as we were saying most of platforms that give you virtual phone numbers, we have researched all of them. They are not safe. Right? So the conclusion is get a phone number under the name of someone

you trust, not you, and use that one. not under your name and not sharing it because I can just pay someone that works at AT&T and say, "Hey, give me the phone numbers from Bruno. They will search for the his phone number." They will disable SIM swap protection or whatever and the the account will be very easily taken over. Um, and what else about phone numbers? >> Well, that's it. >> That's it. Yeah. Basically the the only platform the only important platform where uh phone number is mandatory is Apple ID.

Uh perfect. Uh let's continue with this. So now you will have to enable a second factor authentication of your Apple account. The most secure way to do second factor authentication in all services when you are allowed to is uh with UI keys security physical security keys. Um if they are configured in the correct way they are not fishable uh and are the the best way to do second factor uh there are even more secure that totp apps. So on Apple ID you have the possibility to enforce uh UB keys and

you will have also to once that you configure security keys uh you need to remove uh other methods of second factor you so um yeah you you have to be sure that you have only the best or the the secure the more secure way of two second factor authentication and that you are not using like several seconds factors because uh the f at the end your security is uh the the least secure way that that you are using like if you are using several ways to use second factor if you're using SMS and also security keys well your real

security is that that you are using SMS as second factor >> yeah Apple will require you at least two security keys If you are here, I would say you at least have three. So you you have three UI keys. You enfor you you enforce the pin in all of them, right? So for example, I have my UI key always plugged in into my my device, but but part of my threat model is that they could steal my computer unlocked, right? So that UB key every time I use it, it requires a pin, right? So if you don't have the pin, it's useless. So at least three. Why three? Because let's say that you travel to here to

them connecting Bonositis. You travel with one in your computer, one in your pocket, and you leave one at home, right? So if the worst happens, you get to the airport, you get into a taxi, they steal everything from you, you have a backup, right? And anyways now we will see after this that after adding security keys you will have to create a a backup code a recovery code that will allow you to to get your account back in case you are uh logged out. Yeah. So here is the whole process to add the security keys. Uh as Pablo said you uh Apple enforce you to add two. This is a a good feature. Many services don't do it. Um and it's key because uh if if you

are not using like at least two UB keys you are going to be locked out and and one thing that is important related to that when you start using UB keys I I highly recommend you to start doing that it's very important to be very well organized I have like 15 UB keys because I buy all of them for research and I use all of them right so it's very important when you set them up to put the name this is the U key like this UB key nano5C1, right? Because when you have many, if someday you lose one and you need to remove it and you go to the list and it just say UB key, you don't have any idea which one it is. And their recommendation is just put the same pin to all of them because if not, you may

confuse which one it is and you reset them and you are So just put the same pin to all of them and that's it. I think that that's a very good idea. If you think that for some reason it's not, you can share with us. But I think that that's good. >> Okay. So after configuring the second factor with the UV keys, you will have to set up your recovery key. This is one of the um this is one of the key things that we think that you should store um physically written in a in a paper. Uh please do not uh store this recovery codes any recovery codes or this uh recovery key uh on um password manager

because we have seen uh password managers get hacked and many accounts compromised because because of that because of people using uh h password managers in the way that they are not designed to store uh that kind of information let's say >> yeah so related to this two ideas one is you will see the recovery code. It's a it's like I think that 20 letters something like that >> for 24 I think. Yeah. >> Yeah. 24. Just print it. I would say that this kind of stuff you must always have them in paper. Why? Let's say that again. I travel to Thailand. I lose everything. I want to be able to call someone like call my mom and say, "Hey, mom, go to my home. Go to

