Gabriele Biondo

In part 2 of my macOS security internals series, I demystify System Integrity Protection (SIP), breaking down how the kernel enforces Apple-signed entitlements over POSIX root privileges, the mechanics of rootless.conf, and why the hardware always has the final veto.

Includes a small C program to audit your own CSR bitfield configuration.

Read the full deep dive here:
https://bytearchitect.io/macos-security/Apple-defences-SIP-and-APFS-(cont'd)/

#macOS #infosec #cybersecurity #ReverseEngineering #XNU #AppleSecurity #Kernel #OSInternals #Rootless

New post on The Byte Architect:

**Apple Defences: APFS and the SSV**

Snapshots, cryptographic seals, Signed System Volume, and why on modern macOS `root` is no longer the supreme deity of the machine.

APFS is not just a filesystem. It is part of the defence model.

https://bytearchitect.io/macos-security/Apple-Defences-APFS-and-the-SSV/

Anyone with a spare lobste.rs invite? I write about macOS internals, reverse engineering, and Mach-O internals. Profile: gbiondo.one — happy to share handle via DM.

#lobsters #ReverseEngineering #macOS

New post on The Byte Architect:

**Filesystem Wars: Why Your Choice of Storage is Actually a Security Move**

This is not a “which filesystem should I use?” checklist. It is a walk through the ideas behind FFS, BFS, NTFS, ext4, ZFS, and APFS — and why storage design is never just about storage.

Crash consistency, journaling, soft updates, CoW, snapshots, encryption, space sharing: different filesystems solve different problems, and those choices shape reliability, usability, and security.

The real target, of course, is APFS.

Read it here: https://bytearchitect.io/macos-security/theory/Filesystem-Wars-Why-Your-Choice-of-Storage-is-Actually-a-Security-Move/

#macOS #Apple #APFS #ZFS #ext4 #NTFS #ReverseEngineering #InfoSec #CyberSecurity

Hardening macOS part 7: The Human Surface

You can harden the kernel and encrypt every byte, but the problem usually sits between the chair and the keyboard. In this chapter, I explore the hidden risks of metadata, the trap of social logins, and why your passphrase-less SSH keys are a standing invitation for a breach.

Read the full post here:
https://bytearchitect.io/macos-security/Hardening-macOS-part7-The-Human-Surface-and-Metadata-Risks/

#macOS #InfoSec #CyberSecurity #Metadata #SysAdmin #Privacy

Apple's documentation has a dirty secret: it explains what things are, almost never how they actually work.

I'm deciding what to write next on ByteArchitect and I want to hit the gap that hurts most.

Which one?

1. Code signing & notarization — the real mechanics
2. AppKit internals — delegates, ownership, what the docs skip
3. macOS threat detection — practical, not theoretical

Boosts appreciated. Curious what the community is missing.

#macOS #Apple #infosec #reverseengineering #AppKit #developer

Reverse Engineering or Necromancy? 🧟‍♂️⚖️

What do you do when the company goes dark, the app vanishes from the App Store, and your "smart" scale becomes a 100€ paperweight?

You reverse it.

I’m starting a new series on ByteArchitect about bringing the QardioBase2 back to life. No ChatGPT-farts here—just raw bluetoothd logs, GATT discovery, and the sad sight of a backend that keeps saying "cancelled."

In this first part:
- Sniffing BLE traffic on iOS (without a jailbreak)
- Mapping proprietary GATT services & characteristics
- Realizing the servers are officially dead (RIP Qardio)

If you despise planned obsolescence as much as I do, join me in this "zombie" recovery:

https://bytearchitect.io/security-reversing/Reverse-with-me-Qardio-necromancy/

#ReverseEngineering #Infosec #BLE #iOS #HardwareHacking #Obsolescence #CyberSecurity #GATT #Necromancy

Apparently Electric Eye made it to riskybiz. Not bad for day one.

https://news.risky.biz/risky-bulletin-gen-joshua-rudd-confirmed-as-next-cybercom-and-nsa-head/

Stop chasing blacklists. It's a losing game. I built a Rust engine
to spot AitM proxies where they bleed: in the DOM. Meet Electric Eye.

https://bytearchitect.io/network-security/Bypassing-MFA-with-Reverse-Proxies-Building-a-Rust-based-Firefox-Extension-to-Kill-AitM-Phishing/

#infosec #rust #firefox

New post: Hardening macOS pt.5 — Communications

Email clients, providers, PGP, and chat. For a Cypherpunk, talking about communications is like talking politics at the pub. I tried to be factual. Mostly succeeded.

Also: a special note for my Italian readers on PEC. With appropriate levels of contempt.

https://bytearchitect.io/macos-security/MacOS-Hardening-6-email-and-pgp/

#infosec #macOS #privacy #security #PGP #email #Signal

No Hardening macOS this week. Got distracted.

Starkiller is a new phishing kit that proxies REAL login pages in real-time. It steals credentials, MFA tokens and session cookies — and MFA won't save you.

I wrote a full technical analysis: how AitM works, why traditional defences fail, and what to actually do about it.

Also released ja3-probe, a Rust PoC for TLS fingerprinting of phishing proxies.

→ Post: https://bytearchitect.io/network-security/Starkiller-Phishing-Kit-Why-MFA-Fails-Against-Real-Time-Reverse-Proxies/?ref=mastodon
→ PoC: https://github.com/gb-at-r3/ja3Probe

#infosec #phishing #AitM #MFA #TLS #security #rust

Thanks a lot! 🙏

New post: Hardening macOS pt.4 — Secrets

Scams, Apple Keychain (the good and the ugly), the kdbx ecosystem, Strongbox, hardware security keys.

Your password is not enough. It never was.

https://bytearchitect.io/macos-security/Hardening-macOS-pt.4-Secrets-management/?utm\_source=mastodon&utm\_medium=social&utm\_campaign=hardening-pt4

#infosec #macOS #privacy #security #passwords #MFA #YubiKey