Hello, welcome to the Thursday, August 6th, 2020 edition of the Sandcent Storms, and Stormcast. My name is Johannes Ulrich.

And the time I'm recording from Jacksonville, Florida.

I've mentioned a few times how educational brats' diaries are. Whenever he writes about malware,

he usually includes all the evidence and then walks you

through how to analyze this particular malware, usually with sort of a very traffic-centric

lens. Now, he's upping his game here a little bit and varied the format, and the latest one that he

published today is actually written as a challenge

where you get to solve part of the malware and actually try to extract the malware. Now plenty of

hints here and yes he also gives you the answer at least as part of the files that you can download.

So again, a great learning opportunity and here even with sort of a little bit of a challenge to solve.

And then we got an interesting proof of concept exploit and more details regarding a vulnerability that was patched by Apple

in its July update. This update was released for macOS on July 24th. It's now MacOS 10156. If you're

running an older version, you're vulnerable to this set of vulnerabilities.

And it's really a set of vulnerabilities in that it's three distinct vulnerabilities that together can be used to actually execute arbitrary code as root.

Essentially gives you full privilege escalation. These vulnerabilities also bypass

system integrity protection or SIP, which is the feature that even restricts what root can do

so an attacker could not only become root but also install malicious software into any of these specially protected location. So again, there are three

different vulnerabilities that are sort of being abused here. All of them have been fixed. And if you

are looking for the details, you can find them at the Objective C blog. Now, that blog is usually run by Patrick Wardle,

but this vulnerability was found by Ilius Morad,

a security researcher from Germany.

Let me have a second vulnerability actually affecting Apple devices.

...