/explore
|
You are here 
|
theevilbit.github.io | ||
| | | | |
objective-see.org
[AI summary] This post provides a technical analysis of OSX.DazzleSpy, a cyber-espionage macOS implant used to target pro-democracy users in Hong Kong, detailing its persistence mechanisms, remote capabilities, and detection by Objective-See's tools. |
|
| | | | | ||
| | | | |
pewpewthespells.com
[AI summary] This technical tutorial explains how to create and configure custom Base and Sparse SDK bundles for use with Xcode, detailing the SDKSettings.plist structure, search paths, and common bugs reported via Apple Radars. |
|
| | | | | ||
| | | | |
bradleyjkemp.dev
LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post. |
|
| | | | | ||
| | | | |
slashusr.wordpress.com
Postfix on OSX: Revisited A few years back, I had written a post on enabling the Postfix MTA as a relay server on OSX, which was quite well received. The article was originally written for OS X Lion, though it remained valid for OSX Mountain Lion, and more recently on OSX Mavericks as well. However,... |
|
| | | |||
