Mikko Kenttälä

Hacking, Cyber and politics. Founder and CEO of @SensorFu. Board member: @KyberVPK / @JK_ry . InfoSec Specialist @effi_ry

[Gergely Kalman @gergely_kalman]

Apple has pretty much admitted that TCC doesn't work: They just reduced the payouts for full TCC bypasses om macOS by 83.6%!
Until they come to their senses or confirm whether this is here to stay I won't report any TCC bypasses and won't research it either.

[Mikko Kenttälä @Turmio_]

@MikaAaltola @SarasvuoJari Olin mukana Effin riveissä ottamassa kantaa tiedustelulainsäädäöntöön (myös kriittisesti) ja sanottava on kyllä, että lakihankkeelle oli todella vähän vastustusta. Jos tähän vaikuttaminen olisi ollut yksi kärkihankkeista, lienemme turvassa.

[LetsDefend @LetsDefendIO]

Cybersecurity Advice

[Mikko Kenttälä @Turmio_]

@RGB_Lights At least some of the swag is used. My go-to training socks—cool cybersocks from @certlv ’s #cyberchess

[Mikko Kenttälä @Turmio_]

This may be good to know for researchers. If you are hunting bounties, it’s not worth reporting your findings. However, if you want to do good and help over 100 million Mac users, you should report it. @Apple will fix it. (3/3)

[Mikko Kenttälä @Turmio_]

Apple decided that the CVE-2022–46723 Calendar Arbitrary File Write vuln did not deserve a bounty because it only affected macOS Monterey, and Ventura was already in the beta phase and did not have this issue, even though Monterey was still the latest version in production. (1/x)

[Mikko Kenttälä @Turmio_]

This is mentioned on current guideline: "For an issue to be eligible for an Apple Security Bounty, the issue you report must occur on the latest publicly available version (including beta versions) of iOS, iPadOS, macOS, tvOS, or watchOS with a standard configuration* .." (2/x)

[Mikko Kenttälä @Turmio_]

@gergely_kalman Thank you! 😊

[Mikko Kenttälä @Turmio_]

I discovered a zero-click vulnerability in macOS Calendar that allowed attackers to add/delete files in the Calendar sandbox. This could lead to code execution and compromise iCloud Photos data. (Now fixed). More details on my blog: https://t.co/DoTArTi4HD #macOS #infosec

[Mikko Kenttälä @Turmio_]

Sorry for the late release, and thanks to those who reminded me—it was the push I needed. :) The original plan was to release it after everything was settled with Apple regarding the bounty.

[Mikko Kenttälä @Turmio_]

Do you need to use calendar on your daily work? Its good to remember that it may be attack vector. Stay safe!

[Mikko Kenttälä @Turmio_]

I discovered a zero-click vulnerability in macOS Calendar that allowed attackers to add/delete files in the Calendar sandbox. This could lead to code execution and compromise iCloud Photos data. (Now fixed). More details on my blog: https://t.co/DoTArTi4HD #macOS #infosec

[Ambassador Jonatan Vseviov @vseviov]

Both @ccdcoe and their flagship exercise #LockedShields have grown impressively - with over 3500 participants from 41 nations, this year’s exercise is the largest to date.

Whole-of-society approach and international cooperation are a must in defending us in the cyber domain.

[Mikko Kenttälä @Turmio_]

@theevilbit Thank you! ☺️

[Mikko Kenttälä @Turmio_]

@yo_yo_yo_jbo Absolutely! We need more posts like that!

[Mikko Kenttälä @Turmio_]

I am thrilled to be on stage and talk at @Disobey_fi Security Theater stage at Saturday 7pm about my most recent findings related to exploiting vulnerabilities in macOS Calendar. This will be a continuation of my last year's presentation. #InfoSec #Apple #disobey2024

[Mikko Kenttälä @Turmio_]

@RonMasas Simple and beautiful! 👌👍

[Boris Larin @oct0xor]

Thanks to marcan (https://t.co/sDwlE7Wq6T) and @zhuowei (https://t.co/EzBvk4cNBY) now we know the original purpose for this unknown hardware feature. Its MMIO debug registers for GPU L2 cache. I am really excited that we are very close to solving this mystery!

[Mikko Kenttälä @Turmio_]

Operation Triangulation research by Kaspersky (@oct0xor @bzvr_ @kucher1n ) mentions that M1 chip also "has this unknown hardware feature". My colleague wondered if M1x gfx-asc behaviour doc from Asahi Linux a is related to the exploited MMIO (mis)feature? https://t.co/peUY94VvSI

[Mikko Kenttälä @Turmio_]

Many times security research is not that visually interesting. However Terminal fuzzing with ansi escape art is somewhat hypnotic. 😵‍💫 ( Radamsa in action) #iTerm

[Koen Van Impe ☕ @cudeso]

The attack against Danish critical infrastructure, report by #SektorCERT on attacks against DK energy sector via vulnerable Zyxel firewalls, forcing operators to go in island mode operation. @MISPProject indicators published via https://t.co/zRuayIOAcL https://t.co/CsD3SbQ5B3