I appreciate it. Yeah. Good morning Aloha and welcome to my talk on Apple's background task management. My name is Patrick Wardle. I am the founder of the Objective C Foundation. There I work on free open source Mac security tools. I write the art of Mac malware book series and also co-found and organize the Objective By The Sea Mac security conference. Basically all things Apple, all things Mac. So today what will you learn? What will we dive into? What am I going to be talking about? Well the cool thing is there's kind of many facets to this talk. I mean really the goal is to focus and understand on Apple's Mac OS's background task management, BTM, which of course will explain exactly what that is. But we're also going to cover topics of reversing malware detection, Mac OS internals and more. So hopefully there's something in this talk for everyone. We're going to start by diving into the internals of Apple's new background task management. I will caveat this part. We're going to get into the weeds pretty deep. Some reverse engineering, disassembly. But this is really important for the remainder of the talk. And with an understanding then of the internals of this background task management, we'll then show how we can build some neat tools to leverage this. Then because you know Defconn's a hacker conference we'll talk about of course how to fully bypass this new system. And then we'll end by talking about how to detect our zero-day bypasses. So first let's start with an overview. Starting with defining and talking about what is background task management. So this is something that was largely introduced in Mac OS 13. So the most recent version of Mac OS. And what it is, it's a system designed by Apple on Mac OS to govern and consolidate persistent items or in Apple's parlance background tasks. So what are persistent items? Persistent items in the context of this talk are simply processes that have installed themselves in a manner that every time the system is rebooted or the user re-logs in are automatically re-executed by the operating system. So things like an auto updater that needs to run every day is going to persistently install itself. Of course malware is going to do the same thing because if malware does not persist and you reboot your system you've just disinfected yourself. Now what happens when an item is installed that persistently installs itself is three things, three visual things related to BTM. First, and again this happens on the most recent version of Mac OS, there's going to be a system alert informing the user that whatever they just installed is persisting. So an alert to the user saying hey, something just added itself to the operating system is going to be automatically restarted. Second, there is a security message that is broadcast that security tools can register for, which is a notification, a programmatic notification saying hey, something just persisted. You can see from a security point of view, from a security tool this is something that's very useful. And then finally that item is going to be registered in a database, the BTM database. So why do we even care about this? Who cares about this? Well we do. First and foremost as defenders we now have a nicely organized subsystem that manages most persistent items. If we can understand and tap into that we can build and I'll show you exactly how. Very powerful security tools that can now allow us to generically detect persistent malware. This is awesome. As hackers though, BTM definitely poses some problems to reasons. There's going to be an alert telling the user hey, something just persisted. So if you get on a system and try to persist your back door, the user will now be alerted. And also as I just mentioned there's a security message that's broadcasted so any security tools that installed on the system will get a notification. These are both brand new events on the latest version of macOS. So you can see as hackers this is a problem for us. So we need to figure out exactly how to get around this. Now BTM is largely undocumented. Apple really doesn't describe a lot. So the first part of this talk is really going to be diving into the internals of this subsystem. Now when I want to understand something on macOS I always turn to the logs. And this is because a lot of components in the operating system, even undocumented ones, give us a lot of very informative log messages. Unfortunately on macOS a lot of log messages are redacted. So what we first have to do is install a logging profile which basically tells the operating system hey, please unredact and log everything. And there's a link on the slide how to do that. It's pretty straightforward but just know if you're going to be spelunking around in the logs make sure you've kind of turned on this full logging capability. So now that we have logging off and running, we just install a launch statement which is a persistent component. And then look in the logs and see what is shown. So we can see on the slide there's a few very interesting log messages that are directly related to the BTM subsystem. And what we're going to do is we're going to take these log messages and find the binaries that are responsible for generating them and look in their disassembly at the functions that are broadcasting or logging these messages to figure out exactly what's going on. So there are great signposts. So we can see two things are happening. First there are two binaries, two processes that appear to be responsible for BTM. One is called SMD and the other one is called background task management D. We'll dive into both of these. And based on the method names, we first see one that's called launchD will scan your path. And then the second one, register launch item. So it appears that the operating system has noticed that a new item was persisted is going to scan that directory and then register that item. This makes sense. So let's first talk about SMD. This is the system management demon. And the first thing it does is we see that it generates a log message saying got a FS event. FS stands for file system. And if we debug this, we can see that when this log message is called, if we poke around and look at some of the registers, we can see that one of the registers contains an XPC dictionary with an event that is related to watch paths. Now if we look at SMD's property list, which contains information about how it should be launched and some other activities, we can see it contains key value pairs that tell the operating system, please invoke me any time something is written, for example, to the launch daemon directory. And if you're not familiar with Mac OS, writing something to the launch daemon directory is how you persist an item as a daemon. So what this is telling the operating system is, hey, I am interested any time something is added to this directory. If we dig in a little more looking at some of the method names that we saw in the log messages, we see that SMD will generate a XPC connection to a service called com.apple.background task management. Now XPC is a Mac specific IPC inter process communication mechanism that allows one process to talk to another, to both send messages but also to invoke methods and code in the remote process. And we'll see BTM utilizes this heavily. Again, if we poke around in the debugger, we can see that the scan path that SMD is looking at and is going to talk to the other component is the launch daemon directory, which is where our persistent item was just placed. Let's look a little bit more at these XPC messages to confirm who SMD is sending them to. We can use Mac OS's LSMP command. This is LS list MP mock ports. This will show you who is sending mock messages and to whom. So we get the PID of background task management run LSMP and we can see, yes, there's a bunch of mock messages, XPC messages coming from SMD. And if we set a break point on the BTM daemon, we can see that the way its methods are invoked are via this XPC message. So really SMD is just talking to the BTM daemon. So now let's look at this BTM daemon. This is like the second piece of the puzzle, kind of the core component of the background task management subsystem. If we look at its property list, we can see it has various mock interfaces. These are the XPC interfaces that processes such as SMD can connect and talk to. And then also the path to its binary. Let's take a closer look at its binary. We can see first that it's going to be running with root privileges. This makes sense because it needs to monitor system activity, manage these persistent items. If we look at its entitlements, which are capabilities, additional features that the operating system will give it, we can see it has some related to managing BTM. Also, there's an interesting one, and we'll dive into this more, showing it has a entitlement allowing it to submit endpoint security events. We'll see this is how that security message is generated. If we look at its launch item registration function, we can see that what it's going to do is once it gets a message from SMD, it's going to look at, for example, the launch daemon directory and find the new item that was added. So, for example, when I install zoom on my system, zoom legitimately installs a launch daemon, a persistent component, we can see in a debugger that the BTM daemon has now the property list of that new item that was registered. We now have another player that enters the scene, and this is the BTM agent. So, if we go back to the logs, we can see that there's a log message from the BTM daemon that says, should post advisory, and in this case, it is set equal to true. Next, we see a log message from a new process called the background task management agent, and we can say, we can see a log message saying, posting new advisory notification. So, at the bottom of the slide, we have kind of now a full diagram attic overview where SMD is going to get the initial notification, send an XPC message to the BTM daemon. The BTM daemon is then going to talk to this new process, the BTM agent, which is then going to show the alert to the user. So, let's briefly look at this agent, it's the last piece of the BTM puzzle. If we look at its property list, we can see it has some mock and XPC interfaces. Again, these are exposed so that processes, such as the BTM daemon, can send a message to it. And then also the path to its binary. If we look at its binary, we notice it's running as not root, but as the user. This makes sense because the agent is responsible for displaying the notification on the user's desktop, which you have to be running in the user session in order to do that. In terms of entitlement, we can see that it has various BTM specific entitlements, and also then a private Apple entitlement that allows it to generate system notifications. On macOS, you need these entitlements, for example, to show a system prompt. Okay, we're kind of wrapping up the internals of this, kind of one of the last pieces, we need