Wojciech Reguła

Summary Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle macOS 27.

Overview of my favorite TCC bypass ever This vulnerability was disclosed at Black Hat Europe 2022 in the talk Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms.

Overview These vulnerabilities were disclosed at Black Hat Europe 2022 in the talk Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms.

Publications This research has been presented at: DEF CON 31 - ELECTRONizing macOS privacy Objective By the Sea - ELECTRONizing macOS Privacy - a New Weapon in Your Red Teaming Armory The backstory In 2019 I wrote a blog post about injecting code to Elect…

Overview I identified a vulnerability that allowed executing code on victims’ machines after they click the Edit button on a Confluence page when Atlassian Companion is installed on macOS.

Overview These vulnerabilities were first disclosed at TyphoonCon in Seoul during my talk What happens on your Mac, stays on Apple’s iCloud?!

Introduction In 2020 I observed a strange behavior a sandboxed macOS app may launch any application that won’t inherit the main app’s sandbox profile.

macOS Red Teaming Tricks series The idea of #macOSRedTeamingTricks series is to share simple & ready-to-use tricks that may help you during macOS red teaming engagements The trick There were a lot of different code execution & persistence methods on macOS,

macOS Red Teaming Tricks series The idea of #macOSRedTeamingTricks series is to share simple & ready-to-use tricks that may help you during macOS red teaming engagements.

macOS Red Teaming Tricks series The idea of #macOSRedTeamingTricks series is to share simple & ready-to-use tricks that may help you during macOS red teaming engagements.

macOS Red Teaming Tricks series This is the first post of the new #macOSRedTeamingTricks series.

Introduction This vulnerability has been disclosed on @Hack in Saudi Arabia in 20+ Ways To Bypass Your Macos Privacy Mechanisms presentation.

Introduction This is the second TCC vulnerability that has been disclosed on my & Csaba’s talk “20+ ways to bypass your macOS privacy mechanisms” during Black Hat USA.

Introduction This vulnerability has been disclosed during my & Csaba’s talk “20+ ways to bypass macOS your privacy mechanisms” during Black Hat USA.

Summary This blog post describes a GateKeeper bypass that worked on M1 Macs.

Introduction I personally love vulnerabilities with stories.

Summary This story is about an issue I reported in July of 2019 via Bugzilla.

Recently I read a really good book about macOS #appsec - Professional Cocoa Application Security.

The new macOS Big Sur changed a lot of things and introduced new mechanisms.

Storing secrets on the macOS is a big challenge and can be done in multiple insecure ways.

XPC Exploitation series Learn XPC exploitation - Part 1: Broken cryptography Learn XPC exploitation - Part 2: Say no to the PID!

This is a special post because I fully based on another researcher, s1guza’s 0day.

XPC Exploitation series Learn XPC exploitation - Part 1: Broken cryptography Learn XPC exploitation - Part 2: Say no to the PID!

XPC Exploitation series Learn XPC exploitation - Part 1: Broken cryptography Learn XPC exploitation - Part 2: Say no to the PID!

After reading Adam Chester’s neat article about bypassing macOS privacy controls, I decided to share my recently discovered trick.

Hey Hackers!

Readers who know me probably also know that I like test soft that I use.

Some time ago, I bought Logitech MX Master wireless mouse to be used with my macs.

TLDR Sandbox implemented in macOS does not cover pasteboard.

If you are a security-aware person, you probably use one of the secure messengers. 😏 And maybe to improve your comfort, you installed its desktop version on your mac?

In this short blog post, I will present to you why the alphanumeric password is much more secure than using biometrics.

Hi dear readers!

Quicklook is a super cool mechanism allowing you to quickly check file contents without opening it in a specialized application.

Before I start describing details, you have to know that this post is published on Responsible Disclosure terms.

Not so long time ago, I submitted my presentation proposal on CONFidence’s Call For Papers.

During my work, I was auditing a Cordova App and then I saw a plain text password right in the logs.

What FreePlane is?

Welcome to my #appsec blog!