@_rdowd

Principal @HuntressLabs | Former Detection & Response Principal @CrowdStrike | macOS Security Enthusiast

 Australia
rdowd.com
Joined May 2024
  • Tweets226
  • Following104
  • Followers623
31Media
I finally got around to blogging about this, and a separate bug (CVE-2024-44219). If you're interested in homedir TCC protections, enforcement via `sandboxd` or the sandbox kernel extension, I'd be pleased if you took a quick look! rdowd.com/castles-made-of-sa…

"Castles Made of Sand": The fragility of enforced privacy protections

It is fair to say that one of Apple’s core tenets is its commitment to user privacy. The term appears 123 times in the Apple Platform Security Guide. i...

rdowd.com
Ryan Dowd@_rdowd13 May 2025
I doubt that I was the first to find this quirky bug, however the impact of basically having tccd fail open was very easy to overlook. Remains unpatched in Ventura and Sonoma unfortunately.
5
9
1
48
8,912
Ryan Dowd retweeted
Calif
@calif_ioOct 16
Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click
150
529
108
4,527
575,625
Ryan Dowd retweeted
L0Psec@L0PsecOct 14
Appreciate @jstrosch for the invite on the podcast! macOS malware is at an interesting place. Also, getting to talk about how reverse engineering workflows are changing with AI was fun/therapeutic. I wasn’t crying I promise. 😂
Josh Stroschein | The Cyber Yeti
@jstroschOct 14
New episode of Behind the Binary is live! 🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation. Plus, we talk about how AI is shifting reverse engineering and the inevitable future state... 🎧 podcasts.apple.com/us/podcas…

EP30 The Golden Age of macOS Malware: Evolution, Stealers, and AI Workflows with Christopher Lopez

Podcast Episode · Behind the Binary by Google Cloud Security · October 14 · 59m

podcasts.apple.com
12
37
1,389
Ryan Dowd retweeted
Csaba Fitzl
@theevilbitOct 2
🍎🐛 I got Claude making this, maybe it's useful for others as well. Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations. apple-cve.com/

APPLE·CVE — every Apple security advisory, indexed

Search, filter and chart every CVE in Apple's security release notes since 2002.

