Exploring Yosemite: Abusing Mac OS X 10.10
summary
Claims that Mac OS X 10.10 still allows serious kernel abuse: a method to load unsigned kext without warnings (no kextutil patching), a host_priv escalation to grant nonroot users kernel module install rights, and direct kernel memory access techniques used to unlink kernel objects and hide processes; demos run on Yosemite and successfully hide a calculator process. Delivered code includes an exploit kit and rootkit XPRC, a detector SVV-X rootkit and scanner, and a user-mode checker SVV-X-U, all tested and working.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:11Exploring Yosemite
- 4:55Agenda
- 12:06Directional Memory Access
- 19:37Bypassing Kernel Module Verification
- 22:29Kernel-Mode Rootkits
- 23:11Process Hiding
- 23:41Process Structure
- 37:55System Virtuality Verifier for Mac Os X
- 52:29Summary
- 54:30Conclusion
related talks
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
37mAttacking The XNU Kernel In El Capitain
40m(P)FACE into the Apple core and exploit to root
43mDebug for Bug: Crack and Hack Apple Core by Itself
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms