Book May 28–30 for Positive Hack Days in Moscow 🇷🇺
Cybersecurity conference, festival & community event — unlike anything you’ve been to.
CFP open: https://t.co/t0KkvwtNJa — flights + stay covered.
I’ll personally take care of you — you’ll see how we do things here at #PHDays.
I just posted the slides for today's collab stream with @CyanNyan6!!!
「I hacked macOS!!!
CVE-2022-32947
With Lina✨ & Cyan💎」
https://t.co/87UlSLuVQu
✨ Collab Announcement!!! ✨
Did... did I just hack macOS??? Join me and @CyanNyan6 to hear the story of that time I found a major security bug in macOS and got a bounty from Apple!!
🎦 https://t.co/S2A2CAI6L3
🕚 September 17th at 11:00 JST / 2:00 UTC
▶️ https://t.co/tpiMea2JXP
Continuing my sad story, another exploit I prapared for tfc got fixed today cve-2023-28218 reported by Junoh Lee
A double fetch+integer overflow can allow the size of memmove 0xffffffff. Since src is user space, it can actually copy any size
proc_entitlement_is_bool_true("https://t.co/lHiZWv1L77.container-manager") is changed to AppleMobileFileIntegrity::AMFIEntitlementGetBool in iOS 16.4. So the hack adding entitlements to the backend OSDictionary of OSEntitlements is not working.
I'm sharing two other iOS kernel vulnerabilities reachable from the default app sandbox that don’t require you to open a UserClient:
https://t.co/a6ZOu8UWKR
CVE-2022-32932 is another vulnerability I discovered in the ANE kernel interface; this is a double fetch issue that resulted in an interesting OOB write.
https://t.co/dova9tSWkD
Every time TinyInst on macOS breaks, you can be sure it's because Apple is doing something completely bonkers like, say, in Ventura, moving dyld around once already loaded https://t.co/nPixwwaV5I. Sigh. Fix still in progress.