A2nkF | Ilias

I wrote a macOS LPE chain using only logic bugs a couple of months ago and now I can finally share it ^^ Here's my blogpost about the vulns and techniques I used: objective-see.com/blog/blog_0x4D… And here's the code: github.com/A2nkF/unauthd

@__sethJenkins p0 could publish via fax machine and I’d still read it religiously 😆

We (Project Zero) got a new website! Because the last one was so...2014? projectzero.google

@LiveOverflow - What obj/struct fields are attacker controlled/can be tainted somehow (even if not arbitrarily controlled) - Object relationships & sane value range - Field access convention (eg field supposed to be retrieved via helper function, lock must be acquired before writing x etc)

When you audit code, what global assumptions/invariants do you keep in working memory? For example when you review a web app you see how authorization is implemented. Then you keep that knowledge in your mind while reviewing different endpoints. What else? 🧠 Brainstorm pls 👇

@CodeColorist @patch1t Can’t wait to see this!!! Awesome work man

This week's genome editing triumph is a big deal. Here's why erictopol.substack.com/p/the-first-hu…

@thezdi @SinSinology @SummoningTeam Really cool!!! Is this one getting a write up? 👀

Confirmed! The first ever winner of the AI category in #Pwn2Own is Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). His successful exploit of Chroma earns him $20,000 and 2 Master of Pwn points. #P2OBerlin

@cutesmilee__ Much success man!

after almost 3 years, this is my last day at Dataflow, it’s been amazing to work with all the people there, I grew up a lot and can’t thank them enough for the opportunities they gave me but now a new adventure is about to start :-)

@patch1t Haha that’s awesome!

I got 14 new Apple CVEs in this release😎

We found three more ways to bypass #Apple’s System Integrity Protection after the company’s initial patch of the exploit chain #vulnerability found by researcher @A2nkF_. Find out more about how Apple patched these flaws in our blog entry: research.trendmicro.com/3jeV5gZ

@layle_ctf Definitely Simon's if you like Steaks

can anyone recommend any places to eat in zurich? ideally near central station but completely fine if not

@userlandkernel @__spv Is this a troll? I genuinely can’t tell 😅

@qwertyoruiopz @osxreverser Haha wait till you hear that the JIT is basically 1:1 copied from the Linux kernel. But tbh, you can’t call whatever Solana uses BPF anymore.

@osxreverser there’s coins that use ELFs and BPF? wtf

@jonathandata1 @qwertyoruiopz lmao imagine trying to discredit @qwertyoruiopz 💀

@layle_ctf Oh wow it only took you like 5 seconds to get a 50% improvement in time until kernel connection 👀😜

I wrote a new guide for rapid kernel and driver debugging! This time with a 2x performance improvement :) We utilize VMware Workstation natively (no Vagrant) for some extra performance benefits. - Time until kernel connection: ~ 10 seconds - Time until driver break: ~ 35 seconds

Wow… This might be the most impressive exploit I’ve ever seen

@theevilbit @patrickwardle @jbradley89 Oh cool, I didn’t notice that system_installd invokes zsh! But you’re right, that’s the same technique I used just attacking a different child process 😄

@patrickwardle @jbradley89 Yes. I was thinking about it when read the MS blog. Also @A2nkF_ with the unauthd chain does a similar trick: objective-see.com/blog/blog_0x4D…

Neat SIP bypass for macOS: 1️⃣ Apple-signed .pkgs triggers launch of (SIP entitled) system_installd 2️⃣ system_installd executes zsh shell 3️⃣ zsh executes any cmds found in (subvertabile) /etc/zshenv. Such cmds (executed as a child of system_installd), run uninhibited by SIP 🙌🏽

@layle_ctf Oh hahaha nice know this works! @rA9_main 😆

@A2nkF_ just seeing wild claims of "vulns" again

this guy is a clown lol

@s1guza Yeah, still not great but def a step up

@theevilbit @s1guza 1080p WHATTTT??? What’s happening? Apple stopped doing Apple things and are giving us a ton of actually useful features

@A2nkF_ @s1guza Looks like

@gabe_k If they’d just give us a usable camera MAYBE PEOPLE WOULD USE IT