/explore
|
You are here 
|
theevilbit.github.io | ||
| | | | |
objective-see.org
[AI summary] This post provides a technical analysis of OSX.DazzleSpy, a cyber-espionage macOS implant used to target pro-democracy users in Hong Kong, detailing its persistence mechanisms, remote capabilities, and detection by Objective-See's tools. |
|
| | | | | ||
| | | | |
bradleyjkemp.dev
LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post. |
|
| | | | | ||
| | | | |
balintmagyar.com
Fixed in version 16.2.0.0128 - $11,250 bug bounty |
|
| | | | | ||
| | | | |
macops.ca
[AI summary] This article explains how to customize hardware model filters for NetBoot to support different Mac models with specific OS versions, using DeployStudio's Runtime images and configuring the NBImageInfo.plist file. |
|
| | | |||
