mac – PwnDefend

Vulnerabilities found with AI, oh my!

Ok, so the world is currently obsessed with AI (at least the digital world…) and with the latest Apple update releases we can see that LLMs have been used to help people find bugs! This is great news, finding bugs is better than not finding them!

The funny thing however is the obsession with CVE counts…. this is, honestly not a very useful metric to a defending org.. and I’ll try and explain why!

Hacking

Hash Cracking for Modern OS X (10.8+)

How do we crack OS X password hashes?

I haven’t had tea but I was thinking about the MAC i was remoting into and I suddenly thought.. I wonder how to crack the hashes from a MAC. Surely it’s just cat /etc/passwd and cat /etc/shadow and then unshadow and run hashcat right?

WRONG!

The hashes for local users are stored here:

Guides

Cyber Essentials Readiness

So, you have a driver to achieve cyber essentials, great stuff. Now if you are a business of reasonable size and scale this activity requires a bit of planning, context and lots of access and data. This could be via a distributed team or via a dedicated project team. In this post I’m going to look at what you may need to conduct the planning, discovery, assessment, and certification for Cyber Essentials and/or CE+.