theevilbit blog

2026 Link to heading macOS Exploit Mixtape – Hack Like it’s the 80s /CA: Gergely Kalman/ (Zer0Con) 2025 Link to heading Finding Vulnerabilities in Apple Packages at Scale (SecurityFest, MacDevOpsYVR) Presentation Video - SecurityFest 2025 Video - MacDevOp…

This blog is about a vulnerability on macOS which impacts every third party installer if they try to run a privileged command from within the application bundle.

Intro Link to heading Kandji’s Threat Research team recently performed an audit on the macOS diskarbitrationd and storagekitd system daemons, uncovering several vulnerabilities.

Intro Link to heading The Kandji team is always looking out for how to help keep your devices secure.

This is part 35 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 34 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Intro Link to heading I recently came across a persistence feature in macOS that’s tied to Dock tile plugins.

This is part 33 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Intro Link to heading CVE-2023-40424 is a vulnerability that allows a root-level user to create a new user with a custom Transparency Consent and Control (TCC) database in macOS, which can then be used to access other users’ private data.

Intro Link to heading Vulnerabilities are hot topics inside the world of security research and—because of their potentially dramatic impacts—outside as well.

UPDATE 2023.10.10.: After chatting with Thijs Alkemade, @xnyhps, updated the XPC part of the post as I originally misunderstood Apple’s intent.

This is part 32 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is just a super quick post and some notes, about my experiences with SMAppService.

This is part 31 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 30 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is a quick blogpost about a vulnerability I covered in our Black Hat Europe 2022 talk with Wojciech Regula.

Intro Link to heading Normally, when a users backup their iOS device, the backup is saved into ~/Library/Application Support/MobileSync/Backup directory.

The world is changed: I feel it in the Sandbox, I feel it in the entitlements, I smell it in the kernel...

Intro Link to heading CVE-2017-2533 was part of a chain of vulnerabilities, used at pwn2own 2017 found by the phoenhex team.

Dropping some initial quick notes for a new security feature I ran into on macOS Ventura.

This is part 29 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 28 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 27 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 26 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 25 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 24 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 23 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 22 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Intro Link to heading CVE-2021-1784 was a vulnerability that allowed an attacker to bypass TCC by mounting over the ~/Library/Application Support/com.apple.TCC directory and providing a new TCC database.

My name is Csaba Fitzl or also known as “theevilbit”, which comes from RFC 3514.

This is part 21 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Many people used to ask me where to start learning about macOS security or exploitation, what are the trainings or books out there that can help with this topic.

This is part 20 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 19 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This post is about two techniques that can be useful for someone to evade GateKeeper in a red team engagement or pentest.

This is part 18 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Apple announced macOS Monterey (macOS 12) this week at WWDC, and one of its new features that caught my eye is Shortcuts.

This is part 17 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 16 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Intro Link to heading This is a rather old vulnerability I found in TeamViewer back in 2020, and reported it through VCP/iDefense.

This is part 15 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 14 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

Since Apple started their Apple Security Bounty program I have submitted around 50 cases to their product security team.

I plan to discuss two symlink attacks in this blog post.

This is part 13 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 12 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 11 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 10 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 9 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.

This is part 8 in the series of “Beyond the good ol’ LaunchAgents”, where I try to collect various persistence techniques for macOS.