Michael Tsai
Landon Fuller
@mjtsai Presumably intended for >= 10.11.4, where Yukon2/BCM driver updates appear to fix local vulnerabilities in IOUserClient interface.
Apple Blacklists Own Ethernet Driver: http://mjtsai.com/blog/2016/02/28/apple-blacklists-own-ethernet-driver/ … #mjtsaiblog
-
-
-
@mjtsai Dockmod seems have shipped a valid signed kext that allowed root to bypass SIP and inject code into processes (like the Dock). -
@mjtsai That seems to have resulted in getting their signing cert revoked, and a blacklist entry added for their existing kext. -
@landonfuller@mjtsai Good call IMO. Injecting userland code into Apple-owned processes from kernelspace is a rather horrid security fail. - View other replies
-
@ameaijou@landonfuller Yep. I can’t imagine how they thought Apple would let this slide. -
@mjtsai@landonfuller The prevailing theory I’ve heard is they lied to Apple when requesting the cert and once Apple noticed… boom. -
-
Gwynne Raskind
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.