Is there a list of LOLBINs for macOS?

Ah, so it was guests on your login, and now it’s drive-by downloads in Safari, and yes, there’s been Mac malware.

Here’s one discussion of file-less malware for Mac, though the user has to click through several dialogs, so hardly a drive-by...

https://objective-see.com/blog/blog_0x51.html

I’m not aware of a detailed public list outside of the one likely maintained at Apple, and what’s in the CVEs.

santuccie wrote:

Quoting myself: I've found an app that password-protects other apps from being launched by visiting relatives, but could also serve as the Mac equivalent to an anti-exe.

That can be an ACL.

But then I’m also not running the family time-sharing service. BYOD. Or borrow an iPad.

With Catalina, bypassing checks gets that much harder. And the next release will be yet further locked down, and we only really know a few details such as the kext-related deprecations, and the Apple doc discussions around pointer authentication checks.

What I'm talking about is taking a sort of parental control app, and repurposing it for an extra layer of defense against drive-by downloads

Who’s running this system, who’s the threat, how much is the breach worth?

Whitelist everything?

Or run something else. Maybe atop Qubes.

But pragmatically, go build whatever scheme this is you’re envisioning, and see how well it works.

And just don’t give untrusted folks login access...

Don't give visiting relatives your login credentials.

I don't know what you mean by "vulnerable processes" but perhaps that's due to the fact I do not use operating systems that were vulnerable since their inception. macOS is invulnerable to malicious alteration. Unless you were to give visiting relatives login credentials with Administrator privileges there is no point in password-protecting individual apps or processes... which would just another way of providing Admin-level access anyway.

Disable automatic open of downloads.

For the more security-cavalier folks, I add a rule into mail that trashes any message with an attachment from a new contact.

As for guests, I never allow folks onto any primary login, much less an admin login. Let them use the Guest account. That’s what it exists for.

And password protecting apps using a third-party add-on, that seems a bother. Use an access control list and a group, and mark those apps as inaccessible to the untrusted group, or whatever you have decide to call it. This,with,some local variation of the guest login.

Or loan them an iPad.

A Mac is not single user, nor is NT-descended Windows. An iPad is...

santuccie wrote:

Not true. No computer is invulnerable to malicious alteration.

That's not what I said though, and it's not what you asked. Forgive me if I don't want to indulge your fantasies regarding theoretical exploits. I don't have the patience.

santuccie wrote:

I've found an app that password-protects other apps from being launched by visiting relatives, but could also serve as the Mac equivalent to an anti-exe.

The best solution to this would be to use a Guest User, as explained in this Apple support document: Change Users & Groups Guest user preferences on Mac - Apple Support

If your visiting relatives are staying for a longer period, say 14 days?, then I would suggest that you create a dedicated, standard user for them to use. See Set up users, guests, and groups on Mac - Apple Support

Is it possible to obtain a list of vulnerable processes on macOS? At least those most likely to be used in such an exploit, and that can be restricted without triggering alerts during normal operation?

My suggestion here is to avoid reading too many of those "security blogs". For most people, their visiting relatives are not sophisticated enough to worry about. Sometimes kids can be clever. You can Set up Screen Time for a child on Mac to better control them.

All that being said, there is no security when someone has unsupervised, physical access. So if you know someone who you think is sophisticated enough to do damage, don't give them your machine at all.

Then, You should probably seek out a forum that tends towards fantasy.