Have U Been Invited

The talk walks through the speaker's approach to finding macOS vulnerabilities. The method starts with learning how a system is meant to behave, looking for anomalies, and then testing whether those anomalies can be turned into more privilege. Modern macOS defenses, including sandboxing, Gatekeeper, privacy controls and System Integrity Protection, mean a single bug is rarely enough on its own.

The main case study is Apple Calendar. The speaker looks at the invitation format and the CalDAV sync model, and notes that attachments in an incoming invite are written to disk automatically once the event reaches the app. That behaviour made the calendar a useful place to look for ways to place files on a victim's machine without further interaction.

Two bug classes were demonstrated. One is an arbitrary file write, where a traversal-style attachment name stores a file outside the directory the app intends. The other is an arbitrary file delete, where a crafted attachment reuses the name of an existing cache file and a later update removes the original, causing the app to crash. The sandbox limited which folders were reachable, though several app-related locations stayed writable. The issues were reported to Apple and fixed in a beta release within about two months. Later steps such as code execution and sandbox escape were left out because those parts are not yet fully fixed.

The takeaway is that older formats and sync features can hide simple path handling flaws, and that attachments from outside should be treated as untrusted input.