I hack things
JBO reached out to me, and as it turns out we have collided on the bug I was about to publish, so I won't be doing that until this is cleared up. Instead of that, I will post about a few other things that were already fixed by Apple. The …
UPDATE: JBO reached out to me, and as it turns out we have collided on the bug I was about to publish, so I won't be doing that until this is cleared up. However, I will publish about some others bugs, so stay tuned. Introduction I really meant to write …
While researching the filesystem training I came across a particularly bad example I have given in my talks and slides about how rename() works, and I felt it's prudent that I own up to this mistake and publish the correction. TL;DR: My provided example of rename("./a", "./b") is …
I recently realised that I still owe you guys some writeups, so since OBTSv7 is around the corner here's the one for badmalloc. I found this back in March 2023, and it got fixed in October. About the bug There's a bug in MallocStackLogging , Apple's "magical" framework that allows developers …
TL;DR: Github repo: https://github.com/gergelykalman/fs_usage_ng About Since Apple's built-in fs_usage is amazing but occasionally falls short, I decided to take it upon myself to improve it. Since I suck at coming up with names, I used the old-school Open Source default: fs_usage_ng The ng stands for …
For those of you who requested and/or couldn't make it, here are the slides from my Alligatorcon talk: Gergely Kalman: The forgotten art of filesystem magic It's a prequel to the guide, that is more dry and technical: The missing guide to the security of filesystems and file APIs …
These are the technical slides that I always have to cut from my presentations. I try to sprinkle them in, but it’s just always too much. So I decided that it’s big enough to be it’s own thing: The missing guide to the security of filesystems and …
Intro This is a writeup about a user to root privilege escalation due to a race condition in Windscribe VPN's software. What is Windscribe? Windscribe is a smaller VPN provider, they have about 69M users according to their tweet that was published today. They are notorious on X/Twitter for …
For those of you who are used to reading about my Apple research, this post is going to be a change of pace. This one is about CPE (Customer Premise Equipment) security, basically the routers your ISP gives you. Background Last year I spent some time back in my home …
I forgot to post about my talk here, so here it is for those who missed my tweet: Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS by Gergely Kalman
Wow, two blogposts in two days! Is this a new writeup schedule? No, it's not. But, since I'm presently just ill enough to not be productive, yet well enough to write, I figured I'd chip away at my horrendous (writeup) debt while I wait for the immune fairy to arrive …
Since I owe you guys a bunch of writeups from my talk ( Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS ), I decided that I'll tackle lateralus today. It's a simple, clean bug with a quick and satisfying resolution. I have been bitching about Apple in the past blogpost (and on twitter …
UPDATE: A couple hours after publication the Apple Security Changelogs were updated across the board, and they added me to CVE-2022-26704 . I knew this was in the works, but it's still good to see. Thank you :) This post is a writeup of batsignal, a macOS local privilege escalation bug from …
For those that missed the OBTS v6 conference and live stream, here are the slides of my talk: Gergely Kalman: Unexpected Unreasonable Unfixable There should be a video of the talk coming out on the official OBTS youtube channel as well. As for me, I will publish a writeup for …
This post is a writeup of CVE-2023-38571, a macOS TCC bypass bug I found. It was supposed to be unveiled in my upcoming talk: "Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS" at OBTS v6 , but I needed to cut some bugs out. This is another one of them. Background While …
This post is a writeup of CVE-2023-32364, a macOS application sandbox escape bug I found. It was supposed to be unveiled in my upcoming talk: "Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS" at OBTS v6 , but I needed to cut some bugs out. This is one of them. macOS Sandboxing …