The Curious Engineer

All blogs / Security

theevilbit

theevilbit.github.io

macOS security research by Csaba Fitzl: vulnerabilities, exploits, persistence, talks.

SecurityReverse engineeringApple / classic Mac

’19’20’21’22’23’24’25’26
Posts
60 from 31 Mar 2019 to 1 Sep 2026
Posting
now and then (5 in the last year)
Kind
personal blog
Feed
https://theevilbit.github.io/index.xml

2026 3

  1. Inside the screensharingd Bugs: How macOS Screen Sharing Went from Root File Access to Pre-Auth Compromise
  2. How a single PostScript file leaks your Mac's memory
  3. The Dangers of Cracking Tools

2025 4

  1. macOS LPE via the .localized directory
  2. CrashOne - A Starbucks Story - CVE-2025-24277
  3. Finding Vulnerabilities in Apple Packages at Scale
  4. The diskarbitrationd and storagekitd Audit Story Part 3

2024 8

  1. The diskarbitrationd and storagekitd Audit Story Part 2
  2. The diskarbitrationd and storagekitd Audit Story Part 1
  3. Beyond the good ol' LaunchAgents - 35 - Persist through the NVRAM - The 'apple-trusted-trampoline'
  4. Beyond the good ol' LaunchAgents - 34 - launchd boot tasks
  5. Dock Tile Plugins Could Be Used to Escalate Privileges
  6. Beyond the good ol' LaunchAgents - 33 - Widgets
  7. CVE-2023-40424 - How Malware Can Bypass Transparency Consent and Control
  8. How Apple Mitigates Vulnerabilities in Installer Scripts

2023 6

  1. Launch and Environment Constraints Deep Dive
  2. Beyond the good ol' LaunchAgents - 32 - Dock Tile Plugins
  3. macOS Service Management - The SMAppService API - Quick Notes
  4. Beyond the good ol' LaunchAgents - 31 - BSM audit framework
  5. Beyond the good ol' LaunchAgents - 30 - The man config file - man.conf
  6. CVE-2022-22655 - TCC - Location Services Bypass

2022 8

  1. CVE-2022-32929 - Bypass iOS backup's TCC protection
  2. Prologue - The Lord of The Rules
  3. CVE-2017-2533 - The details behind
  4. AMFI Launch Constraints - First Quick Look
  5. Beyond the good ol' LaunchAgents - 29 - amstoold
  6. Beyond the good ol' LaunchAgents - 28 - Authorization Plugins
  7. Beyond the good ol' LaunchAgents - 27 - Dock shortcuts
  8. Beyond the good ol' LaunchAgents - 26 - Finder Sync Plugins

2021 10

  1. Beyond the good ol' LaunchAgents - 25 - Apache2 modules
  2. CVE-2021-30808 - CVE-2021-1784 strikes back - TCC bypass via mounting
  3. Getting started in macOS security
  4. GateKeeper - Not a Bypass (Again)
  5. macOS Monterey Shortcuts - First look
  6. NOCVE - TeamViewer Local Privilege Escalation Vulnerability
  7. Experiences with Apple Security Bounty
  8. CVE-2020-9900 & CVE-2021-1786 - Abusing macOS Crash Reporter
  9. About com.apple.private.security.clear-library-validation
  10. Divide and Conquer - A technique to bypass NextGen AV

2020 12

  1. CVE-2020-9771 - Reversing Engineering the Fix
  2. NOCVE - Microsoft Teams for macOS Local Privilege Escalation
  3. Let's talk macOS Authorization
  4. CVE-2020-9771 - mount_apfs TCC bypass and privilege escalation
  5. CVE-2020-14977 - Secure coding XPC Services - Part 5 - PID reuse attacks
  6. CVE-2020-14978 - Secure coding XPC Services - Part 4 - Improved client authorization
  7. The AMFI MACF policy system call
  8. CVE-2020-0984 - Secure coding XPC Services - Part 3 - Incorrect client verification
  9. Kernel Debugging macOS with SIP
  10. Secure coding XPC Services - Part 2 - Checking CS (CodeSigning) flags of the client
  11. TALK - Exploiting directory permissions on macOS
  12. CVE-2019-20057 - Secure coding XPC services - Part 1 - Why EvenBetterAuthorization is not enough?

2019 9

  1. GateKeeper - Bypass or not bypass?
  2. CVE-2020-14974 & CVE-2020-14975 - IOBit Unlocker 1.1.2 - Local Privilege Escalation
  3. NOCVE - Few click RCE via GitHub Desktop macOS client with Gatekeeper bypass and custom URL handlers
  4. UninstallString - a possible LPE via Social Engineering
  5. A simple protection against HMValidateHandle technique
  6. DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX
  7. TALK - macOS - Getting root with benign AppStore apps
  8. CVE-2020-14976 - GNS3 ubridge SETUID bit - arbitrary file read
  9. CVE-2019-5514 - VMware Fusion 11 - Guest VM RCE