Top all-time · #5484
Csaba Fitzl
Personal blog · theevilbit.github.iosecuritysystems
Csaba Fitzl writes theevilbit, a personal blog at theevilbit.github.io about security and systems. Since 2019, 14 different Hacker News readers have linked it 16 times, most often “CVE-2022-32929 – Bypass iOS backup's TCC protection”. It is still writing: the last post was on 2026-09-01, and you can follow it by feed.
macOS security research by Csaba Fitzl: vulnerabilities, exploits, persistence, talks.
Most-linked posts?
- CVE-2022-32929 – Bypass iOS backup's TCC protection4 people · 5 mentions · first linked 2022-11-14
- CVE-2020-9771 is not fixed correctly (2020)3 people · 3 mentions · first linked 2020-07-03
What Hacker News says?
You might be right - maybe Apple's poorly operated bug bounty program is a result of incompetence rather than intentional malice. But does that matter to security researchers or the public? No. Apple should fix their bounty program regardless of the reason it's broken. Ultimately, this blog post is just another example on the already large pile[1][2][3][4][5] 1: https://arstechnica.com/information-technology/2021/09…
Comment linking /posts/experiences_with_asb/
on “Zero-Click Calendar invite vulnerability chain in macOS”Submitted macOS persistence – Beyond the good ol' LaunchAgents as a story · 86 points
HN discussionYou might be right - maybe Apple's poorly operated bug bounty is a result of incompetence rather than intentional malice. But does that matter to security researchers or the public? No. Apple needs to get their bounty program in order regardless of the reason it's broken. Ultimately, this blog post is just another example on the already large pile[1][2][3][4][5] 1: https://arstechnica.com/information-technology/2021…
Comment linking /posts/experiences_with_asb/
on “Zero-Click Calendar invite vulnerability chain in macOS”Submitted CVE-2020-9771 is not fixed correctly (2020) as a story · 73 points
HN discussionUnless there is a security vulnerability that allows for the host to be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/
Comment linking /posts/cve-2022-32929/
on “iPhones and iPads Now Require a Passcode on Every Backup/Sync”Submitted Getting root with benign AppStore apps as a story · 45 points
HN discussionThat’s just the issue. There is a security issue on the Mac side that doesn’t make it possible to securely identify itself and it can be spoofed. https://theevilbit.github.io/posts/cve-2022-32929/
Comment linking /posts/cve-2022-32929/
on “iPhones and iPads Now Require a Passcode on Every Backup/Sync”Submitted CVE-2022-32929 – Bypass iOS backup's TCC protection as a story · 13 points
HN discussionI’ll cross post what I wrote to folks on the MacRumors forum: I believe this may be an intentional change to temporarily avoid a security issue, which otherwise hadn't been fixed yet: https://theevilbit.github.io/posts/cve-2022-32929/ (as shown in the blog post and embedded Twitter thread linked earlier) > The issue is that an attacker can invoke the `AppleMobileBackup` utility and make a backup to a custom location…
Comment linking /posts/cve-2022-32929/
on “iPhones and iPads Now Require a Passcode on Every Backup/Sync”Submitted CVE-2020-9771 – mount_apfs TCC bypass and privilege escalation as a story · 4 points
HN discussionSubmitted CVE-2022-32929 – Bypass iOS backup's TCC protection as a story · 3 points
HN discussionSubmitted CVE-2020-9771 – mount_apfs TCC bypass and privilege escalation as a story · 3 points
HN discussionSubmitted Dylib Injection in macOS with DYLD_INSERT_LIBRARIES as a story · 2 points
HN discussionSubmitted Shield – An app to protect against process injection on macOS as a story · 2 points
HN discussionSubmitted Beyond the good ol' LaunchAgents – 32 – Dock Tile Plugins as a story · 1 points
HN discussionSubmitted VMWare Fusion 11 – Guest VM RCE – CVE-2019-5514 as a story · 1 points
HN discussion