apple-cve.com
13
54
5
295
25,500
Apple just announced big changes to Full Disk Access in macOS! When will it ship? What will the new approval look like? Will existing FDA approvals be affected? What about existing MDM/PPPC profiles? Will enterprise & security tools get different treatment from AI or other apps?
2
14
1
124
8,596
CVE-2026-100754: ChatGPT's code-signing checks on macOS/Windows can be bypassed by (local, unprivileged) attackers, who then inherits the agent's trust: 💉 Inject prompts 👀 Read private chats 🔓 Access TCC-protected files 🍪 Steal cookies/auth tokens/browsing sessions
Objective-See Foundation@objective_seeSep 30
Security & privacy used to mean fighting malware and hackers ...now, we have to add "AI agents" to that threat model 🤖 😅 Mahalo to the @nytimes for spotlighting some of our recent ChatGPT research & bugs! nytimes.com/2026/09/29/techn…
5
24
1
116
9,870
You have gotta love a conference run in the sun. Only hanging at the back for the group photos, I swear! 😅 Thanks @mdowd for organising. @UnpromptedAU
1
2
15
1,587
A stand-out talk on the first day of @UnpromptedAU by @clearbluejar. Great insights and food for thought when it comes to finding 0day using frontier models.
1
1
17
2,341
It looks like these changes were reverted overnight. No official comm’s around what the initial issue was, however.
Ryan Dowd@_rdowdSep 16
This report is long since resolved and is one of many marked a duplicate of an internal finding. A bounty was paid two years ago and CVE already issued in my name. I hope Apple has an undo button available for the changes made to ASB overnight.
18
1,462
This report is long since resolved and is one of many marked a duplicate of an internal finding. A bounty was paid two years ago and CVE already issued in my name. I hope Apple has an undo button available for the changes made to ASB overnight.
Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦
@yo_yo_yo_jboSep 16
Very weird times at the ASB - opened my pending vulnerabilities, all are acknowledged, but all of the sudden 60% of them are now marked as "duplicates with internal findings". The problem is that there's no way to know that besides taking Apple's word as it is.
2
2
2
47
6,603
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️ Privileged attacker? SIGSTOP the tool ...⏳💥😂 Mitigation (per @PeteMarkowsky) subscribe to/block signals! docs.google.com/presentation…
1
4
2
42
10,884
Found that 3 of my bug submissions had been rolled up into CVE-2026-84589. I’ll aim to get a blog released when they’ve formally been resolved by Apple ProdSec.
4
2
36
2,309
Props to @theevilbit and @eisw0lf, among others!
2
189
Come join our training in Budapest! As it stands we will be able to spend some quality time with the trainees, so if that's your jam there's still room left!
Csaba Fitzl
@theevilbitSep 7
Our next training with @gergely_kalman will be in Budapest between the 12th and 15th of October. This is our only training in Europe for this year, and this is the only time we will teach the 4 day version of the training. If you are looking getting into Apple vuln research then this is Your training. Although we don't do iOS here, many of the concepts we teach are applicable there as well. macosvuln.training/
2
18
1,847
Ryan Dowd retweeted
Yogesh Londhe@suyog41Aug 31
MioLab MAC Stealer FontConverter_1.4.2.dmg f40932599dbb2499d527cb12474fe841 C2 lewokodwqko[.]icu #MioLab #MAC #Stealer #IOC
7
21
1,682
Thrilled to announce I will be speaking in Sydney! Hope to catch some of you out at @UnpromptedAU
Unprompted AU@UnpromptedAUAug 19
Ok! The schedule is live as! Check it out: unprompted.au

[un]prompted.au — AI × Cybersecurity Conference · Sydney, 18–19 September 2026

Two days of original vulnerability research, exploit development, and frontier AI security at ILUMINA, Sydney. Explore the program.

unprompted.au
1
2
17
848
#PamStealer macOS infostealer · new JXA loader 🧐 🎭 fake CleanDev clones DevCleaner → cleandev[.]cc ⛓️ one char-code .js = whole kill-chain: 🎣 ClickFix → curl → osascript 🧬 self-decodes at runtime · Function('return') 👇 img 🕵️ gauntlet first → anti-VM · ptrace · SIP · CIS ×11 🔑 then RC4 → C2, env-keyed (cracked offline 🤷‍♂️) 📥 only now → stage-2 Mach-O 🥸 fake Finder[.app (real .icns) → com[.apple.finder.agent 🎬 fake "Installation failed" = already infected 📡 notification-portal[.]com 🎯 catch by @ValeryMarchive
2
8
24
1,818
So much knowledge and talent over 3 days. This is going to be 🔥.
Objective-See Foundation@objective_seeAug 20
Just announced: talks for #OBTS v9 🥳 Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more! Check out the full lineup: objectivebythesea.org/v9/tal… Which one(s) are you most looking forward to!? 🤔

#OBTS v9.0: Talks

Conference Talks

objectivebythesea.org
1
1
8
1,753
Ryan Dowd retweeted
Jamie Levy🦉
@gleedaAug 19
This was interesting. I hadn't seen Google Docs weaponized like that before. @_rdowd @JSemonSecurity and @threatresearch spent some time hunting everything down and it turned out a little more interesting than I previously thought. We never got that linux lure though 🤣 huntress.com/blog/defcon-phi…

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware | Huntress

Huntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.

huntress.com
20
52
3,308
Ryan Dowd retweeted
fG!@osxreverserAug 8
My last scan shown around 40k open screen sharing hosts on the internet, almost half in the US, most are residential IPs but there are many juicy hosts in Murican universities, some companies, a server from BBEdit company. Party hard, never expose those services unless behind ssh
3
23
2,496
Load more