⚠️ Latest macOS 0day (credit: Park Minchan)
...bypasses File Quarantine, Gatekeeper, etc.
Advisory:
📝 "macOS Finder RCE" ssd-disclosure.com/ssd-advisory-m…
😅 Confirmed Big Sur & Monterey are vulnerable
🧮 I've posted Park's PoC (pops Calc) if you'd like to play: objective-see.com/downloads/PoCs…
...bypasses File Quarantine, Gatekeeper, etc.
Advisory:
📝 "macOS Finder RCE" ssd-disclosure.com/ssd-advisory-m…
😅 Confirmed Big Sur & Monterey are vulnerable
🧮 I've posted Park's PoC (pops Calc) if you'd like to play: objective-see.com/downloads/PoCs…
The PoC once downloaded still has to be manually executed by the user.
macOS should, via File Quarantine/Gatekeeper, alert/warn/block as this is an 'executable' item from the Internet.
Apple attempted to patch (blocking file:// prefix), but File:// or fIle:// still work 🤣🤣🤣
macOS should, via File Quarantine/Gatekeeper, alert/warn/block as this is an 'executable' item from the Internet.
Apple attempted to patch (blocking file:// prefix), but File:// or fIle:// still work 🤣🤣🤣
ℹ️ The initial patch, will as noted, block items that attempt to abuse the "file://" prefix: (but not "File://" etc.):
If you're interested in this topic (and other such potentially harmful macOS files), check out @vladimir_metnew excellent talk from #OBTS v3.0
"Quarantine Nights: Exploring File Quarantine handling in macOS Apps": objectivebythesea.com/v3/talks/OBTS_… 🙌🏽
"Quarantine Nights: Exploring File Quarantine handling in macOS Apps": objectivebythesea.com/v3/talks/OBTS_… 🙌🏽
• • •
Missing some Tweet in this thread? You can try to
force a refresh
