Exploring the world with my sword of debugger : )
Joined August 2013
- Tweets316
- Following282
- Followers5.4K
- Likes3.7K
Mickey Jin retweeted
Apple has patched a vulnerability I reported that had been present for over a decade. The fix was released in macOS 27.2.
CVE-2026-112445
Of all the local privilege escalation (LPE) vulnerabilities I’ve seen, this is probably the easiest to exploit, the most straightforward, and the most bizarre—so bizarre that it makes you wonder whether it was an Apple backdoor.
github.com/Mas0nShi/CVE-2026…
Mickey Jin retweeted
I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)
- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉
Try it here: github.com/jprx/darwin-vm
Mickey Jin retweeted
The screensharingd bug is a pre-auth, and an amazing bug that LLM enabled clowns killed without understanding it. Releasing a PoC that allows to download files from vulnerable macOS. It’s not super reliable, but the real one is very much. Patch asap!
reverse.put.as/2026/07/29/it…
Mickey Jin retweeted
🍎🌁 Big changes to user TCC.db in macOS Golden Gate! It seems that it finally got the protection it deserves.
It was moved to:
/private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/
You can't access it even with FDA, and likely need "com\.apple.private.security.protected-system-container" entitlement to write to it.
Mickey Jin retweeted
Some observations from disassembly that might be related to iOS 27 performance boost
codecolor.ist/posts/2026-06-…
Mickey Jin retweeted
IMO Mysk is not trustworthy. They tried to hype low impact vulns as critical in the past (HTTP icon download). Also... duplicates happen, and Apple always credits you for those. If you can't trust the vendor's decision about first submitter, then don't submit. I did cross check a few of these duplicates with researchers in the past, and Apple was always right.
Mickey Jin retweeted
Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.
projectzero.google/2026/01/p…
Mickey Jin retweeted
Holiday Project 👨🏻💻🎄
Interested in macOS malware? Have a read!
🎉 A decade of Mac malware research 🎉
Just published our 10th annual “The Mac Malware of <year>” report ...2025 edition!
For each new sample of 2025, covers:
🔎 IoCs 💉 Infection 💾 Persistence 📡 Capabilities ☣️ Samples for download
Dive in 👇
objective-see.org/blog/blog_…
Mickey Jin retweeted
Introducing DirtyDict. A series of vulnerabilities found by me and @patch1t.
Most of this is my perspective, but Mickey did give me permission to share some details about one of his bugs.
Enjoy!
wts.dev/posts/dirtydict/
Mickey Jin retweeted
🎉 My new blog post is about a PackageKit vulnerability I learned from @p1tsist1p 's blog posts.
🍎🐛macOS LPE via the .localized directory
I tried convincing Apple to universally fix it with no luck.
Go hunt for vulnerable pkg installers! There is a ton :-( Happy Friday!
theevilbit.github.io/posts/l…
Mickey Jin retweeted
A really thorough overview of the research: github.com/trailofbits/explo…
Mickey Jin retweeted
The slidedeck to our talk, Crash One: A Starbucks Story - CVE-2025-24277, with @gergely_kalman from @hexacon_fr and @objective_see #OBTS is available from the link below.
It was a macOS vulnerability impacting the crash reporting process where we could achieve LPE and sandbox escape.
theevilbit.github.io/talks_w…
Mickey Jin retweeted
Excited to share our research on ChillyHell, a modular macOS backdoor targeting officials in Ukraine. Check out our write-up for more details.
jamf.com/blog/chillyhell-a-m…
Mickey Jin retweeted
A tiny timing flaw in Apple’s core file-copy APIs can put millions of devices at risk 📂🍏
Despite warnings, Apple thought it was “too hard to exploit”—until Mickey Jin developed an exploit that steals secrets in privileged services
👉nullcon.net/berlin-2025/spea…
#NullconBerlin2025
Mickey Jin retweeted
Thank you @helpnetsecurity to mention us 👍 awesome research by @tsunek0h
#macOS #applesecurity #NullconBerlin2025
helpnetsecurity.com/2025/09/…
Mickey Jin retweeted
🚨 New blog post: ELEGANTBOUNCER - Catch iOS 0-click exploits without having the samples.
Features iOS backup forensics & messaging app scanning for iMessage, WhatsApp, Signal, Telegram & Viber attachments.
🔗 Link -> msuiche.com/posts/elegantbou…
Mickey Jin retweeted
🍏 #AppleDevelopers use NSFileManager thinking it’s safe — but @patch1t found a race condition once thought “impossible to exploit.”
At #NullconBerlin2025, he’ll show how it works, why CVE-2024-54566 failed, and Apple’s final fix.
👉 nullcon.net/berlin-2025/spea…
#iOS #applesecurity
Mickey Jin retweeted
Brief info and POC for this week's Apple 0click iOS 18.6.1 RCE bug CVE-2025-43300 github.com/b1n4r1b01/n-days/…
Mickey Jin retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
