Ryan Dowd @_rdowd

Principal @HuntressLabs | Former Detection & Response Principal @CrowdStrike | macOS Security Enthusiast Australia Joined May 2024

Tweets

107
Followers

268
Following

76
Likes

159

Kory Heard @XNUniverse

4 weeks ago

Apple has integrated Endpoint Security into Mach. I’ll look to see if I can find any clues in the source. The challenge is you can’t perform an AUTH or even get an EVENT for every Mach message. You’d overload the system. You can perform checks for less common messages like task

1 1 10 1K 3

Download Image

Ryan Dowd @_rdowd

a month ago

Has anybody else seen a number of their Apple bugs planned for the FALL 2025 release suddenly drop that tag? I've lost a few in the last 2 weeks.

4 0 3 369 1

Dray Agha @Purp1eW0lf

a month ago

🚨 SonicWall Exploitation (Zero Day?) 🚨 Huntress is tracking active intrusions via SonicWall devices. Threat actors are bypassing MFA, pivoting to domain controllers, deploying ransomware (likely Akira), and creating users for persistence. Pace suggests possible zero-day

5 75 201 65K 74

Download Image

Csaba Fitzl @theevilbit

a month ago

Apple failed to fix this so many times. I first reported this back in macOS Big Sur, and it's literally detailed in my EXP-312 course in "Bypass TCC via Spotlight Importer Plugins"

Microsoft Threat Intelligence @MsftSecIntel

a month ago

Apple failed to fix this so many times. I first reported this back in macOS Big Sur, and it's literally detailed in my EXP-312 course in "Bypass TCC via Spotlight Importer Plugins" https://t.co/caxjQMtxOL

7 67 176 85K 65

2 36 208 34K 67

Download Image

Objective-See Foundation @objective_see

2 months ago

📢 Just dropped: the full #OBTS v8 talk lineup! objectivebythesea.org/v8/talks.html And for the first time we'll have 3 full days of presentations! 🤩 Congrats to the selected speakers and mahalo to all who submitted. With ~100 submissions, selecting the final talks was a daunting task! 😫

2 26 61 47K 8

Csaba Fitzl @theevilbit

3 months ago

📣 Some good news on the training front: 🎉 we teamed up with @gergely_kalman and by bringing in our different expertise in the field will make this training even better 🎉 we should be ready by early 2026 🎉 we aim to deliver it in 3 public conferences 🎉 first two modules are…

5 4 28 4K 3

Ryan Dowd @_rdowd

3 months ago

Yes yes I know macOS 26 is in beta, but it just tickles me that the quirky Setup Assistance ui bugs that were squashed in Sequoia are back! _mbsetupuser TCC enforcement is non-standard. Coupled with an LPE this would be a cheeky way to mess with new hardware, as it was pre 15.3.

2 0 4 839 2

Download Image

Ryan Dowd @_rdowd

3 months ago

macOS 26 (beta) Endpoint Security enhancements: - es_process_t adds es_cs_validation_category_t indicating code signature policy; - iokit_open adds parent_path & parent_registry_id; and - xp_malware_detected gains detected_executable for accurate binary path (e.g in app bundles).

0 4 11 1K 1

Patrick Wardle @patrickwardle

4 months ago

🎙️😍 Was stoked to talk nerdy on the @MacAdmPodcast! If you're interested in macOS malware, Apple security & detection, and much more, have a listen: linkedin.com/feed/update/ur…

0 13 49 3K 12

L0Psec @L0Psec

4 months ago

New RE Video: youtube.com/watch?v=2Bj3rz… Spent some time reversing a recent sample that uses a bit of obfuscation (made easier with a Binary Ninja script), sets up persistence, and uses curl APIs. This one is a little longer than usual but fun since I go through most of the sample.

0 20 77 6K 38

Ryan Dowd @_rdowd

4 months ago

I doubt that I was the first to find this quirky bug, however the impact of basically having tccd fail open was very easy to overlook. Remains unpatched in Ventura and Sonoma unfortunately.

3 2 20 3K 3

Download Image

Blacktop @blacktop__

4 months ago

NEW macOS 15.4 🥫🍝 sauce! 🎉 xnu: github.com/apple-oss-dist… dyld: github.com/apple-oss-dist… objc4: github.com/apple-oss-dist… Security: github.com/apple-oss-dist… Libc: github.com/apple-oss-dist… - this post was generated by `ipsw` 🤖

1 14 75 11K 31

Ryan Dowd @_rdowd

5 months ago

Received minutes apart for an account I created maybe a decade ago and never use. Breach disclosure incoming?

3 1 7 2K 0

Download Image

Ryan Dowd @_rdowd

5 months ago

This post by @theevilbit has inspired many subsequent successful tcc bypasses, including one I managed to obtain overnight on 15.5 beta 1. Worth giving it a read, a re-read, a re-re-read, etc kandji.io/blog/malware-b…

2 3 31 2K 14

Ferdous Saljooki @malwarezoo

6 months ago

If you’re hunting for macOS stealers, this VirusTotal query yields good results: type:script filename:"/Volumes/" filename:".file" behavior_command_executions:base64

2 12 69 6K 45

Download Image

Ryan Dowd @_rdowd

6 months ago

Trust me-- watch previous OBTS presentations on YouTube with a Terminal window open. You will find bugs! And any paid bounty would more than cover your attendance at future OBTS conferences It really can pay for itself!