Iknowsecurity

Regarding IOHIDFamily: An application may be able to execute arbitrary code with kernel privilege

I found this: https://siguza.github.io/IOHIDeous/ that was published Dec 31.

It took Apple 23 days since it was public before they released a fix.

> The exploit accompanying this write-up consists of three parts:

> poc (make poc) Targets all macOS versions, crashes the kernel to prove the existence of a memory corruption.

> leak (make leak) Targets High Sierra, just to prove that no separate KASLR leak is needed.

> hid (make hid) Targets Sierra and High Sierra (up to 10.13.1, see README), achieves full kernel r/w and disables SIP to prove that the vulnerability can be exploited by any unprivileged user on all recent versions of macOS [!!!!!!!!!]

If you look at the Mac security updates lately, you can see avalanches of "execute arbitrary code" fixes for every release. It seems that Mac Os X has more holes than a factory of Swiss cheese.

EDIT: Why was this downvoted?

If you down vote at least you can comment why. These are the security updates since Oct:

https://support.apple.com/en-us/HT201222

https://support.apple.com/en-us/HT208331

https://support.apple.com/en-us/HT208165

https://support.apple.com/en-us/HT208315

Meltdown and Spectre require recompiling... but it sounded they already did back in December. Did they lie?

Tanium has more holes than a colander.

It has a nice interface for enterprise security staff. It is supposed to reveal security problems for enterprises. While it does a pretty good job to report common attacks, it is useless for identify above average hackers and introduces new vulnerabilities that are a hacker heaven.

In general, anybody that is after the enterprises's data will consider any enterprise software a huge honey pot.

If you are serious about security, invest the money that you pay for Tanium's licenses to hire security experts, instead than IT candies for below average security staff.

The token economy is growing!

The good part is that good open source projects like Vue and Inferno are getting some visibility.

Facebook's open source software licences are going to ruin React

Fixed. Thanks!

Some areas in Vallejo above Oakland are also currently rising in price pretty quickly. After San Francisco, even Oakland is running out of affordable houses. There is a Ferry that goes from Vallejo to the Ferry building in San Francisco with free wifi. Unsurprising more people decide to live there.

A colleague that was looking to buy a house last Spring said that the house he put a bid on in San Francisco sold for 100% above the listing price.

Of all vulnerabilities that created massive amount of personal data leaks this may be the biggest but it is hardly the one caused by the most negligence.

Linkedin using unsalted sha hashes is a lot more maddening. Here you have a vulnerability being disclosed and not enough time to patch your code.

Agreed

The credit system sucks. But has anybody created a better alternative yet?

It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.