Posted on 2024-09-12 in blog • Tagged with macOS, ASB, 0day, Alligatorcon, slides, talks, POSIX, filesystems, file APIs, security
For those of you who requested and/or couldn't make it, here are the slides from my Alligatorcon talk:
Gergely Kalman: The forgotten art of filesystem magic
It's a prequel to the guide, that is more dry and technical: The missing guide to the security of filesystems and file APIs …
Posted on 2024-04-12 in blog • Tagged with macOS, 0day, VPN, Windscribe
This is a writeup about a user to root privilege escalation due to a race condition in Windscribe VPN's software.
Windscribe is a smaller VPN provider, they have about 69M users according to their tweet that was published today.
They are notorious on X/Twitter for …
Posted on 2023-12-18 in blog • Tagged with router, 0day, fiberhome, embedded, iot
For those of you who are used to reading about my Apple research, this post is
going to be a change of pace. This one is about CPE (Customer Premise Equipment)
security, basically the routers your ISP gives you.
Last year I spent some time back in my home …
Posted on 2023-11-15 in blog • Tagged with macOS, ASB, tcc bypass, 0day
Wow, two blogposts in two days! Is this a new writeup schedule?
No, it's not. But, since I'm presently just ill enough to not be productive, yet well enough to write, I figured I'd chip away at my horrendous (writeup) debt while I wait for the immune fairy to arrive …
Posted on 2023-11-14 in blog • Tagged with macOS, ASB, tcc bypass, 0day
Since I owe you guys a bunch of writeups from my talk ( Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS), I decided that I'll tackle lateralus today.
It's a simple, clean bug with a quick and satisfying resolution. I have been bitching about Apple in the past blogpost (and on twitter …
Posted on 2023-10-30 in blog • Tagged with macOS, ASB, LPE, 0day
UPDATE:
A couple hours after publication the Apple Security Changelogs were updated across the board, and they added me to CVE-2022-26704. I knew this was in the works, but it's still good to see. Thank you :)
This post is a writeup of batsignal, a macOS local privilege escalation bug from …
Posted on 2023-10-15 in blog • Tagged with macOS, ASB, 0day, OBTS, talks
For those that missed the OBTS v6 conference and live stream, here are the slides of my talk:
Gergely Kalman: Unexpected Unreasonable Unfixable
There should be a video of the talk coming out on the official OBTS youtube channel as well.
As for me, I will publish a writeup for …
Posted on 2023-09-27 in blog • Tagged with macOS, ASB, tcc bypass, 0day
This post is a writeup of CVE-2023-38571, a macOS TCC bypass bug I found. It was supposed to be unveiled in my upcoming talk:
"Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS" at OBTS v6,
but I needed to cut some bugs out. This is another one of them.
While …
Posted on 2023-09-26 in blog • Tagged with macOS, ASB, sbx, 0day
This post is a writeup of CVE-2023-32364, a macOS application sandbox escape bug I found. It was supposed to be unveiled in my upcoming talk:
"Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS" at OBTS v6,
but I needed to cut some bugs out. This is one of them.