← Feed

Posts

• Post #1644288

  Task Injection on macOS 🔍 Dive into how attackers can leverage Task Ports for process code injection. Learn security rules, lldb & debugserver mechanics, and some red tricks! #macOS #Cybersecurity #TaskInjection #InfoSec Enjoy & read it now here: https://afine.com/task-injection-on-macos/

• Post #1644287

  Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more: https://afine.com/slap-flop-apple-silicons-data-speculation-vulnerabilities/

• Post #1644286

  🚀 New blog post! 🚀 Deep dive into a #macOS IONVMeFamily #driver Denial of Service issue! It is not a security risk but a great case study for macOS driver analysis.🕵️‍♂️ Enjoy! #RE #Vulnerability #Research #Kernel #Fuzzing #PoC https://afine.com/case-study-analyzing-macos-ionvmefamily-driver-denial-of-service-issue/

• Post #1644285

  This is a short blog post about a cheap #redteam trick I found last year during #phishing assessments to bypass #Outlook spam filters and deliver links to malicious #ISO files. #Microsoft does not want to patch it, so it is good to be aware of it: https://afine.com/bypassing-spam-filtering-mechanism-in-outlook/ Enjoy!

• Post #1644284

  🚀 New blog post! 🚀 "A History of #NULL Pointer Dereferences on macOS." Discover how #Apple's security measures have evolved, making these vulnerabilities unexploitable on modern systems. Enjoy! #macOS #Cybersecurity #Vulnerability https://afine.com/history-of-null-pointer-dereferences-on-macos/

• Post #1644283

  How a simple #fuzzing payload bypassed entitlement check and triggered a #kernel panic on #macOS in the IOMobileFramebuffer driver. Patched in 15.4. Enjoy! https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/ #RE, #Vulnerability #Research #PoC

• Post #1644282

  Most #macOS devs often underestimate #Apple #TCC. I used to—until I wrote #malware and hit that wall. TCC is the last line protecting users even after compromise. In my latest post, I explain why vendors should care. Enjoy! https://afine.com/threat-of-tcc-bypasses-on-macos/

• Post #1644281

  Think RAM forgets? 🤔 Not always. See how secrets can leak, what mitigations exist on major OS like #macOS, #Windows, #Linux, and what devs can do: https://afine.com/when-memory-refuses-to-forget-sensitive-data-persistence-in-desktop-application/

• Post #1644280

  Thanks @8kSec for the recent #ARM64 #CTF. I wish to see Battleground continue to grow! In the blog below, I have gathered some learning resources about ARM64 that will save others' time. Additionally, you'll find a write-up about one of the challenges. https://www.patreon.com/posts/arm64-reference-134027880

• Post #1644279

  A short post about a #redteam from last year, where employees installed software from a shared SMB. It demonstrates how DLL hijacking in the Check Point SmartConsole installer (CVE-2024-24916) can be exploited for initial access on #Windows. Enjoy https://afine.com/dll-hijacking-in-check-point-smartconsole-installer-aka-cve-2024-24916/

• Post #1644278

  An example of how plaintext credentials stored in memory can pose a threat. https://afine.com/insecure-credential-storage-in-check-point-smartconsole-aka-cve-2024-24915/

• Post #1644277

  It is probably the weirdest way I've found a stack overflow #vulnerability until now (patched in 15.6). Here is a blog post for those interested in #IOKit #macOS #kernel or #Apple Silicon #Exploit Development masochist looking for a target. Enjoy! https://afine.com/a-mouse-move-that-crashed-the-system-stack-buffer-overflow-in-display-driver-on-macos/

• Post #1644276

  Microsoft Visual Studio Code has a misconfiguration in its Electron setup that enables the “RunAsNode” fuse, letting attackers bypass TCC on macOS. https://afine.com/tcc-bypass-in-microsoft-visual-studio-code-via-misconfigured-node-fuses/

• Post #1644275

  #Phrack is much older than me, it is good to see it still doing so well, and an honour to be one of its authors in the 40th anniversary edition, which is now available online: https://phrack.org/issues/72/9_md#article Thank you for what you are doing for our community. Long live the #Phrack!

• Post #1644274

  This post demonstrates how bugs aren't always what they seem, especially when working with a decompiled version of the code. Compiler optimization or decompiler artifacts can mask or "fix" high-level code issues. #Apple #macOS #iOS https://afine.com/reverse-engineering-apples-tcc-daemon-when-decompiled-code-lies/

• Post #1644273

  Short post about why you should not distribute apps with `get-task-allow` through App Store and why #Apple should improve the distribution process. https://afine.com/to-allow-or-not-to-get-task-allow-that-is-the-question/

• Post #1644272

  Since #Microsoft does not care, and the grace period is over, here is the Hardened Runtime bypass they introduced through .NET MAUI on #macOS. All applications built with it are vulnerable. The #vulnerability has existed probably since 2019. https://afine.com/breaking-hardened-runtime-the-0-day-microsoft-delivered-to-macos/

• Post #1644271

  Shout out to Xeno Kovah for @OpenSecurityTraining2 "Vulnerabilities 1001 & 1002: C-Family Software Implementation Vulnerabilities" courses. I learned a ton. Many CVE examples are available for practice with clear guidance and explanations. Highly recommend it for vulnerability hunters and devs.

• Post #1644270

  Short post about LPE and TCC Bypass on macOS through third-party apps bundled with Sparkle framework - a reminder of why XPC services should validate their clients. https://afine.com/threats-of-unvalidated-xpc-clients-on-macos/

• Post #1644269

  The blog post about how #macOS stored authentication tokens in persistent file metadata via the kMDItemWhereFroms key after download. https://afine.com/how-macos-file-metadata-exposed-authentication-tokens/