Gergely's hack blog

JBO reached out to me, and as it turns out we have collided on the bug I was about to publish, so I won't be doing that until this is cleared up.

UPDATE: JBO reached out to me, and as it turns out we have collided on the bug I was about to publish, so I won't be doing that until this is cleared up.

While researching the filesystem training I came across a particularly bad example I have given in my talks and slides about how rename() works, and I felt it's prudent that I own up to this mistake and publish the correction.

I recently realised that I still owe you guys some writeups, so since OBTSv7 is around the corner here's the one for badmalloc.

TL;DR: Github repo: https://github.com/gergelykalman/fs_usage_ng About Since Apple's built-in fs_usage is amazing but occasionally falls short, I decided to take it upon myself to improve it.

For those of you who requested and/or couldn't make it, here are the slides from my Alligatorcon talk: Gergely Kalman: The forgotten art of filesystem magic It's a prequel to the guide, that is more dry and technical: The missing guide to the security of…

These are the technical slides that I always have to cut from my presentations.

Intro This is a writeup about a user to root privilege escalation due to a race condition in Windscribe VPN's software.

I forgot to post about my talk here, so here it is for those who missed my tweet: Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS by Gergely Kalman

For those of you who are used to reading about my Apple research, this post is going to be a change of pace.

Wow, two blogposts in two days!

Since I owe you guys a bunch of writeups from my talk ( Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS), I decided that I'll tackle lateralus today.

UPDATE: A couple hours after publication the Apple Security Changelogs were updated across the board, and they added me to CVE-2022-26704.

For those that missed the OBTS v6 conference and live stream, here are the slides of my talk: Gergely Kalman: Unexpected Unreasonable Unfixable There should be a video of the talk coming out on the official OBTS youtube channel as well.

This post is a writeup of CVE-2023-38571, a macOS TCC bypass bug I found.

This post is a writeup of CVE-2023-32364, a macOS application sandbox escape bug I found.