← Feed

Posts

• View post

  Task Injection on macOS 🔍 Dive into how attackers can leverage Task Ports for process code injection. Learn security rules, lldb & debugserver mechanics, and some red tricks! #macOS #Cybersecurity #TaskInjection #InfoSec Enjoy & read it now here: https://afine.com/task-injection-on-macos/

• View post

  Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more: https://afine.com/slap-flop-apple-silicons-data-speculation-vulnerabilities/

• View post

  This is a short blog post about a cheap #redteam trick I found last year during #phishing assessments to bypass #Outlook spam filters and deliver links to malicious #ISO files. #Microsoft does not want to patch it, so it is good to be aware of it: https://afine.com/bypassing-spam-filtering-mechanism-in-outlook/ Enjoy!

• View post

  🚀 New blog post! 🚀 "A History of #NULL Pointer Dereferences on macOS." Discover how #Apple's security measures have evolved, making these vulnerabilities unexploitable on modern systems. Enjoy! #macOS #Cybersecurity #Vulnerability https://afine.com/history-of-null-pointer-dereferences-on-macos/

• View post

  How a simple #fuzzing payload bypassed entitlement check and triggered a #kernel panic on #macOS in the IOMobileFramebuffer driver. Patched in 15.4. Enjoy! https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/ #RE, #Vulnerability #Research #PoC

• View post

  Most #macOS devs often underestimate #Apple #TCC. I used to—until I wrote #malware and hit that wall. TCC is the last line protecting users even after compromise. In my latest post, I explain why vendors should care. Enjoy! https://afine.com/threat-of-tcc-bypasses-on-macos/

• View post

  Think RAM forgets? 🤔 Not always. See how secrets can leak, what mitigations exist on major OS like #macOS, #Windows, #Linux, and what devs can do: https://afine.com/when-memory-refuses-to-forget-sensitive-data-persistence-in-desktop-application/

• View post

  Thanks @8kSec for the recent #ARM64 #CTF. I wish to see Battleground continue to grow! In the blog below, I have gathered some learning resources about ARM64 that will save others' time. Additionally, you'll find a write-up about one of the challenges. https://www.patreon.com/posts/arm64-reference-134027880

• View post

  A short post about a #redteam from last year, where employees installed software from a shared SMB. It demonstrates how DLL hijacking in the Check Point SmartConsole installer (CVE-2024-24916) can be exploited for initial access on #Windows. Enjoy https://afine.com/dll-hijacking-in-check-point-smartconsole-installer-aka-cve-2024-24916/

• View post

  An example of how plaintext credentials stored in memory can pose a threat. https://afine.com/insecure-credential-storage-in-check-point-smartconsole-aka-cve-2024-24915/

• View post

  It is probably the weirdest way I've found a stack overflow #vulnerability until now (patched in 15.6). Here is a blog post for those interested in #IOKit #macOS #kernel or #Apple Silicon #Exploit Development masochist looking for a target. Enjoy! https://afine.com/a-mouse-move-that-crashed-the-system-stack-buffer-overflow-in-display-driver-on-macos/

• View post

  Microsoft Visual Studio Code has a misconfiguration in its Electron setup that enables the “RunAsNode” fuse, letting attackers bypass TCC on macOS. https://afine.com/tcc-bypass-in-microsoft-visual-studio-code-via-misconfigured-node-fuses/

• View post

  This post demonstrates how bugs aren't always what they seem, especially when working with a decompiled version of the code. Compiler optimization or decompiler artifacts can mask or "fix" high-level code issues. #Apple #macOS #iOS https://afine.com/reverse-engineering-apples-tcc-daemon-when-decompiled-code-lies/

• View post

  Short post about why you should not distribute apps with `get-task-allow` through App Store and why #Apple should improve the distribution process. https://afine.com/to-allow-or-not-to-get-task-allow-that-is-the-question/

• View post

  Since #Microsoft does not care, and the grace period is over, here is the Hardened Runtime bypass they introduced through .NET MAUI on #macOS. All applications built with it are vulnerable. The #vulnerability has existed probably since 2019. https://afine.com/breaking-hardened-runtime-the-0-day-microsoft-delivered-to-macos/

• View post

  Shout out to Xeno Kovah for @OpenSecurityTraining2 "Vulnerabilities 1001 & 1002: C-Family Software Implementation Vulnerabilities" courses. I learned a ton. Many CVE examples are available for practice with clear guidance and explanations. Highly recommend it for vulnerability hunters and devs.

• View post

  Short post about LPE and TCC Bypass on macOS through third-party apps bundled with Sparkle framework - a reminder of why XPC services should validate their clients. https://afine.com/threats-of-unvalidated-xpc-clients-on-macos/

• View post

  The blog post about how #macOS stored authentication tokens in persistent file metadata via the kMDItemWhereFroms key after download. https://afine.com/how-macos-file-metadata-exposed-authentication-tokens/