this place. Take this paper. Read this to me." Right? You don't want to be locked out of your devices. We knew we know about people that even travel to this conference now and maybe they lost something and they they they're totally locked out if they don't go back right. So this kind of stuff backup codes recovery codes uh two places where you can put them in paper or you know that in Apple in Mac there's a hidden nice feature if you go to disk utility you you are able to create a virtual encrypted drive right so it's a drive with a password basically that's very good we don't recommend beta crypt anymore you remember beta crypt that is part what used to be true true crypt we don't recommend that anymore because now

beta crypt requires to install a kernel an extension at the kernel level in our devices and even if it's open source or whatever we don't want to install that kind of stuff. So we think that virtual disc is totally fine but again this kind of stuff have it very um stored safely again safely but you also want to be able to access it in an easy way in case it's needed right paper is always the same. We always say that we used to make fun maybe of oh yeah my mom puts her passwords in some in in some notepad.

She doesn't know anything about security. In the end paper is one of the best things. Perfect. And at last uh for your Apple ID settings you want to enable advanced data protection. Uh this feature uh will allow you yeah to encrypt all your data on on on Apple servers. >> Yeah. Unless you live in the UK where it's not enabled. Uh yeah, you should configure that because if in theory even if Apple wanted to see what's inside, they would not be able to do it. And then there's one thing that we didn't that we didn't see say here. This is not recommended for your accounts but for

the people like for your family you have this recovery contact right this will allow a third party another person another Apple ID to to help you recover your account. So this is recommended for you to set up for your family let's say right but for yourself only if you really really trust someone trusting them regarding two point of views right trusting that they will not you and trusting that they are paranoid enough to have a a really nice setup right >> yeah like this difference are part of what we said at the beginning like h try to understand your thread model scenario

is not the same what you will recommend to your family for example that the settings that are going will use you so yeah that's the idea and when you try to enable advanced data protection for sure this happens every time I don't know why but when you try to enable it will fail next time probably it will fail again and the third time it works I don't know why but it always always happens and then also Check what you are saving to iCloud. Right? This is pretty important. Many times we are saving stuff that we don't even know that we are doing.

For example, if you are storing the full backup of your device in iCloud and someone hacks your iCloud and they get that information, they are able to access the key store files from the hot wallets that you have in your device. Right? We have seen many of those those cases. So they hack someone's iCloud account. They get the backup UR. They go to the meta mask folder whatever key store file and encrypted cryptoon. So check what you are backing up. In fact, these settings that we are seeing, we recommend them like we recommend to have Apple ID in your main device, but then if you have a dedicated device for

signing and that kind of stuff, no Apple ID like the less we have, the better. Uh and here when you when you enable advanced data protection, if you have some devices that are old, you will have to remove them from your Apple ID basically because this is only uh compatible with certain devices. If you have a very old MacBook or phone, it will not it will not work or it will ask you to uh update it first. Yeah. So here's the whole process of the recovery key and >> uh this was what we were saying.

>> Yeah, >> you will for sure see that m that something went wrong always. I don't know why and then it then it will work. >> Okay. So let's start with security uh on Mac OS systems. Um you well you have also the checklist to follow along with all uh the configurations that we are going to see. Uh the first thing is you would like to have uh some kind of antivirus if you're not using an EDR on on your machine.

There are several antivirus that we can recommend like bit defender uh incom and malware bites. Uh there is also uh Microsoft uh yeah Microsoft defender also works for for Mac OS is not so good. Microsoft Defender is more like a it has been designed from um from um from the point of view of I I forgot the name of um uh well it's it's it's not so good. It's for sorry compliance so that people that work in Microsoft can use a Mac but it's not so good. The important thing about this like

99% of the money stolen in the blockchain ecosystem in the last in the last three years is operational security and nine out of those cases nine out of 10 of those all those cases were because devices Mac devices were infected right we think like everyone thinks that virus and malware are for Windows if you're if you're using a Mac there's no malware That's just that. It's a myth. It's full of malware for Mac, full of malware for Windows. Many times that we scan devices from clients that are devices that are working totally fine, they are infected.

Uh so it's very important to use one of these tools. At least 20 you spend $20 in malware bites, which is pretty good. But the thing with antiviruses is that antiviruses work with fingerprints, right? They try to find viruses because they already know that kind of virus. But if I if I say, okay, Louie uses a Mac and Brave and has installed in his in his brave for Mac Ravi wallet. I can design very easily a malware that will just go to his device and will read memory and copy his private key and that will not be

detected by by an antivirus. Right? That's why we recommend edrs. EDRs is a tech um um endpoint detection and response like crowd strike or sentinel one. You don't need to work for a company to have them. You can just pay them for yourself. They are $150 per year, right? It's not expensive or if if we are talking about security, it's not expensive. H but the important the good thing about these tools is that they will detect a stuff based on behavior. So if they see some process that is reading memory, copying something and trying to send it to a server, it will stop it, right? Even if it doesn't know what it is. So we highly

recommend that if the industry used antiviruses or edrs 99% of the money that we have seen being lost including by bit would not have been lost. >> Yeah. uh personally I think that you should have like uh or try to use uh both kind of software an antivirus and also one or uh one of the several tools that we are going to see objective C is a foundation that makes uh open-source software for Apple devices >> security software >> yeah and there are so that some of the tools that we're going to see act in the way that the EDR acts like try to scan and the processes on your computer and

try to understand if there is something that is uh that your that is making your computer work in an unusual way and try to alert you about that. So yeah because of that reason uh sometimes the this kind of tools works better than antiviruses that are only comparing with through a with a a database. The first uh tool that we are going to see about objective C is Lulu. Lulu is a firewall that is going to protect your network connections. Um Lulu is going to block any outgoing and incoming connections. Um this is good because uh

the firewall that that comes with your uh Mac OS system uh is not uh it's not protecting you full of all outgoing connections only for incoming connections. So you will have you will like to have to enable both like the the Mac firewall that that comes with the OS system and uh and also this another uh tool. >> Yeah. Something important regarding that. I don't know why but H Mac OS firewall by default comes off. It's turned off for some reason >> and then we are used to thinking that firewalls protect us from someone

attacking us, right? H we haven't seen in fact in the last three years we have not seen any case of a Mac OS device being attacked from outside. We want Lulu to protect us like in the case someone infects us first thing that we will protect us is okay we will try not to download the stuff right but if we download the stuff and we run it the antivirus should detect it but if the antivirus does not detect it the idea from this is that the malware will copy my private my private keys but when it tries to send those private keys to the server from the attacker the firewall will stop it and you will get a

notification Okay, this process is trying to connect to this IP and you say what is this? You block it and that's it. You're protected. >> Perfect. So, Lulu came with several rules, but you can also create your own rules and and add to and add to them. Um the the other tool that is really really useful is a task explorer. This uh tool allows you to visualize all the processes that are running on your computer. So, it's going to be when you use it, it's going to be easier for you to spot several processes that are using

like many uh many random access memory or that are running like in an unwar way. It's also going to flag to flag you uh which processes like the system detects that that are not uh signed by Apple. >> Yeah. And this is an example. You will see the list of processes. It will scan those processes with virus total. Now this right now this feature is not working because they have to update in the tool something regarding to virus total but doesn't matter when it when it starts working again you will see like if it's

if the process is green it means that it has been signed by Apple if it's or or a developer authorized by Apple and if it's orange I think that it's a developer that is not identified and then this will also check if it's listed in the virus total um list of malware. The important thing about these kind of tools is that you'll be able to see how much stuff you're running your device and you had no idea that you running even things that you have already uninstalled and you still have processes running and it will show you exactly okay this is the process here's the file and you will be able to kill everything from there.

Okay. Uh so no knock no knock uh works in a similar way but the idea of no knockknock is to allow you to spot uh all pro all programs that are running persistently on your on your Mac. This is really important because you know that some malares like spyware for example will require the idea of a spyware is that will require you uh to infect your computer and to to be stored there persistently.

