GamePlan guards Macs with Apple's Pac-Man game-logic engine

At the RSA conference in March 2019, Digita chief research officer Patrick Wardle presented GamePlan, a Mac security tool with an unlikely core: Apple's GameplayKit, the framework that powers video-game logic. 'In PacMan, by default the ghosts are hunting PacMan, so that's a rule. If PacMan eats a power pellet, the ghosts run away. That's another rule,' Wardle told WIRED. 'So we realized that Apple has done all the hard work for us. Its game-logic engine can also be used to very efficiently process events on a system and spit out a warning.'

GamePlan collects macOS's own indicators — USB insertion, screen captures, webcam access, files created by unsigned downloaded programs — into a centralized stream and lets rules evaluate them, including rules built on other rules: 'if an unsigned program persists and accesses the webcam when the user is not active, alert.' Context kills noise: files copied to USB from a developer laptop draw no alert, from an HR laptop they do; an OS component modified by Apple's updater passes, modified by an untrusted program it alerts. Rules ship in packs, and users can write their own.

The tool errs toward false positives rather than false negatives and only notifies rather than acts. Blake Darché, CSO of Area 1 Security, which was running GamePlan on almost all of its company Macs, said it generates a reasonable number of notifications and is easy to tune when too verbose, and praised doing more on the Mac itself 'instead of putting all the focus on cloud and machine learning.' It also works as a compliance checker for basics like firewall and disk-encryption status.

GameplayKit already solves 'evaluate events, spin out an action' for game characters; the same rule engine can process security telemetry instead of Pac-Man ghosts.

Apple had already built a fast, general rule-evaluation engine for game behaviour; repurposing it avoided building yet another event-processing pipeline.

Rules over signatures mean the same engine can catch unknown malware by watching suspicious actions rather than matching samples.

Contextual rules — who, which machine, what state — suppress false alarms, the alert-fatigue problem that plagues monitoring.

Using the OS's own indicators keeps detection local on the Mac, with no cloud round trip.

Before building an engine, check whether the platform already ships one under a different name: game AI and event-response security are the same rule problem.

Digita planned to pre-populate rule packs for customers and write new rules as threats emerged; Wardle had already experimented with detecting 'Evil Maid' attacks from simple event information. Area 1 Security continued trialing GamePlan fleet-wide as of the March 2019 report.