Week of May 6, 2024

A proof-of-concept exploit named Floro demonstrates a method to bypass System Integrity Protection (SIP) on macOS 14.0 and earlier by leveraging a symlink race condition during installation of Apple's InstallAssistant.pkg. The technique allows removal of the 'restricted' flag on SIP-protected directories, enabling an attacker to replace the TCC database and gain Full Disk Access. The vulnerability has no CVE and was tested on macOS 14.0; it does not work on macOS 14.4.

In July 2021, the REvil ransomware gang exploited zero-day vulnerabilities in Kaseya VSA remote monitoring and management software to deploy ransomware to approximately 1,500 downstream businesses via managed service providers. The attackers leveraged the trusted Kaseya agent to distribute malicious updates, bypassing endpoint security controls. This supply-chain attack encrypted systems and demanded a $70 million ransom.

A technique is presented that enables self-modification of a process's .text section using WriteProcessMemory to bypass EDR userland hooks. It builds on the Process Mockingjay approach by avoiding RWX memory allocations and instead modifying existing executable code sections to execute malicious code without triggering typical API hook detections.

Zscaler is investigating claims that threat actor IntelBroker is selling access to its network, including logs with credentials. The company stated there is no impact to customer, production, or corporate environments, and an isolated test environment was taken offline for analysis.

Zscaler confirmed an isolated test environment on a single server was exposed to the internet and taken offline for forensic analysis. No customer, production, or corporate environments were impacted. The incident follows threat actor IntelBroker's claims of selling access to a cybersecurity company with $1.8B revenue, later identified as Zscaler.

A proof-of-concept repository named DV_NEW combines multiple evasion techniques under the name Dirty Vanity to bypass endpoint detection and response (EDR) systems. It uses direct syscalls, dynamic syscall number resolution, and an egg-hunting technique to patch syscall instructions at runtime, evading user-mode hooks and static analysis. The author claims successful bypass of Bitdefender and Microsoft Defender for Endpoint.