Think RAM forgets? 🤔 Not always. See how secrets can leak, what mitigations exist on major OS like #macOS, #Windows, #Linux, and what devs can do:

https://afine.com/when-memory-refuses-to-forget-sensitive-data-persistence-in-desktop-application/

Most #macOS devs often underestimate #Apple #TCC. I used to—until I wrote #malware and hit that wall. TCC is the last line protecting users even after compromise. In my latest post, I explain why vendors should care. Enjoy!

https://afine.com/threat-of-tcc-bypasses-on-macos/

How a simple #fuzzing payload bypassed entitlement check and triggered a #kernel panic on #macOS in the IOMobileFramebuffer driver. Patched in 15.4. Enjoy!

https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/

#RE, #Vulnerability #Research #PoC

🚀 New blog post! 🚀

"A History of #NULL Pointer Dereferences on macOS." Discover how #Apple's security measures have evolved, making these vulnerabilities unexploitable on modern systems.

Enjoy!
#macOS #Cybersecurity #Vulnerability

https://afine.com/history-of-null-pointer-dereferences-on-macos/

This is a short blog post about a cheap #redteam trick I found last year during #phishing assessments to bypass #Outlook spam filters and deliver links to malicious #ISO files. #Microsoft does not want to patch it, so it is good to be aware of it:
https://afine.com/bypassing-spam-filtering-mechanism-in-outlook/
Enjoy!

🚀 New blog post! 🚀

Deep dive into a #macOS IONVMeFamily #driver Denial of Service issue! It is not a security risk but a great case study for macOS driver analysis.🕵️‍♂️

Enjoy!
#RE #Vulnerability #Research #Kernel #Fuzzing #PoC

https://afine.com/case-study-analyzing-macos-ionvmefamily-driver-denial-of-service-issue/

Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more:

https://afine.com/slap-flop-apple-silicons-data-speculation-vulnerabilities/

Task Injection on macOS
🔍 Dive into how attackers can leverage Task Ports for process code injection. Learn security rules, lldb & debugserver mechanics, and some red tricks!
#macOS #Cybersecurity #TaskInjection #InfoSec

Enjoy & read it now here:
https://afine.com/task-injection-on-macos/

Fortunately, I managed to finish a core of the series this year💪 Here we have an introduction to #Apple #macOS hybrid #kernel #XNU: info about #Mach and #BSD integration, #security features, and #debugging techniques. I wish you all a Happy New Year!

https://karol-mazurek.medium.com/snake-apple-x-nu-0bc5c36170da?sk=v2%2F502ee9db-8d8a-4a1b-8655-546742a7d261

Deep dive into #Apple #macOS #drivers: Explore #IOKit and #BSD internals. Understand driver types and #kernel interfaces. Includes practical #RE techniques with #code examples. Enjoy and Merry Christmas!🎄
https://karol-mazurek.medium.com/drivers-on-macos-26edbde370ab?sk=v2%2F8a5bbc18-aae7-4a68-b0dd-bb5ce70b5752

Fresh article on how to build, #RE, #debug, and #recon #XPC services on #macOS with an #XCode #Programming walkthrough (#C and #NSXPC APIs). Plus actual #debugging tips with #LLDB. If you are into #macOS/#iOS, this one's for you - #code included.
Enjoy!

https://karol-mazurek.medium.com/xpc-programming-on-macos-7e1918573f6d?sk=v2%2F21c4e9c7-40a5-43dd-804b-0d8f9bc4e94c

Just published an article on #Mach #IPC #security in #macOS: diving deep into how #XNU handles inter-process communication. Inside, you'll find detailed #RE techniques, #task port security analysis, and practical IPC #recon approaches. Enjoy!

https://karol-mazurek.medium.com/mach-ipc-security-on-macos-63ee350cb59b?sk=v2%2F3afce264-9b59-447f-84ea-b1988606191a

I just published an article about #macOS #Kernel Extensions where you can find info about every #security barrier that makes it hard for #malware to just load kext and gain kernel-level code execution.

Enjoy!
https://karol-mazurek.medium.com/kernel-extensions-on-macos-1b0f38b632ea?sk=v2%2Fb6920735-90f9-459c-9c10-30980247bae7

Learn how #macOS enforces security with the Mandatory Access Control Framework (#MACF). Dive into #policy modules, #hooks, #syscalls, kernel events, and more. Explore detailed insights into #Apple’s robust security model. Enjoy!

https://karol-mazurek.medium.com/macf-on-macos-004b8a490e2c?sk=v2%2Fd9a61281-e230-4ac6-8608-ad062f4d2a9a

This article explains how #macOS handles #exceptions on #Apple Silicon (#arm64), transitions between #user - #kernel mode, dives into #syscalls, #interrupts, and fault handling details, and includes a breakdown with a visual Exception Handling Map. Enjoy!
https://karol-mazurek.medium.com/exceptions-on-macos-2c4bd6a9fd31?sk=v2/fa7393a6-16e7-46d4-84d0-4de300260533

I was featured in @pagedout_zine on pages 22 and 47, but I encourage you to read the entire magazine—it's filled with fantastic work and incredible people! Catch it in Issue #5: https://pagedout.institute/

What started as a simple #bug led me deep into the mysteries of #Unix #symlinks, #firmlinks, and other nuances of the #filesystem. Grateful to @gergely_kalman for the nudge! This one’s full of #python #UnixTips #macOS magic. Enjoy reading!
https://karol-mazurek.medium.com/fixing-an-infinite-loop-on-unix-e0a8a5501c54

I just published Snake&Apple IX, diving into #Apple #TCC (#Transparency, #Consent, and #Control) on #macOS! This article covers how TCC enforces privacy protections for user data, exploring its daemons, databases, permissions dialogs, and entitlements.

https://karol-mazurek.medium.com/snake-apple-ix-tcc-ae822e3e2718?sk=v2%2F426ae6cf-6418-4e3f-a0ca-3aee06d6f676

Last year, I created a tool to identify #MachO binaries on #Apple #macOS. Recently, I got feedback from

@patrickwardle, @gergely_kalman, and @yo_yo_yo_jboon suggesting optimizations: https://x.com/karmaz95/status/1851559861990858810

Here’s an article detailing my improvements: https://karol-mazurek.medium.com/optimizing-mach-o-detection-40352101bbef?sk=v2%2F3378d3f5-874b-4b82-94d5-b2ccd8522ea3

This short post is about identifying all executables on your #Apple #MacOS, finding their UUIDs, and creating such a #UUID database. It introduces a new tool called #UUIDFinder. Enjoy!

https://karol-mazurek.medium.com/apple-uuid-finder-a5173bdd1a8a?sk=v2%2F04bb0d32-6dc9-437d-bf72-8f65e03fed90