Karol Mazurek

The blog post about how #macOS stored authentication tokens in persistent file metadata via the kMDItemWhereFroms key after download.

https://afine.com/how-macos-file-metadata-exposed-authentication-tokens/

Short post about LPE and TCC Bypass on macOS through third-party apps bundled with Sparkle framework - a reminder of why XPC services should validate their clients.

https://afine.com/threats-of-unvalidated-xpc-clients-on-macos/

Shout out to Xeno Kovah for @OpenSecurityTraining2@infosec.exchange "Vulnerabilities 1001 & 1002: C-Family Software Implementation Vulnerabilities" courses. I learned a ton. Many CVE examples are available for practice with clear guidance and explanations. Highly recommend it for vulnerability hunters and devs.

Since #Microsoft does not care, and the grace period is over, here is the Hardened Runtime bypass they introduced through .NET MAUI on #macOS. All applications built with it are vulnerable. The #vulnerability has existed probably since 2019.

https://afine.com/breaking-hardened-runtime-the-0-day-microsoft-delivered-to-macos/

Short post about why you should not distribute apps with `get-task-allow` through App Store and why #Apple should improve the distribution process.

https://afine.com/to-allow-or-not-to-get-task-allow-that-is-the-question/

This post demonstrates how bugs aren't always what they seem, especially when working with a decompiled version of the code. Compiler optimization or decompiler artifacts can mask or "fix" high-level code issues. #Apple #macOS #iOS

https://afine.com/reverse-engineering-apples-tcc-daemon-when-decompiled-code-lies/

#Phrack is much older than me, it is good to see it still doing so well, and an honour to be one of its authors in the 40th anniversary edition, which is now available online: https://phrack.org/issues/72/9_md#article

Thank you for what you are doing for our community. Long live the #Phrack!

Microsoft Visual Studio Code has a misconfiguration in its Electron setup that enables the “RunAsNode” fuse, letting attackers bypass TCC on macOS.

https://afine.com/tcc-bypass-in-microsoft-visual-studio-code-via-misconfigured-node-fuses/

It is probably the weirdest way I've found a stack overflow #vulnerability until now (patched in 15.6). Here is a blog post for those interested in #IOKit #macOS #kernel or #Apple Silicon #Exploit Development masochist looking for a target. Enjoy!
https://afine.com/a-mouse-move-that-crashed-the-system-stack-buffer-overflow-in-display-driver-on-macos/

An example of how plaintext credentials stored in memory can pose a threat.

https://afine.com/insecure-credential-storage-in-check-point-smartconsole-aka-cve-2024-24915/

A short post about a #redteam from last year, where employees installed software from a shared SMB. It demonstrates how DLL hijacking in the Check Point SmartConsole installer (CVE-2024-24916) can be exploited for initial access on #Windows. Enjoy

https://afine.com/dll-hijacking-in-check-point-smartconsole-installer-aka-cve-2024-24916/

Thanks
@8kSec@infosec.exchange
for the recent #ARM64 #CTF. I wish to see Battleground continue to grow! In the blog below, I have gathered some learning resources about ARM64 that will save others' time. Additionally, you'll find a write-up about one of the challenges.

https://www.patreon.com/posts/arm64-reference-134027880

Think RAM forgets? 🤔 Not always. See how secrets can leak, what mitigations exist on major OS like #macOS, #Windows, #Linux, and what devs can do:

https://afine.com/when-memory-refuses-to-forget-sensitive-data-persistence-in-desktop-application/

Most #macOS devs often underestimate #Apple #TCC. I used to—until I wrote #malware and hit that wall. TCC is the last line protecting users even after compromise. In my latest post, I explain why vendors should care. Enjoy!

https://afine.com/threat-of-tcc-bypasses-on-macos/

How a simple #fuzzing payload bypassed entitlement check and triggered a #kernel panic on #macOS in the IOMobileFramebuffer driver. Patched in 15.4. Enjoy!

https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/

#RE, #Vulnerability #Research #PoC

🚀 New blog post! 🚀

"A History of #NULL Pointer Dereferences on macOS." Discover how #Apple's security measures have evolved, making these vulnerabilities unexploitable on modern systems.

Enjoy!
#macOS #Cybersecurity #Vulnerability

https://afine.com/history-of-null-pointer-dereferences-on-macos/

This is a short blog post about a cheap #redteam trick I found last year during #phishing assessments to bypass #Outlook spam filters and deliver links to malicious #ISO files. #Microsoft does not want to patch it, so it is good to be aware of it:
https://afine.com/bypassing-spam-filtering-mechanism-in-outlook/
Enjoy!

🚀 New blog post! 🚀

Deep dive into a #macOS IONVMeFamily #driver Denial of Service issue! It is not a security risk but a great case study for macOS driver analysis.🕵️‍♂️

Enjoy!
#RE #Vulnerability #Research #Kernel #Fuzzing #PoC

https://afine.com/case-study-analyzing-macos-ionvmefamily-driver-denial-of-service-issue/

Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more:

https://afine.com/slap-flop-apple-silicons-data-speculation-vulnerabilities/

Task Injection on macOS
🔍 Dive into how attackers can leverage Task Ports for process code injection. Learn security rules, lldb & debugserver mechanics, and some red tricks!
#macOS #Cybersecurity #TaskInjection #InfoSec

Enjoy & read it now here:
https://afine.com/task-injection-on-macos/