Skip to main content
CPEBuddy
When Queues Become Vulnerabilities: Reverse Engineering GCD, XPC Races, and macOS Detection

When Queues Become Vulnerabilities: Reverse Engineering GCD, XPC Races, and macOS Detection

Source: YouTube · Black Hat · published Aug 7, 2026 · 30:46

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Olivia Gallucci from Datadog explores how to detect race conditions on macOS, specifically examining how the misuse of Grand Central Dispatch (GCD) can lead to security failures in privileged system services 0:11.

Key Takeaways:
• The presentation focuses on the intersection of macOS concurrency mechanisms and vulnerabilities within privileged services 0:18.
• Foundational OS concepts such as processes, concurrency, interleavings, and parallelism are introduced to establish a baseline for understanding race conditions 0:30.
• A process acts as a container for system resources—like virtual memory and descriptors—rather than serving as the runnable entity itself 0:44.
• It is critical to distinguish that a process represents an instance of a running executable, but it is not the actual executing code 0:55.

By establishing a clear understanding of these fundamental operating system concepts, the talk sets the stage for identifying and exploiting race conditions that stem from improper GCD usage.

Sources:

  • 0:11 Speaker introduction and core topic
  • 0:18 GCD misuse leading to privileged service failures
  • 0:30 Overview of concurrency and parallelism concepts
  • 0:44 Process definition as a resource container
  • 0:55 Distinction between a process and executing code

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Awesome. So, hi everyone. My name is Olivia Gallucci and I work at Datadog. Today, I will be discussing how to detect race conditions on macOS focusing on how GCD and its misuse can lead to failures in privileged system services. So, yeah. Before we dive into the talk, I want to cover processes, concurrency, interleavings, and parallelism. Starting with a quote from Jonathan Levin, the concept of a process is inherent to all modern operating systems. A process corresponds to an instance of a running executable. Processes are used by the system as containers for resources like virtual memory and descriptors and for maintaining execution statistics. It's important to note that processes are not runnable entities. A process corresponds to an instance of a running executable, but it's not the …