BlockBlock: macOS Persistent Threat Monitoring Tool

BlockBlock is a macOS system security tool developed by Objective-See, designed to monitor and block malicious software from self-starting through persistence mechanisms. It continuously monitors common persistence locations in the system, alerting users when suspicious persistence components are detected, thus effectively preventing malware from automatically running after system restarts.

---

🛡️ Features and Advantages

1. Real-time Monitoring of Persistence Mechanisms

• Monitors Core Locations: BlockBlock continuously monitors common persistence locations in macOS, including login items, launch daemons, launch agents, cron jobs, and other points frequently exploited by malware for persistence.
• Endpoint Security Framework: Built on Apple’s official “Endpoint Security Framework,” ensuring high efficiency and system compatibility.

2. Intelligent Alerts and Responses

• Detailed Alert Information:
  • Displays the process triggering the persistence action (name, PID, path, arguments).
  • Shows modified persistence files and newly added persistence components.
  • Provides options to view code signing information, VirusTotal detection results, and process lineage.
• Flexible Response Options:
  • Allow: Trust the process and persistence item.
  • Block: Block the persistence item and remove the corresponding component from the filesystem.
  • Temporary Handling: By checking the “temporarily” checkbox, users can allow or block actions temporarily without creating long-term rules.
• Rule Scope Configuration: Users can customize rule matching scope via a dropdown menu (e.g., match only the process, persistence file, persistence item, or combinations thereof).

3. Rule Creation and Management

• Automatic Rule Generation: Rules are automatically generated based on user allow/block actions, ensuring future identical persistence attempts are handled automatically.
• Manual Rule Management: Users can view, edit, or delete existing rules through the “Rules” option in the status bar menu, enabling granular control.

4. System Integration and Logging

• System Permissions Required: Installation requires system authorization and granting “Full Disk Access” to BlockBlock in System Settings to ensure effective filesystem monitoring.
• Automatic Startup Protection: After installation, BlockBlock launches automatically at system startup to provide continuous protection.
• Detailed Logging: All alerts, responses, and actions are recorded in the /Library/Objective-See/BlockBlock/BlockBlock.log file for easy tracking and auditing.

5. Easy Installation and Uninstallation

• Simple Installation Process: Download the latest version, run “BlockBlock Installer.app,” and click “Install” to complete setup.
• Clear Uninstallation Steps: Use the “Uninstall BlockBlock” option in the status bar menu to launch the uninstaller and remove the software completely.

---

🚀 Support and Compatibility

• Supported Operating Systems: macOS 10.15 and above
• Latest Version: 2.2.5 (View changelog)
• Open Source: BlockBlock’s source code is publicly available for review and auditing, enhancing transparency and trustworthiness.

---

BlockBlock is a lightweight, professional-grade security tool specifically designed for macOS systems, ideal for users concerned about system security and aiming to prevent malware from infiltrating via persistence mechanisms. Its design based on Apple’s official security framework ensures seamless compatibility with macOS, while its intuitive interface and flexible control options make security protection both simple and efficient.