to look a little closer at how this message is actually displayed. So we know that the BTM daemon is going to send a message to the BTM agent, and if we look at the agent's disassembly, we can see it has a method, aptly named post advisory for content. And in the bottom, I've debugged this instead of breakpoint on this method, and we can see that the argument that it's passed is the message that should be displayed in the notification. So this is just the internals of how the agent then will display the message to the user, alerting them as to the fact that something was just persistently installed. Once that has been displayed, we see one other log message which shows that the background task management daemon, it's kind of the core piece, is actually updating some undocumented proprietary database with what appears to be the item that was registered. And we'll dig into this more when we dive into writing a tool, but basically what the BTM daemon is doing is now storing information about the item that was just persisted into a new database. So that was kind of an overview, we kind of got into the weeds, but it's important again to understand these different components, because as we now talk about writing tools to interact with them, we have to understand those, and also when we want to bypass these, we're going to have to have this understanding as well. So that's out of the way, let's kind of pull it back a little bit and talk first about how we can write some neat tools to leverage BTM to detect persistent malware. Now why this is such a great idea in my opinion is because the vast majority of malware is going to persist. Again, persistence is a way to ensure that you are automatically re-executed by the operating system each time the system is rebooted. So this is something that the vast, vast majority of malware strives to achieve. I study the new Mac malware of each year, it's kind of one of my end of the year highlights, sadly, and I've noticed some interesting trends, and this is not surprising to me, but again, this just reiterates that most malware is going to persist. So in 2015, which is now almost 10 years ago, I was like, hey, since all Mac malware is persisting, I should write a tool that monitors for these persistent events, and then when malware persists, regardless of how it got onto your system via a zero day, a trojanized installer, a supply chain attack, I might not be able to detect all that, but as soon as it persists, I can alert the user. So I release this free open source tool called BlockBlock, and BlockBlock does exactly kind of as the name implies, it will monitor for persistent activity and then alert the user. So this is what Apple is doing now. It took them 10 years or so to realize this is a good idea. I like to think that they were inspired by my tool, but you know, from a security point of view, this is great that now this is built into the operating system. And to me again, this just iterates the fact that Apple now has also realized that because most Mac malware is going to persist, this is a great way to now alert the user that perhaps something has slipped onto their system. Let's look at a brief example, Dazzle Spy, one of my great examples for this because it was deployed via zero day safari bugs. So a very powerful deployment mechanism, right? Users in this case were almost SOL if they inadvertently browsed to the site, clicked on the link, the zero days would infect their operating systems, their Mac OS systems, even if they were fully patched. If we look at the embedded strings for Dazzle Spy, we can see something related to a launch agent, which is another way you can persist. And if we run a file monitor and execute the malware, for example, in a virtual machine, we can passively observe it persisting itself as a launch agent. So again, even if we can't detect the zero day exploitation or prevent that, as soon as the malware goes to persist, if we are able to detect that, we can then alert the user that something is amiss and maybe stop the infection before it's gone too far. So the first idea I had to leverage this new BTM is I want to dump the database because the BTM database has a nice comprehensive list of all the persistent items. So the idea is like let's write a tool that you can run on a Mac system that says show me everything that's persisted. Now this will include legitimate software, for example Zoom, we saw, but if there is any persistent malware on your system, it will likely also be in this database. The problem is this database is proprietary and undocumented. Luckily though, Apple ships a tool called the SFL tool that allows you to interact with this database. And one of the commands it has is dump BTM. And if you execute this, it will nicely dump the database. So here, for example, we can see the information about Zoom's persistent component in the BTM database. Now it's great that there is a command line tool, but I want to be able to programmatically do this so I can add this to my own security tools. So I said, okay, well, SFL tool obviously knows how to grab this database, parse it. Let me reverse engineer and figure out how it does this. So if we reverse engineer it, we can see in a nutshell that it sends an XPC message to the background task management daemon. And the daemon will then send the database, its contents back to the SFL tool. We can see that also in the log messages with the BTM daemon saying, yes, I received an XPC message to get the contents of this database. So it said awesome, let me implement this same code, let me talk to the BTM daemon, kindly ask and say, hey, I also want the database. So I mimic the code of SFL tool, compiled and executed this, and it completely failed. Basically, we can see a log message saying, Patrick, you don't have Apple's private entitlement. Rude, you can't talk to me, please go away. And we can confirm this if we reverse engineer the background task management daemon, we can see it has code to check who is talking to it. And it will only talk to processes that are privately entitled, meaning things like SFL tool. I can't get that private Apple entitlement, I can't spoof it. So BTM daemon is basically going to tell me to take a hike, whereas FSL tool is going to be allowed to make that request and get the contents of the database. So fail. But can we just access the database directly? Yeah, as long as we have full disk access, we can. So the first thing is that let me dig into this database to figure out what exactly it is. I ran the file tool on it, it told me it was an Apple binary property list. We can use the PLUT command to convert it to a normal property list. But unfortunately, that doesn't really help because it shows us it's just a NS key archived, which is a jealousy object that has a bunch of other serialized objects. So really the database has a bunch of undocumented serialized objects, so not the best format. But SFL tool can somehow deserialize those objects and display them to the user. So if we reverse engineer SFL tool some more and figure out how those objects are deserialized, in theory we should be able to write our own deserializer and then read the database directly ourselves and display this information to the user. So if we look at SFL's tool, we find it's deserialization code, which describes the objects that are in this database. So what we can do is we can essentially re-implement that deserialization ourselves. I'm not going to go through all of this, but we can see there's things in these serialized objects such as an executable path, bundle identifier, et cetera, et cetera. We can then with this deserialization logic complete, write some code that opens the database, loads it into our own keyed archiver, and then invoke the decode object of class method, which will invoke our custom deserializer and deserialize all the objects for us. So I pushed this logic into an open source library called dumpbtm, and with this library now you can write a five or ten line program that simply can interact with the database. The library exposes two main methods. The first one is dumpbtm. You can either specify the path or it will look it up for you. This will print it out to standard out, or it will load the contents of this database into a dictionary that then you can programmatically dig into more. So here's an example, the output of our dumpbtm tool. This should look exactly like SFL, SFL tool, which was the goal. Another cool thing about it is this doesn't need root access to run where Apple's SFL tool does. So if we execute this we can see we're opening the background task management database which contains all the persistent items on the system that we're interested in and starts printing them out. Again we can see for example the zoom daemon that has installed itself. So what I then did was I took this library and I implemented it into one of my well-known security tools called knockknock. Knockknock's goal is to simply tell you who's there, pretty much saying these are all the persistent items and with the addition of this new library code it can now also query the undocumented btm database, get all the persistent items from that and display that. So on a system where Dazzle Spy has infected via the Safari Zero Days we can now enumerate its persistence and alert the user that their system is infected. Now there's one kind of downside to that approach and that is it's somewhat reactive, right? You're going to get on a system if you're doing some forensic analysis or seeing if it's infected and you're going to now query and yes you can get a list of everything that's persisted but it would be nice to get a notification in real time when something is persisted. That's a little more proactive. So let's talk about how to do that now. Now you might remember that I mentioned that the background task management daemon has an entitlement related to end point security. What is end point security? It's another subsystem in Mac OS that's designed to be designed to interact with third party security tools. The idea is the end point security system and we'll dive into this more. Basically monitors all sorts of activity on the system and then third party security clients can tell it what they are interested in and when that event occurs the end point security subsystem will programmatically deliver it to them. So for example we will see we can tell the end point security subsystem hey we are interested whenever something persists and then it will programmatically call us. So this is really great for a security tool to monitor for example whenever a persistent item is installed. Whether that is zoom or dazzle spy via zero days. So what we can do is we can look at the header files for the end point security system and we note that in Mac OS 13 the most recent version when BTM was introduced there are some new end point security events that we can now listen for and the one we're going to focus on is the BTM launch item ad. As the name implies