Ryan Dowd @_rdowd

Principal @HuntressLabs | Former Detection & Response Principal @CrowdStrike | macOS Security Enthusiast Australia Joined May 2024

Tweets

116
Followers

273
Following

78
Likes

166

Jai Minton @CyberRaiju

3 days ago

Has my content ever helped you? I'd appreciate you making it known 🥰 After more than 6 years of free content, for the 1st time ever I've been nominated for a #SANSDMA Award 👀🎉 Voting is open until October 8 and I'm alongside other worthy recipients🙏 survey.sans.org/jfe/form/SV_6f…

2 6 29 3K 3

Download Image

Objective-See Foundation @objective_see

a week ago

We ❤️ supporting authors! At #OBTS v8, three amazing authors will be selling & signing their latest books 📚 1️⃣ "Threat Hunting macOS" by J. Bradley 2️⃣ "Disarming Code" by J. Levin 3️⃣ "The Art of Mac Malware (Vol. II)" by P. Wardle ...so make sure to grab your signed copy!

1 2 14 5K 1

Download Image

Patrick Wardle @patrickwardle

2 weeks ago

macOS Tahoe ships with a 0day ...based on a bug disclosed 8(!) years ago at #OBTS v1.0 🫣 New post: "From Spotlight to Apple Intelligence: Abusing an 0day to steal the data that fuels macOS AI": objective-see.org/blog/blog_0x81… ...with open-source PoC! Takeaway? Always attend #OBTS 😄

9 108 344 36K 132

Csaba Fitzl @theevilbit

2 weeks ago

The blog post format of my talk, "Finding Vulnerabilities in Apple Packages at Scale", I presented at @securityfest and @MacDevOpsYVR is up at @KandjiOfficial 's blog. I cover CVE-2024-27883, CVE-2024-44196 and CVE-2024-44253. the-sequence.com/finding-vulner…

0 20 83 6K 35

Kory Heard @XNUniverse

2 months ago

Apple has integrated Endpoint Security into Mach. I’ll look to see if I can find any clues in the source. The challenge is you can’t perform an AUTH or even get an EVENT for every Mach message. You’d overload the system. You can perform checks for less common messages like task

1 1 10 1K 3

Download Image

Ryan Dowd @_rdowd

2 months ago

Has anybody else seen a number of their Apple bugs planned for the FALL 2025 release suddenly drop that tag? I've lost a few in the last 2 weeks.

4 0 3 379 1

Dray Agha @Purp1eW0lf

2 months ago

🚨 SonicWall Exploitation (Zero Day?) 🚨 Huntress is tracking active intrusions via SonicWall devices. Threat actors are bypassing MFA, pivoting to domain controllers, deploying ransomware (likely Akira), and creating users for persistence. Pace suggests possible zero-day

5 74 201 65K 74

Download Image

Csaba Fitzl @theevilbit

2 months ago

Apple failed to fix this so many times. I first reported this back in macOS Big Sur, and it's literally detailed in my EXP-312 course in "Bypass TCC via Spotlight Importer Plugins"

Microsoft Threat Intelligence @MsftSecIntel

2 months ago

Apple failed to fix this so many times. I first reported this back in macOS Big Sur, and it's literally detailed in my EXP-312 course in "Bypass TCC via Spotlight Importer Plugins" https://t.co/caxjQMtxOL

6 67 177 87K 65

2 35 208 34K 67

Download Image

Objective-See Foundation @objective_see

2 months ago

📢 Just dropped: the full #OBTS v8 talk lineup! objectivebythesea.org/v8/talks.html And for the first time we'll have 3 full days of presentations! 🤩 Congrats to the selected speakers and mahalo to all who submitted. With ~100 submissions, selecting the final talks was a daunting task! 😫

2 26 61 48K 8

Csaba Fitzl @theevilbit

3 months ago

📣 Some good news on the training front: 🎉 we teamed up with @gergely_kalman and by bringing in our different expertise in the field will make this training even better 🎉 we should be ready by early 2026 🎉 we aim to deliver it in 3 public conferences 🎉 first two modules are…

5 4 28 5K 3

Ryan Dowd @_rdowd

4 months ago

Yes yes I know macOS 26 is in beta, but it just tickles me that the quirky Setup Assistance ui bugs that were squashed in Sequoia are back! _mbsetupuser TCC enforcement is non-standard. Coupled with an LPE this would be a cheeky way to mess with new hardware, as it was pre 15.3.

2 0 4 851 2

Download Image

Ryan Dowd @_rdowd

4 months ago

macOS 26 (beta) Endpoint Security enhancements: - es_process_t adds es_cs_validation_category_t indicating code signature policy; - iokit_open adds parent_path & parent_registry_id; and - xp_malware_detected gains detected_executable for accurate binary path (e.g in app bundles).

0 4 11 1K 1

Patrick Wardle @patrickwardle

5 months ago

🎙️😍 Was stoked to talk nerdy on the @MacAdmPodcast! If you're interested in macOS malware, Apple security & detection, and much more, have a listen: linkedin.com/feed/update/ur…

0 13 49 3K 12

L0Psec @L0Psec

5 months ago

New RE Video: youtube.com/watch?v=2Bj3rz… Spent some time reversing a recent sample that uses a bit of obfuscation (made easier with a Binary Ninja script), sets up persistence, and uses curl APIs. This one is a little longer than usual but fun since I go through most of the sample.

0 20 77 6K 38

Ryan Dowd @_rdowd

5 months ago

I doubt that I was the first to find this quirky bug, however the impact of basically having tccd fail open was very easy to overlook. Remains unpatched in Ventura and Sonoma unfortunately.

3 2 20 3K 3

Download Image

Blacktop @blacktop__

5 months ago

NEW macOS 15.4 🥫🍝 sauce! 🎉 xnu: github.com/apple-oss-dist… dyld: github.com/apple-oss-dist… objc4: github.com/apple-oss-dist… Security: github.com/apple-oss-dist… Libc: github.com/apple-oss-dist… - this post was generated by `ipsw` 🤖

1 14 75 11K 31

Ryan Dowd @_rdowd

6 months ago

Received minutes apart for an account I created maybe a decade ago and never use. Breach disclosure incoming?

3 1 7 2K 0

Download Image

Ryan Dowd @_rdowd

6 months ago

This post by @theevilbit has inspired many subsequent successful tcc bypasses, including one I managed to obtain overnight on 15.5 beta 1. Worth giving it a read, a re-read, a re-re-read, etc kandji.io/blog/malware-b…