Mikko Kenttälä retweeted
Apple has pretty much admitted that TCC doesn't work: They just reduced the payouts for full TCC bypasses om macOS by 83.6%!
Until they come to their senses or confirm whether this is here to stay I won't report any TCC bypasses and won't research it either.
🧵Apple just devalued full TCC bypasses from 30,5k to 5k. Hard to interpret this in a good way. It feels like
- we admit we can’t fix this shit and we don’t care or at least not willing to pay for it
- we don’t care about privacy
security.apple.com/bounty/ca…
Apple decided that the CVE-2022–46723 Calendar Arbitrary File Write vuln did not deserve a bounty because it only affected macOS Monterey, and Ventura was already in the beta phase and did not have this issue, even though Monterey was still the latest version in production. (1/x)
This is mentioned on current guideline: "For an issue to be eligible for an Apple Security Bounty, the issue you report must occur on the latest publicly available version (including beta versions) of iOS, iPadOS, macOS, tvOS, or watchOS with a standard configuration* .." (2/x)
This may be good to know for researchers. If you are hunting bounties, it’s not worth reporting your findings. However, if you want to do good and help over 100 million Mac users, you should report it. @Apple will fix it. (3/3)
I discovered a zero-click vulnerability in macOS Calendar that allowed attackers to add/delete files in the Calendar sandbox. This could lead to code execution and compromise iCloud Photos data. (Now fixed). More details on my blog: mikko-kenttala.medium.com/ze… #macOS #infosec
Do you need to use calendar on your daily work? Its good to remember that it may be attack vector. Stay safe!
I discovered a zero-click vulnerability in macOS Calendar that allowed attackers to add/delete files in the Calendar sandbox. This could lead to code execution and compromise iCloud Photos data. (Now fixed). More details on my blog: mikko-kenttala.medium.com/ze… #macOS #infosec
Mikko Kenttälä retweeted
Both @ccdcoe and their flagship exercise #LockedShields have grown impressively - with over 3500 participants from 41 nations, this year’s exercise is the largest to date.
Whole-of-society approach and international cooperation are a must in defending us in the cyber domain.
I am thrilled to be on stage and talk at @Disobey_fi Security Theater stage at Saturday 7pm about my most recent findings related to exploiting vulnerabilities in macOS Calendar. This will be a continuation of my last year's presentation. #InfoSec #Apple #disobey2024
Mikko Kenttälä retweeted
Thanks to marcan (social.treehouse.systems/@ma…) and @zhuowei (xitter.cf/zhuowei/status/1740504…) now we know the original purpose for this unknown hardware feature. Its MMIO debug registers for GPU L2 cache. I am really excited that we are very close to solving this mystery!
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
Operation Triangulation research by Kaspersky (@oct0xor @bzvr_ @kucher1n ) mentions that M1 chip also "has this unknown hardware feature". My colleague wondered if M1x gfx-asc behaviour doc from Asahi Linux a is related to the exploited MMIO (mis)feature? github.com/phire/m1n1/blob/g…
Many times security research is not that visually interesting. However Terminal fuzzing with ansi escape art is somewhat hypnotic. 😵💫 ( Radamsa in action) #iTerm
Mikko Kenttälä retweeted
The attack against Danish critical infrastructure, report by #SektorCERT on attacks against DK energy sector via vulnerable Zyxel firewalls, forcing operators to go in island mode operation. @MISPProject indicators published via botvrij.eu botvrij.eu/data/feed-osint/b…
One of the vulnerabilities what I found from macOS is now fixed on 14.0 Sonoma. I’ll release the details to this vuln bit later.
Late in 2020, I found a vulnerability chain from macOS where an attacker can use Alias files to cause arbitrary code execution with user privileges with one click.
This is same story what I have presented on stage before.
Here’s the story:
mikko-kenttala.medium.com/al… #infosec
Thank you @howardnoakley for your blog posts about the alias files and bookmarks. Your analysis and posts were really helpful during the research.
Go and check those E.g: eclecticlight.co/2019/01/11/…
Back to @sensorfu office after busy week. It was an honor to once again participate to the world's largest cyber defence exercise NATO @ccdcoe Locked Shields in the Finnish team and defend complex and critical IT and OT systems. Thanks to the whole team, you know who you are. 🫡
#LockedShields2023 has concluded! This year was even more competitive than previous years. As organisers, we saw a big jump in quality within the Blue Teams.
The most effective participants were the 🇸🇪-🇮🇸 joint team, followed by the 🇪🇪-🇺🇸 joint team and the 🇵🇱 team. Good job!
Mikko Kenttälä retweeted
Over 3,000 cybersecurity experts from almost 40 countries took part of the #LockedShields2023 exercise last week. After a tough competition, team Finland finished in fifth place. This year's winners came from Sweden and Iceland. Congratulations to the winners!