Yeah, persistently means that every time you reboot your device it will load again wipe out. So knockknock will show you like uh well this is the installation but then continue it will show you like there the list of all the login items uh periodic scripts uh startup scripts system extensions and you will be able to see in detail everything that you have persistent in your device and it will also check with virus total if something is infected.

Again, you will find lots of stuff you had no idea. Block is very similar to knock-knock. This tool, what it does is that when you are installing something, whenever some process wants to keep persistence in your device, like you are installing Zoom, which you shouldn't do, but you're installing Zoom and Zoom wants to add persistence to your device to uh to start up. Every time you start your device, you will get a notification from block saying, "Hey, Zoom updator wants to add persistent to your device.

Do you want to allow it?" And again, you will see the amount of stuff that this software used to add. For example, Acrobat reader in Mac has like seven processes running. one to update itself, one to send h statistics from your device, one to check your uh your license, what it's full of stuff that shouldn't be there. The less stuff we have, the better. One important thing about these tools that you will see is that every time that you want to install a security tool, it will require full access to your device, right? and you will have to put your uh your admin username and password in case this is

why it's very important to only use tools that you really trust that you have researched and that are open source right we are we use this but if you want to use it research it right we trust on it but you don't have why to trust us so verify everything before using it Again, this is all open source. Perfect. And at the end, the the last um the last application that we think is really useful is Raiki. Raiki will allow allow you to scan and detect um applications that want to to register or

to keep track of all the logs that you are typing on your computer. are basically key loggers and that are trying to steal your your accesses when when you are when you type it. >> Yeah. And there you have an example. If you have Raike and you have a process that is trying to see what you're typing, you will get a notification like this one. And then in the objective C website you will see many other tools.

Uh for example there's a tool that it's very nice called >> neticquette. >> Well netiquette will allow you to see all the processes that are connecting to the internet or to a network. And there's also one tool that protects you from the evil evil mailed attack that is basically someone going to your device and physically opening opening it and trying to log in. So that tool every time you open the lid from your Mac like physically like this that's stored right in in Mac OS configuration. So that will show you a list of every time your computer was opened and every time someone tried to log in and even you can configure that if someone tries to log

in and it's h it fails it can take a photograph and you can get a notification in another device. Okay. Uh well as we said your Mac OS system comes with a firewall and the ideally you would like to use the firewall also with with Lulu like both of them uh like all applications it matters a lot that they that they are configured well. So a firewall means nothing like having firewall enabled means nothing if you have like uh battle configuration of the rules or you are

just like clicking allow any time uh that you have that you been are being prompted with a with with um notification that some program is trying to connect to your computer. Well, the idea is that you really have to care when you have a notification to see it, try to understand, hey, why is this happening? What what is what is which is the program that is trying to to connect or to send information to somewhere? Yeah. So here you can block like all incoming connections. you can allow only the the programs that you h that that

you or applications that you allow to to receive incoming connections and as we said this firewall the the weakest point is that it's not protecting you from outgoing connections and for that reason is that you would like to use uh Lulu >> at the same time >> and one more thing here is to select this option Block all all incoming connections and select this R1 enable stealth mode. >> Uh so you should have those uh those two um enabled.

Okay. Now file bault and this disk encryption depending on the version of your Mac OS and where you bought your your MacBook this will come enabled or not. File Vault is like the bit locker for Windows, right? What it will do is basically encrypt your drive. Why is it useful? If you forget your device in a car or the FBI writes your home, you don't want them to be able to take out your disk, connect it in another device and see what's there because it's unencrypted. So, File Vault will encrypt your drive, right? So, you must turn it on. And when you turn it

on, you will have two options. No, go here. Yeah. >> So, it will tell you, do you want to allow your iCloud account to unlock your disc? So, if you ever lose access to your to your secret key, having that enabled will allow iCloud to uh open your drive, right? That means that also um um police or any agency will be able to open it too, right? they will they just need to require Apple to unencrypt it and they will be able to do it. So we don't recommend that or again it depends on your thread model. It depends on who you're protecting from and where you live. But the recommended option is to

create a recovery key right and do not use my iCloud account. Sometimes the recovery that recovery key is the same one that you use for iCloud account protection. Sometimes it gives you a different one. It depends on the version of the operating system that you have. So um okay that is for encrypting your whole drive. And then as we said if you go to the disk utility tool you can go to file new image blank image then continue to the next one. And here you are able to select to create a new disk for example for 100 megabytes encrypted. In encryption, you select uh

256 uh bit AES encryption and you will be able to create a virtual encrypted drive and you can put important stuff inside there. And depending again on your thread model, you can put that file maybe in the cloud or maybe you can put it in a USB drive. Um >> perfect. >> Again, the idea from this drive is to have Erh what can you have there backup codes recovery keys security keys seed phrases only in the case that you are doing this offline like for most of the people we just recommend seed

phrases in paper but if you if you think that you are sophisticated enough something that you can do regarding set phrases instead of having them in paper is you get a you have a guys. You format it. You you you after formatting it with no internet, no nothing, you create the virtual encrypted drive. You open a TXT file, you enter your seed phrase, you save it inside the virtual encrypted drive, you close it, you copy that file into a USB drive, and then you format the device again. Right? So all of this process you now have your seed phrase inside the virtual encrypted drive in a

USB drive and the device where you configured that where you entered your your seed phrase was not connected to the internet in any moment and then you format it right. >> Yeah. >> But I think that it's too complicated and it's overengineering for 99% of cases. >> Yeah. Also like we said, what you have to take in account is that maybe you are sophisticated enough to uh unencrypt the files, but you also have to think that sometimes you will need another p another person to uh help you to recover that. And it maybe if some someone that you trust like friends or family are not sophisticated to do all this and for

that reason like the paper is like >> yeah or if something happens to you you want your family to have access to your crypto basically. >> Well then we have verac as we were saying we don't we don't recommend this tool anymore because it requires to have h to install an a system extension at the kernel level. But if you want to use it for some reason, it's open source. Something interesting that this tool has is that it has hidden volumes, right? So you're able to create an encrypted drive and you can have two passwords for it.

So if you put password A, you will see some content. If you put password B, you will see some other content. So this gives you deni uh pos pl possible deniability right if someone says hey open the disk you can and and you're being forced to do that you can open it with password B and they have no way of knowing if there's a second disc or not if there's a second password there or not. Again too much sophistication for 99% of cases. But if the state is after you maybe uh Okay, automatic updates.

Okay, perfect. Um, this is something that comes uh enabled as a default, but you would like to check and be sure that your system is uh automatically updating itself. Uh so yeah you will you will have to go to software updates and see that everything all the boxes are ticked and you are updating all the software automatically. Oh yeah. And what one thing about these ones is especially the last one install security responses and file systems. What this will do is is like there are two kind of updates from Apple. Normal updates for bugs and

updates to patch zero like exploits that are being exploited in the wild. Uh so this last option will install those things as soon as possible and will require you it will give you the option to reinst to restart your device as soon as possible. Every time you see an update now updates for Mac take the most five minutes do them. Okay. Um another cool setting that Mac has is lockdown mode. lockdown mode basically turns your Mac or your or your iPhone into a paranoid mode. And this is something that it that it's cool to to

try and to see that is that it for you works like um in the way that you that you use your devices like daily. uh it's make makes you really harder to use it or not. Personally, I tried it and for me uh I I I think that it didn't interfere with my with my daily use. So I have it like lockdown mode enabled like all the time. But some people for some reason feels like having lockdown mode makes impossible for them to use their devices like in a regular way. But it's something that if you have any doubts

