/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.
You are here

 balintmagyar.com
Client-side RCE via Symlink Following in Google Web Designer for macOS/Linux: CVE-2025-1079 - Bálint Magyar
| | objective-see.com
Objective-See's Blog
2.6 parsecs away

Travel
| | [AI summary] A technical deep-dive analysis of OSX.DazzleSpy, a macOS cyber-espionage implant targeting pro-democracy activists in Hong Kong, which persists via LaunchAgents and offers capabilities like remote desktop and keychain dumping.
| | bradleyjkemp.dev
LaunchDaemon Hijacking: privilege escalation and persistence via insecure folder permissions | bradleyjkemp
1.8 parsecs away

Travel
| | LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post.
| | blog.quarkslab.com
Exploiting Microsoft Teams on macOS during a Purple Team engagement - Quarkslab's blog
2.3 parsecs away

Travel
| | The following article explains how during a Purple Team engagement we were able to identify a vulnerability in Microsoft Teams on macOS allowing us to access a user's camera and microphone.
| | blog.hobbyistsoftware.com
How to access related files in the Mac Sandbox | Mobile Messages...
5.9 parsecs away

Travel
| [AI summary] A developer shares a tutorial on how to access related Objective-C header files from an app's info.plist in the Mac sandbox using a custom FilePresenter and NSFileCoordinator.