this is a message that will be delivered anytime a new item is persisted. So the idea is an installer or piece of malware comes along and persists itself if our ES client has registered for these notifications Apple will deliver that to us. So you can see if you're writing a security tool this is great. You can then perhaps examine that item alert the user generate a log message etc etc. So let's look how to do this programmatically. This is some standard end point security code. This is how you write a client basically three steps. You tell it what events are of interest to you. Here we want to detect when a new persistent item is added so we tell it we're interested in the BTM launch item ad event. We create a callback that will be invoked when this event is delivered to us and then we subscribe which kicks off basically our listener. Now whenever something is persist the operating system will call us because we said hey please let us know and here are some additional information about the contents of that message. So we can see things like the item, the executable, the path to its property list. Again these are the components of the message that are going to be delivered to us. So now if we add this code and compile and execute we are now listening essentially for persistence events. If Dazzle Spy comes along and infects this system we can now see that we get a notification from the operating system from the end point security subsystem telling us hey just to let you know a new persistent item was added here is the path to its executable and also the path to its property list. This is great because if we look at that first we can see it's an executable software updater that's running from a hidden directory huge red flag. Its property list is also called calm.apple.software but if we look at the binary software update it's not signed by Apple so another huge red flag. So this is an example of now how we can generically detect even brand new malware that's being deployed via zero days simply by monitoring for persistence activities. Now one problematic issue the other end point security event related to persistence events the remove events is broken. Like you can register for it but when a persistent item is removed it's just never delivered. So Apple please fix. And speaking of broken the btm launch add event was actually horribly broken to begin with in two ways. First whenever an item was persisted the operating system would just call you with all the items that were persisted which is totally unhelpful. I'm only interested in the new items not the 25 other items that are already on the system. And then also if you persisted as a login item which is another persistence mechanism you wouldn't get a notification at all. So I sent a bug report to Apple and I said hey yo this is like all broken they took their happy time but eventually in macOS 10, 13.3 they fixed this. Okay so now we've talked about the internals of the btsm subsystem. We've showed how we can write some pretty powerful detection tools that allow us to detect malware when it persists. So this is great for defenders. But as I mentioned Defconn like it's a hacker conference so we need to like put on our black hats and talk about now how to break this subsystem. And the reason we want to break this subsystem as hackers are twofold. First let's put ourselves in the shoes of a hacker. We come along we infect a mac system with our 0 days. All well and good. We go to persist. Two things now happen because of btm. First a big system alert is generated and displayed to the user saying hey something just persisted.  And then also as we showed this will generate a endpoint security message which means that if any security system is on your on your mac any security tool it will pick up this event and also be like yo strange you've essentially been hacked. So as hackers we want to bypass both the security alert and the endpoint security event. Two things to point out these are both separate so we have to find attacks and bypasses for both of them. But the good news is both of them are independent on the functionality of the persistent item. Meaning regardless of what happens to the alert and the security event they're both notification so either way the item will be successfully persisted. It's not like the operating system is waiting for the user to click on the event and say allow. So this is good. This means if we can suppress these messages or somehow prevent them from being delivered we're great our malware will be able to persist invisibly and still function. So one thing you can do and this is not really a bypass per se it's more just a limitation of BTM is simply persist in a way that is outside launch daemons, launch agents or login items which are the three persistent mechanism that BTM currently monitors. These are the most popular ones but there are myriad of other ways for example you can persist as a cron job and currently BTM does not monitor cron jobs. There's also a great blog post by Chaba who basically shows that there's 20 or so more esoteric and stealthy ways to persist. So if you persist your malware in any of those ways again as long as you're not a launch daemon, a launch agent or a login item, BTM doesn't even come into play. But I wanted to directly bypass that system alert. So method one is hilariously simple. If we go back to that SFL tool and look at what it supports, one of its commands is the reset BTM database. And the idea is if your database gets into a funky state you can reset it. The operating system will then just rescan all the launch daemon agent and login items directory and rebuild the database. So that's great. The problem is when you execute that it puts the background task management daemon in like a funky confused state. So if we look at the log messages what we can first do is reset the database and then persist an item. And if you look at the log messages you can see that should post advisory is now set to false. I don't know exactly why but I know that if you reset the database this will always be the case. So what a hacker can now do granted with root privileges is just reset the database, persist their item. Their item will be successfully persisted and restart every time the system is rebooted but the alert will never be delivered. And again they're simply using Apple's own tool.   So that's awesome but the problem with that is you need root access. So I said okay let's do one better. Remember the BTM daemon will send an XPC notification to the BTM agent and say please display a notification to the user. What privilege level is the agent running at? User. And this is because it needs to display a message on the user's desktop session. So I said can we just send the BTM agent a stop signal like yo go to sleep for a minute. What happens? Well it turns out you can do this. The BTM daemon will still deliver the message to the BTM agent and believe that was successfully delivered but since the agent is sleeping it's not really going to get that message and so it will never be displayed. So what a hacker can do is get the process ID of the BTM agent which again is running as user so lowest privilege level. Send it a stop signal to put it to sleep. Go to persist. BTM daemon will try to deliver the message and think it succeeded but the agent is sleeping. And then once they have persisted kill the agent which again you can do because it's running with your same privilege level.  But if you do this you will now be able to persist and the alert to the user will never be displayed. Now this is well and good. I'm like cool. Like these techniques work on the latest version of Mac OS so hackers take note. I guess Apple take note too. But you know I'm like cool users might ignore that alert anyways. What I'm really more interested in is preventing the end point security message because security tools including my own listen for this method. This is how Apple says register for persistence notification. And you can imagine security tools are not going to necessarily ignore this. A user might ignore an alert. A security tool if it gets a persistence event is going to examine that very closely. So again as adversaries, hackers we want to figure out how to prevent that message from being delivered. And it's a little harder because this is all being delivered in the root session. So I went back to the BTM daemon and started looking around at how it submits events to the end point security system when it detects something has persisted. And unfortunately if we follow the call chain, we can see it calls into the kernel. Which means we're going to have to pop into kernel. However right below that kernel call, we can see a log message that says fail to submit event. So I'm like okay well it looks like there's a failure scenario I have no idea what that is. But we can figure out what that failure scenario is and trigger that. We might be able to prevent the end point security message from being delivered to any security tool on the system. Which is the goal. So we pop into the kernel and there's kind of a lot going in on the slide kind of follow the black arrows. We can basically see that in the end point security kernel extension, so this is running in kernel mode, we find a bunch of methods. One is called PDB read audit token. This reads a process ID from a user mode buffer and then calls another method create from PID version. And this invokes the proc find API. Given a PID. This is going to be important. Then it calls another method to get the executable Vnode. This is kind of like the file system Vnode of the process it's just looked up. So basically it's trying to get a path to a process. What process? Well if we set a break point in kernel mode and install something for example oversight which is one of my utilities that installs a launch login item. We can see that the process that it's looking up is the responsible process that has persisted the item. And we can confirm that if we look at the end point security message in user mode we can see that the PID and the process match. So again what the end point security kernel extension is trying to do is look up the process that is responsible for generating the persistent event. The installer, the malware, etc. etc. This makes sense because they want to deliver that to the security tool in user mode. So I looked at that a little more and I thought okay what happens if the responsible process is like gone? What if it executes really quickly right? This is kind of happening separately so maybe it'll get confused. And so what happens we can see in this case they call proc find with null. They don't have a PID because the process that persisted at least I thought it was gone. Now if you call proc find with null which is also zero you get back a process object but it's the one belonging to the kernel task. Because the kernel task is assigned PID zero. It's not really a process per se but this is just how it works on macOS. And that's okay. I mean they kind of have the wrong process at this point but it's problematic then when they call proc get executable vnode because the kernel doesn't have an executable vnode. It's not a running process backed by a binary per se. So that is going to return null which causes them to return error number three. And if we go back to the log messages in user mode we can see a log message that says fail to submit ES syscall error three no such process. So I was like okay I think I can trigger this but how? Like how do I develop a proof of concept? And I thought about it and I said oh wait a minute my own tool block block uses the CP command to install a property list. It copies that and that's a very quick command that exits. So I was like is this going to trigger this kernel bug and bypass that? So let's do a demo. I haven't prayed to the demo god so fingers crossed this all worked but go bigger go home. The first thing we're going to do I'm going to make this a little bigger is we're going to execute Apple's ES logger command and this is going to this is a utility and end point security client that allows you to listen for end point security events and we're saying please listen for the BTM launch add item. So in theory if an item is persisted we should get notification. We're then going to have some log messages running this is just going to show us the error message and then we're going to install block block. Fingers crossed put in my password this is definitely going to work. Now we do get an alert we'll address that in a second. These alerts are again separate from the end point security subsystem. If we go over here though we see there's no message. There's supposed to be a message. Why isn't there a message? Well if we go back to here and look for Lib end point we can see that we have successfully triggered this kernel bug failed to submit event sys call failed error no such process and this is because block block again is a script that executes shell commands which start and stop very quickly. So the kernel doesn't have time to look that up or isn't tracking those separately. When it goes to look that up that process is already gone and so it doesn't have a pad and so it errors out. So basically all you have to do to bypass the security events is to do that. Okay let's I guess we have some time let's show how we can block these messages as well. Yeah awesome. Thank you. So I'm going to uninstall block block click through this just to kind of reset everything uninstall and we're going to run it again and we're going to this time try to hide those alerts. So I remember I told you the launch agent the background the BTM agent is responsible for displaying those alerts and so what we can do is just tell it to go to sleep. So let's do that exactly. So what we can do first over here I'll make this a little bigger is we're just going to get the process ID of the background task management agent. We can see it has a pit of 86276 it's also running as me as the normal user. So what we can do is we can do this programmatically or we can just do it via the kill. We're going to send it the kill stop command which is going to say hey go to sleep and we can confirm that if we do the process listing again it now has a T here T means that item is now suspended. If we and I'm going to reset this because the uninstaller for block block installs something persistently but does it programmatically so this generates an event this just proves that normally we should get an event. So I'm going to reset this to show that the installer doesn't we're now going to run block block again and the hope is we don't get a security event and be no no alert is shown. So fingers crossed live demo number two block block is going to install hooray happy we're going to get an alert from block block saying I'm up and running but no alerts from the endpoint security system and no alerts from the subsystem. So now what we would do is we would kill the agent to make sure that those messages are not delivered. What I'm going to do instead resume it to show you that if we didn't do those those would actually be there. So again normally a hacker wouldn't like continue the agent they would kill it at this point which is again because it's running with the same privileges but if we continue it we will see those are the messages.  So what we have done is fully bypassed background task management which is I think kind of problematic. And why is this problematic let me just clear these annoying alerts. It's really problematic because this is a security mechanism that Apple has basically told us will protect our Macs but in reality it's implemented incredibly poorly and is trivial to bypass. And this is problematic because users might now be overconfident in the security of their system because Apple has promised them this security feature and security tool vendors might also be leveraging this to detect persistence believing it works when in reality it's broken and trivial to bypass. So that in my opinion is problematic. So let's end kind of on a more positive note and show how we can detect these bypasses until Apple gets their act together and actually start shipping secure implementations. So the first thing we want to do is how do we detect if someone resets the SFL or the BTM database. This is not something that should ever normally happen right. It's kind of an undocumented database no one really knows about the SFL tool. So if you see someone resetting the database it's like probably a hacker trying to leverage one of these bypasses. So what we can do is we can write a process monitor that can detect when this process is spawned and also look at the arguments. We can write a process monitor that's either passive that can say hey this happened or using other endpoint security events you can actually receive a notification when a process is about to be spawned and if it's the SFL tool with the dump BTM command you can actually prevent sorry with the reset database command you can actually block that all together. So this is a way to essentially prevent that command from being run so that database cannot be reset. What about telling the BTM agent to go to sleep? Well it turns out we can also use the endpoint security system to register for signals. Specifically we can use the event type auth signal which will be delivered to us anytime a process is trying to send a signal to another process. What we can then do is we can examine both the signal and the source and destination process and if the destination process is the background task management agent and the signal that is about to be sent to it is a stop event to put it to sleep we can tell the operating system do not allow that to happen. So if we implement this code and are running this in our security tool you can now see that when the attacker tries to send that sig stop message to tell the BTM agent to go to sleep our security tool will deny that and that will actually fail. So now we've prevented the agent from going to sleep. Again these are things like Apple should be doing it's like lame that we have to do this but is what it is right. In terms of getting the end point security notification for persistence this one's a little tougher because it's a kernel flaw so kind of hard for us to detect. Well good news is there are other end point security alerts or messages that will also be delivered that are not susceptible to this bug. For example when a piece of malware writes a property list to the launch daemon directory to persist yes in theory this is supposed to generate a BTM launch item ad and will in some cases but we showed how to trivially bypass this. This will always also generate file notifications for example notify create notify write that will be delivered to us and are not susceptible to the kernel flaw which allows us then to say hey something was written to those directories. So what we can do and this is how block block detects persistence is it doesn't use the BTM launch item ad because it's broken currently I wish it worked to be really nice but instead it uses the file events to monitor the locations where items can persist as I mentioned those events will always be delivered accurately and correctly. So it listens for those events if it turns out it's in one of those directories it then alerts the user. The other thing is unlike apple's approach it has the ability to block that so you can actually take some action against that versus just clicking on an alert that's like yeah cool. Okay so let's wrap this all up with some takeaways. So we talked about understanding macOS's BTM subsystem. I think it was important to understand that because we want to write tools and also understand limitations. So once we had an understanding of the internals of the background task management we showed how to write some very powerful malware detection tools that are built on the fact that mac malware persists and BTM now manages and governments governs persistence. Unfortunately we showed that it's trivial to bypass the BTM subsystem entirely. Again all these approaches worked on all the latest versions of macOS so go out and cause chaos I guess. No don't. But you know again one of the other takeaways is like if we're not doing this research who is? Like what is apple doing? Like counting their trillions in Cupertino? I don't know but it's really problematic when they say hey there's this great new security system that's built into macOS. You now are protected against a persistent malware. Well in the reality like that's really not true. And again as I mentioned that's problematic because users are going to have a false sense of security which is bad. Makes them easier to victimize. And then also security tools might be thinking they're doing their jobs when in reality they're not at no fault of their own. So again maybe anything apple says take with a huge grain of salt and continue to keep poking on macOS because even new code that apple releases is well I would say subpar. Now if you're interested in learning more about Mac malware, reverse engineering, writing security tools, I've written some free books on the topic. Volume one is out. Go to taomm.org 100% free online. I'm also going to be doing a book signing today right after this talk at the No Starch Press. So if you want to pick up volume one get my signature check it out. I'm also writing volume two which covers basically the topics we talked about today which are the programmatic approaches to detecting malware. So again the nonprofit I'm part of because I think we're doing a lot of really cool things that I think many of you will be interested in. We organize the OBTSEcurity conference. I see a lot of friends here from that conference so thank you all. We also raise money for college scholarships for students who are going into technology fields and we have various diversity programs as well. Our current effort though is raising money for the wildfires in Maui. Many of you know I live there. A lot of my friends had everything lost working to raise money for that. So something very personal. If you feel like you want to support that it's awesome or even just share this. It's something that would be very meaningful to those who lost their houses and their loved ones. So speaking of thank you also want to briefly just end by thanking the companies who support the nonprofit. We're able to organize this great conference. I'm able to release these tools these free books give these talks thanks to them really couldn't do that without them so I briefly want to thank them all and also thank you all for spending this rather early Saturday morning with me talking nerdy about Mac OS stuff. So thank you again to you all.


The white linen nurse came out of the prudish smelling hospital, into the riotous, mud-and-posey promise of the young April afternoon. The God of Hysteria had certainly not deserted her. In all the full effervescent reaction of her brainstorm, fairly bubbling with dimples, fairly foaming with curls, light-footed, light-hearted, most ecstatically light-headed, she tripped down into the sunshine as though the great, harsh granite steps that marked her descent were nothing more nor less than a gigantic, old, horny-fingered hand, passing her blithely out to some deliciously unknown lily-putty in adventure. As she pranced across the soggy April sidewalk to what she supposed was a senior surgeon's perfectly empty automobile, she became conscious suddenly that the rear seat of the car was already occupied. Out from an unseasonable snuggle of sable furs and flaming red hair, a small, peevish face peered forth at her with frank curiosity. Why, hello! beamed the white linen nurse. Who are you? With unmistakable hostility the haughty little face retreated into its furs and its red hair. Hush! commanded a shrill, childish voice. Hush, I say! I'm a cripple and very bad temper. Don't speak to me.  O my glory, glory, glory! Without any warning whatsoever she felt suddenly like nothing at all rigged out in an exceedingly shabby old ulster and an excessively homely black slouch hat.  That the bleak hat reflected no decent, featherish consciousness of being tossed, that the big thread-bear pockets had no bottoms to them merely completed her startled sense of having been in some way blotted right out of existence. At her back the senior surgeon's huge fur-coated approach dawned blissfully like the thud of a rescue-party. But if the senior surgeon's blunt, wholesome invitation to ride had been perfectly sweet when he prescribed it for her in the superintendent's office, the invitation had certainly soured most amazingly in the succeeding ten minutes. Uproptly now, without any greeting, he reached out and opened the rear door of the car and nodded curtly for her to enter there. Instantly across the face of the little crippled girl already enscounced in the tonneau a single flash of light went zigzagging crookedly from brow to chin and was gone again.   Yet so subtly was the phrase mouthed, to save your soul you could not have proved just where the greeting ended and the taunt began. There was nothing subtle, however, about the way in which the senior surgeon's hand shot out and slammed the tonneau door bang-bang again on its original passenger. His face was crimson with anger. Brusquely he pointed to the front seat. "'You may sit in there with me, Miss Malgreger.' He thundered. "'Yes, sir,' crooned the white linen nurse. Meek as an oiled machine she scuttled to her appointed place. Once more in smothered giggle and unprotesting acquiescence she sensed the resumption of eternal discipline. Already in just this thrice of time she felt her rampant young mouth resettle tamely into lines of smug, determinant, serenity.  Already the facile tip of her tongue seemed fairly loaded and cocked, like a revolver, with all the approximate yes-sirs, no-sirs, that she thought she should probably need. But the only immediate remarks that the senior surgeon addressed to anyone were addressed distinctly to the crank of his automobile. "'Damn having a chauffeur who gets drunk the one day of the year when you need him most,' he muttered under his breath, as with the same exquisitely sensitive fingers that could have dissected, like a caress, the nervous system of a hummingbird, or reset unbrusingly the broken wing of a butterfly, he hurled his hundred and eighty pounds of infuriated brute strength against the calm, chronic, mechanical stubbornness of that auto-crank. "'Damn,' he swore in the upward pull. "'Damn!' he gasped on the downward push. "'Damn!' he cursed and sputtered and spluttered. Purple with effort, bulging eyed with strain, reeking with sweat, his friends it outburst would have terrorized the entire hospital staff. With an odd little twinge of homesickness the white-lidden nurse slid cautiously out to the edge of her seat so that she might watch the struggle better. For thus, with dripping foreheads and knotted neck muscles and breaking backs and rankly tempestuous language, did the untutored men folk of her own beloved homeland hurl their great strength against bulls and boulders and refractory forest trees. Pretty startlingly as she watched, a brand-new thought went zigzagging through her consciousness. Was it possible, was it even so much as remotely possible, that the great senior surgeon, the great wonderful altogether formidable, altogether unapproachable senior surgeon, was just a, was just a. Stripped ruthlessly of all his social superiority, of all his professional halo, of all his scientific achievement, the senior surgeon stood suddenly forth before her, a mere man, just like other men.  The very delicacy of such a thought drove the blood panic-stricken from her face. It was the indelicacy of the thought that brought the blood surging back again to brow, to cheeks, to lips even to the tips of her ears.   Just for an instant his famous fingers seemed to flash with apparent inconsequence towards one bit of mechanism and another.  Even monotonously in terms of pain and dirt and drug and disease, the city wafted itself in and out of the white linen nurse's well-grooved consciousness. From every filthy street corner, sudden age or starved babyhood reached out its fluttering pulse to her. Then suddenly, sweet as a draught, through a fever-tainted room, the squalid city freshened into jacquant, luxuriant suburbs, with rollicking tennis-courts and flaming yellow fours-sithia blossoms and green velvet lawns prematurely posed with pale, exotic hyacinths and great scarlet splotches of lusty tulips. Beyond this hectic horticultural outburst, the leisurely spraying faded out again into April's naturally, sallow colors. And black as an endless top-rider ribbon, the narrow, tense state road seemed to wind itself everlastingly in and in and in on some hidden spool of the car's mysterious mechanism. Clickety-click-click-clack, faster than any human mind could think, faster than any human hand could finger, hurtling up hazardous hills of thought, sliding down facile valleys of fancy, roaring with emphasis, shrieking with punctuation, the great car yielded itself perforce to fate's dictation. Robbed successively of the city's humanitarian pang, of the suburb's aesthetic pleasure, the white linen nurse found herself precipitated suddenly into a mere blur of sight, a mere chaos of sound. In whizzing speed and crashing breeze, houses, fences, meadows, people, slapped across her eyeballs like pictures on a fan. On and on, and on through kaleidoscopic yellows and rushing grays, the great car sped a purely mechanical factor in a purely mechanical landscape. Alongside with concentration the senior surgeon stared like a dead man into the intrepid oncoming road. Intermittently from her green plushy lap robes, the little crippled girl struggled to her feet, and sprawling clumsily across whosoever's shoulders suited her best, raised a brazenly innocent voice, deliberately flattered, in a shrill and maddeningly repetitive chant of her own making. To the effect that all the birds were there with the yellow feathers instead of hair, and bumblebees crocheted in the trees, and bumblebees crocheted in the trees, and all the birds were there, and, and. Intermittently from the front seat the senior surgeon's wooden face relaxed to the extent of a grim mouth twisting distractedly sideways in one furious bellow. Will you stop your noise and go back to your seat? Nothing else happened at all until at last, out of unbroken stretches of winter-stailed stubble, a high formal hemlock hedge, and a neat pebble driveway proclaimed the senior surgeon's ultimate destination. Cautiously now, with an almost tender skill, the big car circled a tiny venturesome clump of highway violets, and crept through a prancing, leaping fluff of yellow collie-dogs to the door of the big stone house. Instantly from inestimable resources a liveried serving man appeared to help the surgeon from his car, another to take the surgeon's coat, another to carry his bag. Linkering for an instant to stretch his muscles and shake his great shoulders, the senior surgeon breathed into his cramped lungs a friendly impulse as well as a scent of budding cherry trees.  He conceded. It's an extraordinary case. You will hardly see another one like it. Palpably he lowered his already almost indistinguishable voice. The boy is young. He confided, about your age I should guess, a college football hero, the most superbly perfect specimen of young manhood it has ever been my privilege to behold. It will be a long case. They have two nurses already, but would like another. The work ought not to be hard. Now, if they should happen to, fancy you. In speechless expressiveness his eyes swept estimatingly over sun parlours, stables, garages, Italian gardens, rapturous blue shadowed mountain views, every last intimate detail of the mansion's wonderful equipment. Like a drowning man feeling his last floating spar wrenched away from him, the white linen nurse dug her fingernails frantically into every reachable wrinkle and crevice of the heavily upholstered seat. Oh, but, sir, I don't want to go in. She protested passionately.  It would break my heart. It would. Oh, sir, these worrying about people for whom you've got no affection. It's like sledding without any snow. It grits right down on your naked nerves. It— Before the senior surgeon's glowering and credulous stare, her heart began to plunge and pound again. But it plunged and pounded no harder, she realized, suddenly, than when in the calm white hospital precincts she was obliged to pass his terrifying presence in the corridor and murmur an inaudible good morning or good evening.  She reasoned over and over to herself. With a really desperate effort she smoothed her frightened face into an expression of utter guillessness and peace and smiled unflinchingly right into the senior surgeon's rousing anger, as she had once seen an animal trainer smile into the snarl of a crouching tiger. The—Thank you very much, she said. But I think I won't go in, sir. Thank you. My—my face is still pretty tired. Idiot! snapped the senior surgeon as he turned on his heel and started up the steps. From the green plushy robes on the back seat the white linen nurse could have sworn that she heard a sharply ejaculated, maliciously joyful, ha! piped out. But when both she and the senior surgeon turned sharply round to make sure the little crippled girl in apparently complete absorption set amably extracting, tuft after tuft of fur from the thumb of one big sable glove to the rumbling, sing-song monotone of, he loves me, loves me not, loves me, loves me not. Bristling with an utterable contempt for all femininity, the senior surgeon proceeded up the steps between two solemn-faced lackeys. Father! wailed a feeble little voice. Father! There was no shrillness in the tone now, nor malice, nor any mischievous thing, just desolation, the impulsive panic-stricken desolation of a little child left suddenly alone with a stranger. Father! the frightened voice ventured forth a tiny bit louder, but the unheating senior surgeon had already reached the piazza. Fat Father! screamed the little voice, barbed now like a shark-hook, the phrase ripped through the senior surgeon's dormant sensibilities, as one fairly yanked out of his thoughts he whirled around in his tracks. What do you want? he thundered. Helplessly the little girl set staring from a lackey's ill-concealed grin to her father's smoldering fury. Quite palpably she began to swallow with considerable difficulty. Then quick as a flash, a diminutively crafty smile crooked across one corner of her mouth. Father! she improvised dulcetly. Father! may I sit in the white linen nurse's lap? Just for an instant the senior surgeon's narrowing eyes probed mercilessly into the reekingly false little smile. Then altogether brutally he shrugged his shoulders. I don't care where in blazes you sit! he muttered and went on into the house. With an air of unalterable finality the massive oak door closed after him. In the resonant click of its latch the great wrought iron lock seemed to smack its lips with ineffable satisfaction. Ringing suddenly around with a wish of starched skirts the white linen nurse knelt up in her seat and grinned at the little crippled girl. Hi yourself! she said. Against all possible expectancy the little crippled girl burst out laughing. The laugh was wild, ecstatic, extravagantly boisterous, yet awkward withal, and indescribably bumpy like the first flight of a cage-cramped bird. Quite abruptly the white linen nurse sat down again and commenced nervously with the wrist of her chamois glove to polish the slightly tarnished brass lamp at her elbow. Equally abruptly after a minute she stopped polishing and looked back at the little crippled girl. Would you like to sit in my lap? she queried conscientiously. Insolent with astonishment the little girl parried the question. Why in blazes should I want to sit on your lap? She quizzed harshly. Every accent of her voice, every remotest intonation, was like the senior surgeons at his worst. The suddenly forked eyebrow, the snarling twitch of the upper lip turned the whole delicate little face into a grotesque but desperately unconscious caricature of the grim-jawed father. As though the father himself had snubbed her for some unimaginable familiarity, the white linen nurse winced back in hopeless confusion. Just for sheer shock, short-circuited with fatigue, a big tear rolled slowly down one pink cheek. Instantly to the edge of her seat the little girl jerked herself forward. Don't cry, pretty. She whispered. Don't cry. It's my legs. I've got fat iron braces on my legs, and people don't like to hold me. Half the professional smile came flashing back to the white linen nurse's mouth. Oh, I just adore holding people with iron braces on their legs. She affirmed, and leaning over the back of the seat proceeded with absolutely perfect mechanical tenderness to gather the poor, puny, surprised little body into her own strong, shapely arms.  There, there, there, she began quite instinctively to croon and pat. Don't say there, there, wailed the little girl peevishly. Her body was suddenly stiff as a ramrod. Don't say there, there. If you've got to make any noise at all, say here, here. Here, here. Droned the white linen nurse. Here, here, here, here. On and on, and interminably on. Here, here, here, here. At the end of about the 347th here, the little girl's body relaxed, and she reached up two fragile fingers to close the white linen nurse's mouth. There, that will do. She sighed contentedly. I feel better now. Father does tire me so. Father tires you? Gasped the white linen nurse. The giggle that followed the gasp was not in the remotest degree professional. Father tires you? She repeated accusingly.  Impulsively, with her one free hand, she turned the little girl's listless face to the light.  She asked, with real curiosity. What makes you? He isn't fat at all. He's just big.  Can't you see how mad it makes him? Why, of course, it made him mad! Said the little girl with plainly reviving interest.  Why, of course, it makes him mad! She explained briskly. That's why I do it. Why, my papa, never even looks at me unless I make him mad. Sh! said the white linen nurse. Why, you mustn't ever say a thing like that. Why, your mama wouldn't like you to say a thing like that.  Silly pink and white nursey, she chuckled. Don't you know there isn't any mama? Cackling with delight over her own superior knowledge, she folded her little arms and began to rock herself convulsively to and fro.  Now you stop!  Why, just think how bad it would make your poor papa feel!   But the papa didn't like the mama. She explained painstakingly. The papa never liked the mama. That's why it isn't like me. I heard cook telling the icemen once when I wasn't more than ten minutes old.   I think your cap is too hot. She began casually and then proceeded with increasing vivacity and conviction to the objects that worried her most. And those, those ruffles, she protested, they don't look a bit nice being so long. Resentfully she rubbed an edge of the purple dress between her fingers.  She admonished with real concern.  Oh, but when I wear gray, she persisted, the papa never sees me. But when I wear purple, he cares. He cares most awfully. She boasted with a bitter sort of triumph. Why, when I wear purple and frizz my hair hard enough, no matter who's there or anything, he'll stop right off short in the middle of whatever he's doing and rear right up so perfectly beautiful and mad and glorious, and haul her right out. For heaven's sake, take that colored Sunday supplement away.  Almost tenderly the little girl reached up and drew the white linen nurse's ear close down to her own snuggling lips. Damned nervous. She confided leconically. Quite against all intention, the white linen nurse giggled. Floundering to recover her dignity, she plunged into a new error. Poor little dev, she began. Yes, sighed the little girl complacently. That's just what the papa calls me. Fervently she clasped her little hands together. Yes, if I can only make him mad enough day-times, she asserted.  Oh, if I can only make him mad enough day-times, she cried out ecstatically.  Scalded the white linen nurse with an unmistakable catch in her voice.  Like the brush of a butterfly's wing, the child's hand grazed the white linen nurse's cheek. I'm a lonely little thing. She confided wistfully. Oh, I'm an awfully lonely little thing. With a really shocking abruptness, the old malicious smile came twittering back to her mouth. But I'll get even with a papayette. She threatened joyously, reaching out with pliant fingers to count the buttons on the white linen nurse's dress. Oh, I'll get even with a papayette. In the midst of the passionate assertion, her rigid little mouth relaxed in a most mild and innocent yawn. Oh, of course, she yawned. On wash days and ironing days, and every other work day in the week, he has to be away cutting up people, because that's his lawful business. But Sundays, when he doesn't really need to, at all, he goes off to some kind of a green grassy club all day long and plays golf. Very palpably her eyelids began to droop. Where was I? she asked sharply. Oh, yes, the green grassy club. Well, when I die, she faltered. I'm going to die specially on some Sunday when there's a big golf game, so he'll just naturally have to give it up and stay home and amuse me, and help arrange the flowers. The papa's crazy about flowers. So am I. She added broodingly. I raced almost a geranium once, but the papa threw it out. It was a good geranium, too. All it did was just drip the tiniest, tiniest bit over a book and a writing, and somebody's brains in a dish. He threw it at a cat. It was a good cat, too. All it did was, too.  Her heavy eyes were almost tight shut by this time, and after a moment's silence her lips began moving dumbly, like one at silent devotions. I'm making a little poem now. She confided at last. It's about you and me. It's a sort of a little prayer. Very, very softly she began to repeat. Now I sit me down to nap, all curled up in a nurse's lap. If she should die before I wake.  Ha! she mocked. You thought I was going to say if I should die before I wake, didn't you? Well, I'm not. It would have been more generous. Acknowledged the white linen nurse. Very stiffly the little girl purrised her lips. It's plenty generous enough when it's all done. She said severely. And I'll thank you, Miss Mel Gregor, not to interrupt me again. Re-excessive deliberateness, she went back to the first line of her poem and began all over again. Now I sit me down to nap. I'll curled up in a nurse's lap. If she should die before I wake. Give her. Give her ten cents for Jesus' sake. Why, that's a cunning little prayer. Yawned the white linen nurse. Most certainly, of course, she would have smiled if the yawn hadn't caught her first. But now in the middle of the yawn it was a great deal easier to repeat the very cunning than to force her lips into any new expression. Very cunning. Very cunning. She kept crooning conscientiously. Modestly, like some other successful authors, the little girl flapped her eyelids languidly open and shut for three or four times before she acknowledged the compliment. Oh, cunning as any of them! she admitted offhandishly.   Yes, a little, conceded the white linen nurse. Ha! they hurt me all the time! jibbed the little girl. Five minutes later the child who didn't particularly care about being held and the girl who didn't particularly care about holding her were fast asleep in each other's arms. A naughty nagging, restive little hornet all hushed up in a dream in the heart of a pink wild rose. Stalking out of the house in his own due time, the senior surgeon reared back aghast at the sight. Well, I'll be hanged. He muttered. Most everlasting hanged. Wonder what they think this is? A somnolent kindergarten show? Talk about fiddling while Rome burns. Awkwardly on the top step he struggled alone into his cumbersome coat. Every tingling nerve in his body, every shuddering sensibility, was wracked to its utmost capacity over the distressing scenes he had left behind him in the big house. Back in that luxuriant sick room, youth incarnate, lay stripped, root, branch, leaf, but blossom, fruit of all its manhood's promise. Back in that erudite library, culture personified, robbed of all its fine philosophy, sat babbling illiterate street curses into its quivering hands. Back in that exquisite pink and gold boudoir, blonded fashion ravished for once of all its artistry, ran stumbling round and round in interminable circles like a disheveled hag. In shrill crescendos and discordant bases, with heart-piercing jaggedness, with blood-curdling raspishness, each one, boy, father, mother, meddlesome relative, competent or incompetence-assistant, indiscriminate servant, filing his separate sorrow into the senior surgeon's tortured ears. With one of those sudden revolutions to materialism which is liable to overwhelm any man who delves too long at a time in the brutally unconventional issues of life and death, the senior surgeon stepped down into the subtle, highest-synth-scented sunshine, with every latent human greed in his body clamoring for expression, before it too should be hurtled into oblivion.  At the edge of the bottom step, a precipitous lilac branch that must have budded and bloomed in a single hour smote him stingingly across his cheek, laggard, taunted the lilac branch. With the first crunching grit of gravel under his feet, something transcendently naked and unashamed that was neither brazen sorrow nor brazen pain thrilled across his startled consciousness. Over the rolling marshy meadow, beyond the succulent willow hedge that hid the winding river, up from some fluent slim canoe, out from a chorus of viral young tenor voices, a little passionate love song, divinely tender, most incomparatively innocent, came stealing palpitantly forth into that inflammable spring world without a single vestige of accompaniment on it. Kiss me, sweet, the spring is here, and love is Lord of you and me. There's no bird in break or prayer, but to his little maid sings he. Kiss me, sweet, the spring is here, and love is Lord of you and me. Wrenched like a sob out of his own lost youth, the senior surgeon's faltering college memories took up the older frayne. As I go singing to my dear, kiss me, sweet, the spring is here, and love is Lord of you and me. Kiss me, sweet, the spring is here. Just for an instant a dozen long-forgotten pictures lanced themselves poignantly into his brain. Dingey, uncontrovertible old recitation rooms where young ideas flashed bright and futile as parade swords, elm-shaded slopes where little young bodies lulled on green velvet grasses to expound their harshest cynicisms. Book history, book science, book economics, book love, all the paper passion of all the paper poets swaggering imperiously on boyish lips that would have died a thousand bashful deaths before the threatening eminence of a real girl's kiss. Magic days when youth, the one glittering, positive treasure on the tree of life and woman still a mystery. Woman a mystery. Harshly the phrase ripped through the senior surgeon's brain. Croakingly in that instant all the grim-gray scientific years re-overtook him, swamped him, strangled him. Woman a mystery. O ye gods, and youth, bach, youth a mere tinsel on a rotten Christmas tree. Furiously, with renewed venom, he turned and threw his weight again upon the stubbornly resistant crank of his automobile. Vaguely disturbed by the noise and vibration, the white linen nurse opened her big drowsy blue eyes upon him.   Well, what about my convenience I'd like to know? snapped the senior surgeon in some astonishment.  Oh, never mind about that! she mumbled nonconcernedly. Oh, for heaven's sake, wake up there! bellowed the senior surgeon above the sudden roar of his engine. Adroitly for a man of his bulk, he ran around the radiator and jumped into his seat. Jogled unmercifully into wakefulness, the little girl greeted his return with a generous if distinctly non-tactful demonstration of affection.   Don't be foolish! snarled the senior surgeon. Who me? gasped the white linen nurse in a perfect agony of confusion. Yes, you! snapped the senior surgeon explosively half an hour later, after interminable miles of absolute silence and dingy yellow field stubble and bare brown elder bushes. Truly out of the ascetic habit of his daily life where no rain was as the Bible would put it, it did seem to him distinctly foolish not to say careless, not to say out and out incendiary for any girl to go blushing her way like a firebrand through a world so palpably populated by young men whose heads were tau and hearts indisputably tender rather than tender. Yes, you! he reasserted vehemently at the end of another silent mile. Then plainly begrudging the second inexcusable interruption of his most vital musings concerning spinal meningitis he scowled his way savagely back again into his own grimly established trend of thought. Excited by so much perfectly good silence that nobody seemed to be using, the little crippled girl ventured gallantly forth once more into the hazardous conversational land of grown-ups. Father? She experimented cautiously with most commendable discretion. Fathom's deep in abstraction the senior surgeon stared on heeding into the whizzing black road. Pulses and temperatures and blood pressures were seething in his mind and sharp sticks and jagged stones and the general possibilities of a puncture and murmurs of the heart and rallies of the lungs and the most unaccountable knock-knock-knocking in the engine and the probable relation of middle-ear disease and the perfectly positive symptoms of optic neuritis and a damned funny squeak in the steering gear. Father? The little girl persisted valiantly. To add to his original concentration the senior surgeon's linen collar began to chafe him maddeningly under his chin. The annoyance added two scowls to his already blackly furrowed face and at least ten miles an hour to his running time but nothing whatsoever to his conversational ability. Father? The little girl whimpered with faltering courage. Then panic stricken as wiser people have been before her over the dreadful, spookish remoteness of a perfectly normal human being who refuses either to answer or even to notice your wildest efforts at communication. She raised her waspish voice in its shrillest, harshest war cry. Fat Father! Fat Father! Fat Father! She screeched out friends idly at the top of her lungs. The gunshot agony of a wounded rabbit was in the cry, the last gurgling gasp of strangulation under a murderer's reeking fingers, catastrophe unspeakable, disaster now irrevocable. Clamping down his brakes with a wrench that almost tore the insides out of his engine, the senior surgeon brought the great car to a staggering standstill. What is it? he cried in real terror. What is it? Limply the little girl stretched down from the white linen nurse's lap till she could nick her toe against the shiniest woodwork in sight. Altogether aimlessly her small chin began to burrow deeper and deeper into her big fur collar. For heaven's sake, what do you want? demanded the senior surgeon. Even yet along his spine the little nerves crinkled with shock and apprehension. For heaven's sake, what do you want? Helplessly the child lifted her turbid eyes to his. With unmistakable appeal her tiny hand went clutching out at one of the big buttons on his coat. Desperately, for an instant, she rummaged through her brain for some remotely adequate answer to this most thunderous question and then retreated precipitously as usual to the sacristy of her own imagination. All the birds were there, father. She confided guilessly. All the birds were there, with yellow feathers instead of hair and bumblebees crocheted on the trees. And short of complete annihilation there was no satisfying vengeance whatsoever, that the senior surgeon's exploding passion could rack upon his offspring. Complete annihilation, being unfeasible at the moment, he merely climbed laboriously out of the car, recranked the engine, climbed laboriously back into his place, and started on his way once more. All the red blustering rage was stripped completely from him. Startlingly rigid, startlingly white, his face was like the death mask of a pirate. Pleasantly excited by she didn't know exactly what, the little girl resumed her beloved falsetto chant, rhythmically all the while with her puny, iron-braced legs beating the tune into the white linen nurse's tender flesh. All the birds were there, with yellow feathers instead of hair, and bumblebees crocheted on the trees, and all the birds were there, with yellow feathers instead of hair, and— Friendsedly, as a runaway horse trying to escape from its own pursuing harness and carriage, the senior surgeon poured increasing speed into both his own pace and the pace of his tormentor. Up hill, down dale, screeching through rocky echoes, swishing through blue-green spruce lands, dodging indomitable boulders, grazing lax, treacherous embankments, the great car scuttled homeward. Huddled behind his steering wheel like a warrior behind his shield, everybody muscle-taught with strain, every facial muscle diabolically calm, the senior surgeon met and paired successively each fresh onslaught of yard-rod-mile. Then suddenly, in the first precipitous descent of a mighty hill, the whole earth seemed to drop out from under the car. Down, down, down, with incredible swiftness and smoothness, the great machine went diving towards abysmal space. Up, up, up, with incredible bumps and bouncings, trees, bushes, stone walls went rushing to the sky. Gasping surprisingly towards the senior surgeon, the white linen nurse saw his green mouth yank around abruptly in her direction, as it yanked sometimes in the operating room with some sharp incisive order of life or death. Instinctively, she leaned forward for the message. Not over-loud, but strangely distinct, the words slapped back into her straining ears. If it will rest your face any to look scared by all means do so, I've lost control of the machine! called the senior surgeon sardonyically across the roar of the wind. The phrase excited the white linen nurse, but it did not remotely frighten her. She was not in the habit of seeing the senior surgeon lose control of any situation. Merely intoxicated with speed, delirious with ozone, she snatched up the little girl close to her breast. We're flying! she cried. We're dropping from a parachute! We're— Swoopingly, like a sled-striking glare, level eyes, the great cars were from the bottom of the hill into a soft rolling meadow. Instantly, from every conceivable direction, like foes in ambush, trees, stumps, rocks reared up in threatening defiance. Tighter and tighter, the white linen nurse crushed the little girl to her breast. Louder and louder, she called in the little girl's ear. Scream! she shouted. There might be a bump! Scream louder than a bump! Scream! Scream! Scream! That first overwhelming, nerve-numbing, hard-crunching terror of his whole life as the great car tilted up against a stone, plowed down into the mushy edge of a marsh, and skitted completely round, a crash bang into a tree. It was the last sound that the senior surgeon heard—the sound of a woman and child screeching their lungs out in diapolical exultancy. End of Chapter 4 Chapter 5 Of The White Linen Nurse This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox.org The White Linen Nurse by Illinois Hallowell Abbott Chapter 5 When the White Linen Nurse found anything again, she found herself lying perfectly flat on her back, in a reasonably comfortable nest of grass and leaves. Staring inquisitively up into the sky, she thought she noticed a slight black and blue discoloration towards the west, but more than that, much to her relief, the firmament did not seem to be seriously injured. The earth she feared had not escaped so easily. Even way off somewhere near the tip of her fingers, the ground was as sore, as sore as could be under her touch. Impulsively, to her dizzy eyes the hot tear started to think that now, tired as she was, she should have to jump right up in another minute or two and attend to the poor earth. Fortunately for any really strenuous emergency that might arise, there seemed to be nothing about her own body that hurt at all, except a queer, persistent little pain in her cheek.  