/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.
You are here

 blog.quarkslab.com
Exploiting Microsoft Teams on macOS during a Purple Team engagement - Quarkslab's blog
| | bradleyjkemp.dev
LaunchDaemon Hijacking: privilege escalation and persistence via insecure folder permissions | bradleyjkemp
1.2 parsecs away

Travel
| | LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post.
| | objective-see.com
Objective-See's Blog
1.7 parsecs away

Travel
| | [AI summary] A technical deep-dive analysis of OSX.DazzleSpy, a macOS cyber-espionage implant targeting pro-democracy activists in Hong Kong, which persists via LaunchAgents and offers capabilities like remote desktop and keychain dumping.
| | objective-see.org
Objective-See's Blog
1.8 parsecs away

Travel
| | [AI summary] This post provides a technical analysis of OSX.DazzleSpy, a cyber-espionage macOS implant used to target pro-democracy users in Hong Kong, detailing its persistence mechanisms, remote capabilities, and detection by Objective-See's tools.
| | dae.me
"Building boot caches" error when changing startup disk | Dae's blog
15.6 parsecs away

Travel
| [AI summary] A blog post discusses troubleshooting the 'Building boot caches' error encountered when changing the startup disk on a Mac, offering a solution involving the creation of a missing com.apple.Boot.plist file.