PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Intego X9: Why your macOS antivirus should not trust PIDs

blog.quarkslab.com | research | #vulnerability-research | #privilege-escalation | #ghidra | #macos | #race-condition | #frida | #intego | #xpc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of Quarkslab's Intego series: combining Ghidra static analysis with Frida tracing to show how a PID reuse race can bypass XPC authentication checks on privileged macOS services.
Published
Collected

Related coverage

research · blog.quarkslab.com
Intego X9: Never trust my updates
Part three of Quarkslab's Intego series: chaining an XPC authentication bypass in the com.intego.netupdated daemon with another flaw to reach root, highlighting weak validation in macOS XPC mechanisms.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
BSIM explained once and for all!
Quarkslab finally explains Ghidra's BSIM internals: functions are lifted to normalized P-code, hashed into feature vectors, and compared to find semantically equivalent functions.
research · blog.quarkslab.com
Milking the last drop of Intego - Time for Windows to get its LPE
Quarkslab discloses a Windows LPE in Intego 3.0.0.1: the Optimization module deletes files as SYSTEM without validating directory junctions, chaining the Config.msi trick to reach SYSTEM privileges.
Back