that something strange is happening with your device that you have been compromised, you can just turn lockdown mode on. Yeah, lockdown mode is the feature that Apple launched after having many zerod exploits, zero click, zero exploits targeting uh highly important people. And this is one of the few things that will protect you from that. We highly recommend it recommend to enable it. H this for example if someone sends you an image in iMessage it will not be downloaded automatically or if you are into some website that has some kind of JavaScript that JavaScript may be disabled if they

consider that it's dangerous but for most of the cases it will work totally fine. So enable it. Also know that when you enable it in Mac, you will get a message in your other Apple devices telling you to enable it there too. It's optional, but if you can enable it everywhere, it's nice. Uh, of course, one of the most important things regarding the physical security of your device is to have a lockdown screen settings at the minimum. Uh personally I use like I think the minimum is uh one minute. If I have in any device I always try to use like the

minimum. Uh and for me um like we think that you have to get accustom on and make it like second nature for you to always have your screen uh locked like even if you are h alone at home like to lock your screen because you don't want like your this is something like psycholog psychological but you don't want like your m to to rely on your mind to think oh I'm at my home alone or no now I'm at the cowork and I have to to lock it. So for me it's just easy. I always lock my Mac and all my devices have lockdown screen automatically set

it at the minimum. And well now not maybe um >> remember one thing remember related to that when the when the when the Silk Road founder when they got the guy he has his computer encrypted but what they did is he was working in a library and they simulated that there was a fight between a girl and a guy he did like this and they took his computer unlocked right so every time like I am working here and someone comes and talks to you log it and that's it.

Yeah. Uh well and what like nowadays that we are using biometrics is not h it's not difficult to be you don't have to be typing like your password and that it's really easy to just put your finger your face. So it's not um it's not an issue to say that you have to do something to unlock it uh all the time. >> Yeah. And also if you are going through some if you know that in the next moment hour whatever you may be in some kind of difficult situation or whatever I don't know let's say that you are going through an airport and for some reason

you don't want to show what you have in your device um they can just take your finger and put it there and they will unlock your computer But if you turn it off when they when the computer is turned on like the like the iPhone, it will require your password and you just don't give your password and that's it, right? Uh so also have that in mind. iPhone also allows you to lock it, right? So it doesn't work your your face ID. That's something important in case someone wants to um using violence making uh make you unlock your device.

>> Yeah. like law enforcement for some reason can enforce you to unlock with biometrics but if you are using password or pin they cannot force you to unlock your device so it's important that well uh this is also really important you want to disable iPhone mirroring and all the features that are like screen mirroring screen sharing and that you have to be really really careful with this um most of device compromise and um and incidents that we see are using like this kind of uh of features.

So yeah, you can disable hand off and also uh iPhone mirroring uh an airplane here as the same as your operating system that you want to uh to this the software to download automatically lo the updates. You will also want applications to update uh automatically. So this you have to this this uh feature you have to make sure that it's enabled on the app store and all the applications are updating itself.

>> Now here you basically go to system settings privacy and security. You will you will see many options but one is called allow applications from and you should only enable app store instead of app store and known developers only app store why because app store and known developers means that I know I am a known developer right so every time I send an update from my app h to my website I update my app. I signed the app with a key that I only have and Mac verifies. You can download that app and you can install it. But it's very easy

to hack a dev, steal their keys, upload a new piece of software infected that has been inside by him and you install it and you're fed. So only apps. >> Perfect. Yeah. >> Oh, well, if you enable if for some reason when you have lockdown mode enabled, sometimes uh when you want to connect a new USB drive or your ledge or something, uh you will have to allow it, right? But if not, if you don't have that uh lockdown mode enabled, you can go here again to privacy and security.

