...
This week I published a break down of the events surrounding the pre-auth bug in Screen Sharing and explore detection opportunities for the available PoCs. Check it out! https://www.huntress.com/blog/macos-screen-sharing-rce-patched
It is fair to say that one of Appleās core tenets is its commitment to user privacy. The term appears 123 times in the Apple Platform Security Guide . Privacy. That's Apple. What this means for the regular macOS user is that they can expect to rest assured that their documents, iCloud files, Notes, and iMessages are protected from prying eyes. This blog will explore what happens when you test theā¦
It's not every day you get privileged access to over 25,000 globally distributed Windows devices for $10. Working with @darkrym11 is always a treat! https://www.huntress.com/blog/pups-grow-fangs
In 2023, I stumbled into OffSecās EXP-312 āmacOS Control Bypasses.ā As a blue-teamer mostly working in Windows environments, macOS felt foreign, which made it enticing. Before long, it was eating my free time. Since then, I've met a small but passionate community of researchers and even picked up a few CVEs through Appleās Security Bounty program. Iām still new to the macOS security scene, and myā¦
Shameless x-post inbound! Here's a blog that I had the pleasure of contributing to alongside the immensely talented Jai Minton ( @CyberRaiju ). Please give it a read. https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer
Endpoint Security is Apple's C API for monitoring system events. Its primary use is to allow security vendors to monitor for potentially malicious activity, but it also provides a great source of system telemetry for security researchers. ES Subsystem primer Typically, you would write a client that subscribes to specific events provided by the Endpoint Security Subsystem. These clients need to beā¦
Conducting macOS security research at scale is hard. Useful telemetry is strictly limited to entitled applications, and taking ad hoc approaches to interrogate system binaries entails disabling OS protections, which can potentially taint observable events. Background A comment from Gergely Kalman , one of the first macOS security bloggers I was ever introduced to, often comes to mind; "Do dumbā¦