Found 70 bookmarks
Custom sorting
smith (CVE-2023-32434)
smith (CVE-2023-32434)
This write-up presents an exploit for a vulnerability in the XNU kernel: Assigned CVE-2023-32434. Fixed in iOS 16.5.1 and macOS 13.4.1. Reachable from the WebContent sandbox and might have been actively exploited. *Note that this CVE fixed multiple integer overflows, so it is unclear whether or not the integer overflow used in my exploit was also used in-the-wild. Moreover, if it was, it might not have been exploited in the same way. The exploit has been successfully tested on: iOS 16.3, 16.3.1, 16.4 and 16.5 (iPhone 14 Pro Max) macOS 13.1 and 13.4 (MacBook Air M2 2022) All code snippets shown below are from xnu-8792.81.2.
#Poulin-Bélanger#EN#2023#exploit#analysis#vulnerability#github#macos#ios#CVE-2023-32434
·github.com·
smith (CVE-2023-32434)
Analysis of a new macOS Trojan-Proxy
Analysis of a new macOS Trojan-Proxy
A new macOS Trojan-Proxy is riding on cracked versions of legitimate software; it relies on DNS-over-HTTPS to obtain a C&C (command and control) address. Illegally distributed software historically has served as a way to sneak malware onto victims’ devices. Oftentimes, users are not willing to pay for software tools they need, so they go searching the Web for a “free lunch”. They are an excellent target for cybercriminals who realize that an individual looking for a cracked app will be willing to download an installer from a questionable website and disable security on their machine, and so they will be fairly easy to trick into installing malware as well.
#securelist#EN#2023#MacOS#Trojan#Malware#Trojan-Proxy#Descriptions#Technologies#Piracy#Apple
·securelist.com·
Analysis of a new macOS Trojan-Proxy
New macOS 'KandyKorn' malware targets cryptocurrency engineers
New macOS 'KandyKorn' malware targets cryptocurrency engineers
A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform. The attackers impersonate members of the cryptocurrency community on Discord channels to spread Python-based modules that trigger a multi-stage KandyKorn infection chain. Elastic Security discovered and attributed the attacks to Lazarus based on overlaps with past campaigns concerning the employed techniques, network infrastructure, code-signing certificates, and custom Lazarus detection rules.
#bleepingcomputer#EN#2023#macOS#Lazarus#Discord#Python-based#cryptocurrency#engineers#Targeted
·bleepingcomputer.com·
New macOS 'KandyKorn' malware targets cryptocurrency engineers
iLeakage
iLeakage
We present iLeakage, a transient execution side channel targeting the Safari web browser present on Macs, iPads and iPhones. iLeakage shows that the Spectre attack is still relevant and exploitable, even after nearly 6 years of effort to mitigate it since its discovery. We show how an attacker can induce Safari to render an arbitrary webpage, subsequently recovering sensitive information present within it using speculative execution. In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content. Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers.
#ileakage#EN#2023#macos#Safari#Side-Channel#ios#Spectre#speculative
·ileakage.com·
iLeakage
Last Week on My Mac: How quickly can Apple release a security update?
Last Week on My Mac: How quickly can Apple release a security update?
We seldom get much insight into how long Apple takes to release an urgent update to macOS, but last week must have seen one of the quickest in recent times. By my reckoning, Apple’s engineers accomplished that in 6-10 days, across four of its operating systems, and with two distinct vulnerabilities.
#eclecticlight#EN#2023#Apple#security#update#macos#release
·eclecticlight.co·
Last Week on My Mac: How quickly can Apple release a security update?
Mac users targeted in new malvertising campaign delivering Atomic Stealer
Mac users targeted in new malvertising campaign delivering Atomic Stealer
  • Malicious ads for Google searches are targeting Mac users Phishing sites trick victims into downloading what they believe is the app they want The malware is bundled in an ad-hoc signed app so it cannot be revoked by Apple * The payload is a new version of the recent Atomic Stealer for OSX
#malwarebytes#EN#2023#macos#AtomicStealer#stealer#tradingview
·malwarebytes.com·
Mac users targeted in new malvertising campaign delivering Atomic Stealer
macOS 0day: App Management
macOS 0day: App Management
App Management is a new macOS security feature in Ventura introduced at WWDC last year: If an app is modified by something that isn't signed by the same development team and isn't allowed by an NSUpdateSecurityPolicy, macOS will block the modification and notify the user that an app wants to manage other apps. Clicking on the notification sends people to System Settings, where they can allow an app to update and modify other apps.
#lapcatsoftware#EN#2023#macOS#0-day#AppManagement
·lapcatsoftware.com·
macOS 0day: App Management
Mac systems turned into proxy exit nodes by AdLoad
Mac systems turned into proxy exit nodes by AdLoad
AdLoad malware is still infecting Mac systems years after its first appearance in 2017. AdLoad, a package bundler, has been observed delivering a wide range of payloads throughout its existence. During AT&T Alien Labs’ investigation of its most recent payload, it was discovered that the most common component dropped by AdLoad during the past year has been a proxy application turning MacOS AdLoad victims into a giant, residential proxy botnet.
#ATT#Alien#AT&T-Alien-Labs#EN#2023#macOS#AdLoad
·cybersecurity.att.com·
Mac systems turned into proxy exit nodes by AdLoad
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
Cisco Talos discovered 12 memory corruption vulnerabilities in MSRPC implementations on Apple macOS and VMWare vCenter.       - Seven vulnerabilities affect Apple macOS only.       - Two vulnerabilities affect VMWare vCenter.       - Three vulnerabilities affect both.
#talosintelligence#EN#2023#MSRPC#macOS#VMWare#vCenter#vulnerabilities
·blog.talosintelligence.com·
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation