MacOS bug bounty

Posted by Samuel Groß, Project Zero Introduction This is the first blog post in a three-part series that will detail how a vulnerability...

TL;DR Find out how a vulnerability in macOS Finder system allows remote attackers to trick users into running arbitrary commands. Vulnerability Summary A […]

TL;DR We could mount the entire file system through APFS snapshots as read-only, with the noowners flag, which enables us accessing (almost) every file in the file system, including data (documents, files, etc…) of every user on the system, including those protected by Apple’s privacy framework (TCC). Even with the Guest account we could read files of admin accounts as Guest! 😱 This could be achieved with a single command, for example: mount_apfs -o noowners -s http://com.

macos/ios exploit writeup. Contribute to houjingyi233/macOS-iOS-system-security development by creating an account on GitHub.

This post will briefly discuss how a bug that I uncovered in macOS Catalina 10.15 (specifically tested on 10.15.7) and in macOS Big Sur…

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the…

Zero-day exploits TCC protection by allowing XCSSET malware to bypass user authorization through piggy-backing from previously approved applications.

Back in the beginning of November, Project Zero announced that Apple has patched a full chain of vulnerabilities that were actively exploited in the wild. This chain consists in 3 vulnerabilities: a u

Two weeks ago, CVE-2021-1782 was fixed by Apple.

Usually we don't do blog posts about CTF challenges but we recently stumbled across a challenge that was a good opportunity to talk about several macOS/iOS internals, security mechanisms and exploit m

Author: Zhipeng Huo(@R3dF09) of Tencent Security Xuanwu Lab 0x0 IntroductionIn this blog, I will detail an interesting logic vulnerability I found in launchd process when it is managing the XPC Servic

CVE-2019-8761 is an interesting macOS bug I found that lets attackers execute HTML within a TXT file, leak files, and do all sorts of other funky things when a TXT file is opened.

In this post we will examine a vulnerability in the WebAssembly subsystem of JavaScriptCore, the JavaScript engine used in WebKit and Apple Safari. The issue...

Introduction This vulnerability has been disclosed during my & Csaba’s talk “20+ ways to bypass macOS your privacy mechanisms” during Black Hat USA. It was a part of my COVID-19 lockdown research. 😉 In the end this vulnerability led to full TCC bypass as I was able to fully control the TCC database. How I found this vulnerability After the XPC research, I had an idea to verify if it will be possible to use the same tricks but on the macOS processes.

Apple recently fixed three vulnerabilities in macOS 11.3’s Preferences. Here we present our writeup about how we identified one of the issues, and how we exploited it.

We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.

As well known, iOS14.8 patched two 0 days in the wild, one of which is the pegasus 0-click vulnerability. You can get the root cause and more interesting findings by reading my analysis from here.

Contribute to theevilbit/exploits development by creating an account on GitHub.

My team and I posted the details of the brand new Mac Malware XCSSET last year [1] [2], and disclosed the interesting 0 day tricks used inside. All the XCSSET payload modules were reviewed carefully. However, I was a newbie for hunting macOS vulnerability and I didn’t realize the TCC bypass is a vulnerability at that time until Jamf posted their new blog and detailed the 3rd 0 day used by XCSSET.

the flaw and fix of a zero-click vulnerability, exploited in the wild https://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html

https://github.com/saaramar/IOMobileFrameBuffer_LPE_POC

Random Security Research

Welcome to my blog where I describe found in free time vulnerabilities, and other worth writing IT security things.

Reverse engineering and debugging.