Wake up! Wake up! scolded the little crippled girl shrielly. Naughty, pink and white nursey, I want to hear the bump! You screamed so loud I couldn't hear the bump! With excessive caution the white linen nurse struggled up at last to a sitting posture and gazed perplexedly around her. It seemed to be a perfectly pleasant field, acres and acres of mild old grass, tottering, pulsedly down to watch some skittish young violets and bluets frolic in and out of a giggling brook. Up the field! Up the field!  Up the field, just beyond them, the great empty automobile stood amably at rest. From the general appearance of the stone wall at the top of the little grassy slope, it was palpably evident that the car had attempted certain vain acrobatic feats before its failing momentum had forced it into the humiliating ranks of the backsliders.  Under the torn twisted sable cap, one little eye was hidden completely, but the other eye loomed up rakeish and bruised as a prize fighters. One sable sleeve was wrenched disastrously from its armhole, and along the edge of the vivid little purple skirt the ill-favored white ruffles seemed to have ravelled out into hopeless yards and yards and yards of hamburger embroidery. A trifle self-consciously, the little girl began to gather herself together. We seemed to have fallen out of something. She confided with the air of one who halves a most precious secret. Yes, I know, said the white linen nurse. But what has become of your father? Warrantly, for an instant, the little girl set scanning the remotest corners of the field. Then abruptly, with a gasp of real relief, she began to explore with cautious fingers the geographical outline of her black eye. I'll never mind about father, she asserted cheerfully. I guess, I guess he got mad and went home. Yes, I know, mused the white linen nurse, but it doesn't seem probable. Probable? mocked the little girl most disagreeably. Then suddenly, her little hand went shooting out towards the stranded automobile. Why, there he is! She screamed. Under the car! Oh, look! Look! Lucky! Laboriously, the white linen nurse scrambled her knees. Desperately, she tried to ram her fingers like a clog into the whirling dissonance around her temples. Oh, my God! Oh, my God! What's the dose for anybody under a car? She babbled idiotically. Then, with a really herculean effort, both mental and physical, she staggered to her feet and started for the automobile. But her knees gave out, and wilting down to the grass, she tried to crawl along on all fours, till straining wrists sent her back to her feet again. Whenever she tried to walk, the little girl walked. Whenever she tried to crawl, the little girl crawled. Isn't it fun? The shrill, childish voice piped persistently. Isn't it just like playing shipwreck? When they reached the car, both women and child were too utterly exhausted with breathlessness to do anything except just sit down on the ground and stare. Sure enough, under that monstrous, immovable-looking machine, the senior surgeon's body lay rammed face down deep, deep into the grass. It was the little girl who recovered her breath first. I think he's dead. She volunteered, sagely. His legs look awfully dead to me. Only excitement was in the statement. It took a second or two for her little mind to make any particularly personal application of such excitement. I hadn't exactly planned on having him dead! She began with imperious resentment.  I won't have him dead! I won't! I won't! She screamed out stormily. In the amazing silence that ensued, the white linen nurse gathered her trembling knees up into the circle of her arms and sat there staring at the senior surgeon's prostrate body and rocking herself feebly to and fro in a futile effort to collect her scattered senses. Oh, if someone would only tell me what to do! I know I could do it! Oh, I know I could do it! If someone would only tell me what to do! She kept repeating helplessly. Cautiously the little girl crapped forward on her hands and knees to the edge of the car and peered speculatively through the great yellow wheel spokes. Father! She faltered in almost inaudible gentleness. Father! She pleaded in perfectly impotent whisper. Impetuously the white linen nurse scrambled on her own hands and knees and jostled the little girl aside.  Fat Father! Fat Father! Fat Father! She jibed and taunted with the one call she knew that had never yet failed to rouse him. Perceptibly across the senior surgeon's horridly quiet shoulders a little twitch wrinkled and was gone. Oh, his heart! gasped the white linen nurse. I must find his heart! Throwing herself prone upon the cool meadowy ground and frantically reaching out under the running board of the car to her full arms length, she began to rummage awkwardly hither and yon beneath the heavy weight of the man in the desperate hope of feeling a heartbeat. Ouch! You tickle me! spluttered the senior surgeon weakly. Rolling back quickly with frightened relief the white linen nurse burst forth into one maddening cackle of hysterical laughter. She giggled.   Very laboriously, very painstakingly, he spat out one by one two stones in a wisp of ground pine and a brackish prickly tickle of stale golden rod. Blankety blank blank blank. He announced in due time, blankety blank blank blank blank.


Hi, I'm Maureen Feynman and I'm Heather McKeown-Droon and this week we're going to be talking about igneous rocks of a few different types, specifically basalt, diorite, and porphyry. So up until this point in class we've been talking about minerals most of the time. Mineral such as this crystal of quartz here has a five-part definition. It is a homogeneous inorganic solid with a definite chemical composition and a defined crystalline structure. And those are the things that make a mineral a mineral. A rock on the other hand is an assemblage of minerals. So it has all of the definition of a mineral, but it is made up of more than one grain. And although it is possible to have a mono-mineralic rock that is made up of all one type of grain, it is more common to have rocks that are made up of multiple different types of minerals altogether. So for example, the basalt that you see here, this is an example of a basalt that was erupted under water or ice in Iceland. It has a little bit of a glassy top to it. This basalt is made up of the minerals olivine, pyroxene, and plagioclase. And in some cases might even have a tiny bit of quartz in it as well. So we move now into looking at these rocks, these assemblages of minerals. And in particular the rocks that we're going to be looking at in this module are igneous rocks. Igneous rocks are rocks that form by crystallizing from a liquid magma. So we take a rock from the interior of the earth, melt it to form a molten liquid magma.  And in either case, over time it crystallizes to form different minerals and becomes a solid igneous rock. You can see quite clearly when you look at the texture of this Pohoihoi sample here, this is a type of basalt, similar in composition to this one. But you can really see the textures of the liquid flowing lava that formed this particular rock here. We call this sometimes a ropey basalt for the texture that it takes on as it flows and wrinkles up. These are both volcanic rocks that cooled very quickly at the surface. In contrast, diorites are rocks that cool very slowly over time. And that slower cooling underneath the surface of the earth allows larger mineral grains to grow. So you get some larger crystals forming that you can see with the naked eye, as opposed to the microscopic minerals in the basalt. And in some cases, you get a combination of the two. So this is a porphyritic rock. This rock has some large crystals of feldspar in it. And then those are held together in a fine grained matrix of smaller crystals. These rocks are very hard, which leads to some of the ways that they are used in an architecture through history. So as we'll find in art history, what makes these particular igneous rocks important is their hardness and their permanence. For something like basalt, one of the first types of uses that we have for it is exactly what's expressed in this little souvenir model I have from Mayen, Germany. And that is that these were used as grinding wheels for grain mills. And such grinding wheels were used way back into the Neolithic period by many groups of peoples. And even today, if you buy yourself certain types of food grinders or mortars and pestles like the traditional Mexican mocajete, the mocajetes tend to be made out of basalt. So you might even have had some guacamole made with such mocajete. So this is a very utilitarian type of rock. It was also because it has a tendency sometimes to form into these great pillars of rock, particularly favored for large-scale monuments that were intended to be permanent in the ancient world. And you might be familiar with the Law Code of Hammurabi, which is something that we'll discuss in our case studies. That's made from a basalt pillar. Similarly, the hardness and permanence of diorite were incredibly important in the ancient world and even later. And we also have both hardness in porphyry. And in this particular variety of porphyry, which is purple, we have a color that has a very symbolic meaning to it. And this was also quite rare. This was only found in one quarry in Egypt in the ancient world. So we'll be talking about that.