Ryan Dowd

Principal @HuntressLabs | Former Detection & Response Principal @CrowdStrike | macOS Security Enthusiast

[Ryan Dowd @_rdowd]

@gergely_kalman If I had $1 for every time you asked me for a write up I could pay you to write my blogs for me. :P
But yeah, one cookin' right now which is a banger.
Congrats on your bounty dude!

[Ryan Dowd @_rdowd]

@theevilbit @antoniozekic It was insanely quick for me; less than 2 hours.

[Ryan Dowd @_rdowd]

@KyleHanslovan @HuntressLabs Unfortunately these bugs are everywhere in macOS. I wrote a tool that finds then at scale https://t.co/iI7VjR7IIE

Unfortunately the bottleneck is actual real telemetry. Working on that research rn ;)

[Ryan Dowd @_rdowd]

Found a macOS TOCTOU bug while reviewing Apple EDR integrations at @HuntressLabs.
A non-admin user can delete TCC-protected content by hitting the right timing window. Came up unexpectedly during the review, which made it a fun one.

[Ryan Dowd @_rdowd]

@gergely_kalman @HuntressLabs Thanks man!

[James Northey @darkrym11]

Found some very common adware quietly killing antivirus products. Then we found an unregistered update domain, and anyone with $10 could have pushed any payload to 25,000+ endpoints, AV already disabled.

So we registered it first.

https://t.co/WMSaym7yOu

Big thanks to @_rdowd

[Brandon Dalton @PartyD0lphin]

Spent some time with Claude this weekend making an Endpoint Security reference for research and development. Checks for the latest SDK, parses the ES headers, and publishes. Includes a dedicated ES change log and telemetry matrix.
https://t.co/b0HZ6IKOpW

[Patrick Wardle @patrickwardle]

You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! 🤯

Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks

Read: “Building a Firewall…via Endpoint Security!?”
https://t.co/gR4t6dPbbr

[Jai Minton @CyberRaiju]

I teamed up with Ryan Dowd to investigate a fake OpenClaw installer hosted on GitHub. This was also picked up by Bing's AI and recommended as the correct way to install OpenClaw on Windows.

https://t.co/3bFxLeKxzZ

[Gergely Kalman @gergely_kalman]

4 new CVEs in the latest Apple update, 2 with @theevilbit and 2 on my own. I will try to do and get writeups out for these, but right now I'm writing material for the training still. This is turning into a book...
Anyway, update your systems!

[Ryan Dowd @_rdowd]

Amazing work @tonygo_

[Tony Gorez @tonygo_]

I did a summary of my last Predator spyware analysis:

https://t.co/2ccNWxIqjy

[Olivia Gallucci ✨ @OliviaGalluccii]

I'm excited to announce that I'll be speaking at @BSidesSF & @DianaInitiative on how to detect race conditions on macOS! 🌁

Big thanks to Andrew Krug and Adam Messer for supporting my work, and helping me submit to these amazing conferences!

#InfoSec #BSidesSF @DatadogHQ

[Gergely Kalman @gergely_kalman]

We (me + @theevilbit) have a website for the macOS Vulnerability Research Training now, in case you are interested:
https://t.co/TAwcSvCv7l

[Ryan Dowd @_rdowd]

Update: Things are back on track now.

[Ryan Dowd @_rdowd]

How it started: "Target Flags are a new security research capability in Apple operating systems that make it easier to objectively demonstrate your findings and determine your award eligibility."

How its going:

[Ryan Dowd @_rdowd]

@m1thr1da Having the report abruptly closed without comment or email notification of the status change is a little bit frustrating, I won't lie.

[Ryan Dowd @_rdowd]

@VanStorek I have no problems with this post being shared :)

[Ryan Dowd @_rdowd]

Updated my ransomware poc to remove the reboot requirement. Full TCC bypass for Tahoe 26.2 chained with a DoS exploit to demo exfiltration of private data and wipe the user's home directory while the user session remains active.

[Ryan Dowd @_rdowd]

@jaakerblom @gergely_kalman These look to be worth $10k now based on the updated bounty guidelines.

[Ryan Dowd @_rdowd]

I've been seeing a lot of discussion online recently about the changes to Apple's bug bounty program, specifically the downgrading of payouts for TCC bypass vulnerabilities.
I was recently asked for my thoughts on this matter. I figured the best way to illustrate the importance of supporting research into this class of bug was to demonstrate the real-world impact.

I created a small ransomware POC with clickfix-esque deployment (since that's what the cool kids are doing nowadays).

No TCC prompts or any other system warnings. It exfils all sensitive user data and deletes the user's home and iCloud data.