ronka

[ronka @epsilan]

@xnyhps that's really unfortunate. it seems it was lost in the chaos somewhere. to add more ASB data: my disclosure to bounty timeline was 10 months starting in january

[ronka @epsilan]

#OBTS was just surreal. many thanks to everyone for the warm reception, you can find my slides detailing the story behind 5 app/macro sandbox escapes stemming from one root cause here: https://t.co/DXktTvGrp0

[Objective-See Foundation @objective_see]

Ron Waisberg (@epsilan) of @okta, detailing a lovely
a logic vulnerability he discovered in LaunchServices (CVE-2021-30677) and creative ways to reliable exploit it! 🙌🏽 #OBTS

If you're not on the conference live stream, you're missing out!

Join us: https://t.co/8eEeWGDkG0 🎥

[ronka @epsilan]

@durumcrustulum @0xmachos @patrickwardle good find. this should have the envvar ignored but testing on 5.17.2 I'm not seeing that behaviour and I'm dropped into a node interpreter 🤔

[ronka @epsilan]

@ClassicII_MrMac @theevilbit all will be revealed in ~2 weeks time at @objective_see #OBTS 🤭🤠

[ronka @epsilan]

@theevilbit @ClassicII_MrMac To add evidence to your theory: a bug of mine was fixed in 11.6

[ronka @epsilan]

@_r3ggi @theevilbit @BlackHatEvents The bounty decision makes no sense. @mattshockl was your issue eligible for a bounty?

[ronka @epsilan]

@theevilbit @BlackHatEvents @_r3ggi awesome talk & great finds!

[ronka @epsilan]

Big Sur 11.5 fixed and assigned CVE-2021-30783 to a bug of mine in just under 2mo from report. Can't wait to share details about this bug and CVE-2021-30677 at @objective_see's #OBTS v4 !! Get your palms ready for your faces :))

[ronka @epsilan]

honoured to speak alongside so many brilliant folks at #OBTS v4 https://t.co/l1yWl14UmL see y'all in Maui!! 🏖️🌴

[ronka @epsilan]

CVE-2021-33765 is an Installer spoofing bug and variant of CVE-2021-26413 where a batch command is placed in CFB unallocated bytes of an Installer file (preserving the signature) and cmd.exe optimistically interprets one line at a time without exiting early

[ronka @epsilan]

@clintgibler did I get it?? https://t.co/b2LyVtVH83

[ronka @epsilan]

@_xpn_ this worked well for me https://t.co/7wsWY9cUET

[ronka @epsilan]

@xnyhps Yikes... so 6mo+ later that other bug is still unpatched

[ronka @epsilan]

@xnyhps thanks for sharing, Thijs 🙏 is this bug separate from the process injection bug described at the end of your presentation?

[ronka @epsilan]

@aionescu thanks Alex!! and if you're referring to my profile pic (which admittedly does look a lot like Mont Royal) it's actually Chapultepec Castle in Mexico City :)) hopefully we'll be back in mtl soon enough 🤞

[ronka @epsilan]

@thracky thank you John!! hopefully enough details in here to make for an easy report :P

[ronka @epsilan]

wrote a little write-up about my first MS bug: CVE-2021-26413 https://t.co/TiI6CS5can big h/t to @mattifestation for sharing his endless knowledge!

[ronka @epsilan]

@theevilbit Not IDA but I recently wrote this for Hopper to help with reconstructing ObjC runtime info in Big Sur’s cache https://t.co/DNxu2G1vBz

[ronka @epsilan]

here is an example of what class and protocol information can be discerned (easy NSXPC clients anyone??) shoutout to Steve Nygard for the excellent class-dump and Vincent for excellent disassembler!

[ronka @epsilan]

hello world! for those reversing Big Sur, I wrote a Hopper (@bSr43) plugin to reconstruct ObjC runtime structures in the dyld_shared_cache. dePAC/import/analyze the names + types of ivars, properties, methods in classes & protocols: https://t.co/DNxu2G1vBz