News for hackers. Stuff that matters.
Re:Fun with macOS's Sip by WirelessGigabit on Wednesday January 25, 2023 @04:55AM (#34516483)
While the explanation is super cool it makes me feel nervous. None of this did supported. APIs change without notice, as you don't have a contract. You're relying on the fact that there is an x64 version available.
Re:Fun with macOS's Sip by aviramha on Wednesday January 25, 2023 @05:03AM (#34516527)
Most odds is when x64 binary will stop shipping, arm64e won't be in preview mode anymore and we will be able to just do the re-signing part. (Which is supported)
Re:Fun with macOS's Sip by ghostpepper on Wednesday January 25, 2023 @10:09AM (#34519131)
It's pretty much expected that if you publish a method for working around a security feature it will be patched quickly. Cool research if that was the intention but if you're building a product around this... you're going to have a bad time.
Re:Fun with macOS's Sip by eyalbukchin on Wednesday January 25, 2023 @10:47AM (#34519659)
This is detailed in the post, but the security feature i.e. preventing injected libraries access to entitlements isn't actually bypassed here. Rather the binary is run without these entitlements (which aren't required anyway for mirrord's use case).