Essential details of each of the three types of XProtect data files, how they’re updated, how to update them, and more. Covers new XProtect in macOS 15.x.
SIP
App launch security is built in multiple layers, and not all check are run on every launch of an app. Syspolicy plays a key role, CDHashes are now central, and XProtect scans can make checks on large apps slow.
Three malicious apps – Atomic Stealer, Genieo and XCSSET – against macOS 14.6.1, with full security, SIP disabled, and Gatekeeper disabled.
If you thought spctl disabled Gatekeeper assessments, and disabling SIP had little effect, then you might like to think again.
Details of security checks including Gatekeeper, XProtect and notarization, performed when launching an app in full security.
Security in macOS is designed and applied in multiple layers to remain effective even when one layer is bypassed, and herd protection determines types of attack.
One cause of an app crashing as soon as it’s launched, these constraints prevent you from running bundled apps copied elsewhere, and can now be used by third-party apps.
Why disable the whole of SIP when all you need is to disable some of its features? Here are all the options explained, and how to combine them.
Changing Dock icons, a new Check Now command, a major bug fix, and more in these updates to the apps that keep a watchful eye on your Mac’s security.
Includes a version you can install into the menu bar, improved interface with categories, and internal improvements. Also makes results accessible to scripts.