Like when you go to privacy and security, just check the whole list of stuff that you have. But one is allow accessories to connect. You will have to put ask for any new accessories. And this is especially important for H cables. Now surely you know that there's a cable called OMG cable. It's a cable that just looks like a normal cable, but you connect it to your computer and if your computer is unlocked, it will open the terminal. you will not even see it. It will be hidden and it will run code and your computer is compromised.

>> Yeah. And also it's about USB like the same version. >> So whenever you connect a cable to just um uh charge your device, it shouldn't ask for any permission because you just need to charge it anyways. Just use your own cables. Don't use cables from any other people. They look exactly the same. And there it's full of those cables. Full. They are $20. They are not $500 anymore. So, everyone has them. >> Okay. Here also when you go in press in security, you will have the option of full disk access. You have to click there. H. And when you click there, you will see which tools have the permission

to have full disk access. Here you should only have well check what you have but there should be only security tools. If there's something that you don't recognize you remove it like first of all take an screenshot then disable it and then do a bit of more research to understand what it is. Then the same for files and folders. You will click there and see which applications can access any file uh and folder and you remove what you do not recognize or just applications that shouldn't have that permission. Input monitoring the

same. There you will see what apps are able to check what you're typing. Usually this cord is there. Disable it. Discord is super super uh dangerous to use. Um and then okay again privacy and security advanced and when you go to advanced continue there >> here you will enable this option to require an administrator password to access systemwide settings. Right.

>> This should always be >> this is key. This is key because you want if any kind of malware gets into your computer, you want uh at least one more barrier that is to be required to put an administrator key and not that malware to have like full access to install anything and or change system settings without uh without any other restriction. So we have just one more minute. We have many many configurations here. But while the last one is remote desktop, disable any application that has permissions to use remote desktop and do not use this kind of of apps. And then what I would

say two last things because we are now up with the time. First of all, these are lots of configurations, right? We haven't seen everything there. It's there's lots of stuff. The more layers you put, the less probable your device will be compromised in the future. But anyways, part of your thread model should be that your device will eventually be compromised. Right? We always say it. You will not believe me for this for sure. And it's okay. I used to think the same. All of our devices, my device, his device, your devices, Vitalik's device, Donald Trump's device, Putin's device, all devices will eventually be compromised, right? We saw that. You

remember the XC back door that was out there that was that nearly infected all Linux devices worldwide? That's the one we catched. How many of those were successful? And all of those devices are compromised for sure. there there's there's no way that those things have many many have had many successful attacks and devices are compromised. The thing is that maybe we are not the target of the threat actor that has access to that to that tool. Right? So first of all think that your device could be compromised. So do not have everything in one computer. Right?

And second, try to verify everything you do and understand what you're doing, right? And last thing, we devel we we launched the tool. If you go to our website obsc.io, you will see that we created three tools. One for Mac, one for Windows, and one for Linux that are scripts that you can run and you will have many of these configurations done automatically, right? as it's a script that you have to run with admin per with root permissions in your device. Don't just go and run them, right? Not yet. We have just launched it. It's an MVP.

That script is going to be audited by three big auditing firms and after that you can use them if you want to use them, right? But know that we have we have done that in order to to try to make this easier, right? But again, anytime that you are running some tool or some script or something in your device, understand what you're what you are running and understand the the risks. >> Anything else you want to add? >> I think it's okay. >> Okay.

>> Yeah. >> Thank you very much. We couldn't do everything. We saw half of the of all the stuff >> but also you have the checklist and in the checklist you can follow like step by step all the configurations also on your iPhone that we were not able to see but you will have everything you will have the configuration of your the correct configuration of uh the uis also of the call email accounts. So yeah, and if you have any doubts of any of the steps, feel free to reach out uh by email or telegram uh to any of us and we will have help you with them.

>> Yeah. Yeah. Exactly. And uh and a small shield. Well, this is basically what we do at OBSC, right? Our our company what we do is operational security audits and trainings for any web through organization. So anything that we can help you with, you let us know. Thank you guys. >> Thank you. I know we in