Access Control
27 matching posts.
The Helper Was Registered. Its Lifetime Outlived the App.
A macOS login item, launch agent, or launch daemon can remain active after the visible app exits. A defensible review separates packaging, registration, approval, launch domain, runtime authority, updates, failure recovery, and removal.
The Permission Was Granted. The Data Use Still Needed a Policy.
TCC can authorize a macOS process to reach a protected resource, but consent is not a standing business authorization. A defensible review follows the prompt, responsible code identity, returned capability, downstream use, retention, logging, and revocation.
The Extension Was Sandboxed. The Shared Container Still Crossed the Boundary.
An iOS app and its extensions run in separate containers, but App Groups and Keychain access groups deliberately reconnect them. A defensible review follows each entitlement, producer, shared object, lifecycle transition, and privileged consumer instead of treating code signing as authorization.
One ATM Was Contained. The Fleet Trust Path Was Not.
The final ATM assessment chapter: test remote support, software deployment, segmentation, monitoring, transaction integrity, containment, and reconciliation as fleet-wide control planes.
The App Was Sandboxed. The XPC Boundary Still Needed Authorization.
A macOS app can be sandboxed while a separate helper, launch agent, or launch daemon holds different authority. A defensible review maps every executable, entitlement, XPC peer, operation, and effect instead of treating the app bundle as one security boundary.
The Device API Was Standard. Authorization Was Assumed.
Part four of the ATM assessment series: test XFS-style middleware, caller identity, service providers, peripheral state, PIN boundaries, and transaction context with emulators and denied requests—not live device effects.
The Desktop Was Hidden. The Execution Boundary Was Not.
Part three of the ATM assessment series: validate kiosk containment, application control, service identities, maintenance states, secrets, updates, and off-host telemetry without turning UI escape testing into a payload exercise.
The BIOS Had a Password. The Boot Chain Still Needed Trust.
Part two of the ATM assessment series: an evidence-driven method for validating firmware recovery, Secure Boot, measured boot, disk-unlock policy, update integrity, and off-host detection without publishing a hardware-bypass playbook.
The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
The Package Was Signed. The Update Was Still a Security Decision.
A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.
The Extension Was Sandboxed. The Native Host Was Not.
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
The ATM Was Locked Down. The Transaction Path Was Not.
An evidence-driven methodology for authorized ATM security assessments: test the trust boundaries between the kiosk, operating system, device middleware, EPP, service network, monitoring plane, and transaction switch without turning the engagement into a cash-out exercise.
The Container Was Non-Root. The Node Was Still One Mount Away.
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
The Model Proposed the Action. The Broker Decided Whether It Could Exist.
A practical architecture for AI-assisted pentest execution: resolve scope outside the model, classify side effects, issue short-lived capabilities, deny high-impact authority, and preserve a decision record that can be independently verified.
The Hardening Score Went Up. The Attack Path Stayed Open.
A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.
The Model Found the Vulnerability. The Tool Call Became the Incident.
A balanced operating model for AI-assisted pentesting: where models improve coverage and evidence work, where excessive agency turns a valid test into a destructive action, and how to keep cloud, shell, and Domain Admin authority outside the model.
The Handshake Was Captured. The Network Was Not.
A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.
The Pipeline Has No Secret. It Still Has a Cloud Identity.
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
Android App Links: The Link Was Verified. The Action Was Not.
A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.
The Last Two Steps Are Not in Scope. What Makes Them Survivable Is.
Part five of testing the ransomware playbook: an assessment stops before exfiltration and encryption, and it should. But the two properties that decide how bad either gets — egress and backup reachability — are fully testable, and almost never in scope.
The Request Stayed Server-Side. The Credential Did Not.
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
The Blast Radius Is One Number. Almost Nobody Has Measured It.
Part four of testing the ransomware playbook: lateral movement runs on your own administrative tooling, so detection is a signal-to-noise problem — and the number that actually decides the outcome is how many hosts accept the same credential.
They Do Not Break In. They Log In.
Part one of testing the ransomware playbook: the initial access an affiliate needs is almost always a valid credential against a reachable endpoint — and that finding is usually already in a report somewhere, marked medium.
The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
SMB Signing Is On. That Closed One Edge, Not the Graph.
Signing is a per-protocol control, and NTLM over HTTP cannot be signed at all. The useful question is never whether signing is enabled — it is which relay edges are still open.
The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
The Path Your Proxy Blocks Is Not the Path Your App Runs
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.