Loading video...

Video Failed to Load

Go Home

🚨 We're disclosing a macOS security bug that Apple says is not an issue. Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web—no password or warning is required. Here's a demo using Signal to steal its encryption...

mysk_co's profile picture

Mysk 🇨🇦🇩🇪

20,854 subscribers

86,835 views • 14 days ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart. With this macOS bug, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)
1:34

Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart. With this macOS bug, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy)

Mysk 🇨🇦🇩🇪

123,735 views • 13 days ago

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇 This happens entirely in the background, with no password prompts or visible alerts. The modified binaries can then access the original app's keychain records and protected containers. We reported this to Apple two weeks ago and haven't received a response. We previously said we wouldn't contact Apple's bounty program again, but we believe it's necessary in this case to help protect Mac users. It affects macOS 26 and 27. This bug doesn't impact apps downloaded from the Mac App Store. Many developers distribute apps on the web instead because Apple controls the App Store's review process and payment methods.
1:25

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇 This happens entirely in the background, with no password prompts or visible alerts. The modified binaries can then access the original app's keychain records and protected containers. We reported this to Apple two weeks ago and haven't received a response. We previously said we wouldn't contact Apple's bounty program again, but we believe it's necessary in this case to help protect Mac users. It affects macOS 26 and 27. This bug doesn't impact apps downloaded from the Mac App Store. Many developers distribute apps on the web instead because Apple controls the App Store's review process and payment methods.

Mysk 🇨🇦🇩🇪

137,007 views • 1 month ago

Sen. Kelly: "This is a fundraising email from POTUS…It says 'As a national security briefing measure you'll receive my private national security briefings.'…Do you think supporters of the president should be able to pay and receive his private national security briefings?" Ratcliffe: "The Hatch Act would prevent me, in an apolitical role, from engaging in that. I'm not aware that anything like that happened." Kelly: "Director Gabbard, do you have any comment on whether unfiltered updates of private national security briefings should be made to individuals that donate to the president?" Gabbard: "I'm not familiar with that document."
1:36

Sen. Kelly: "This is a fundraising email from POTUS…It says 'As a national security briefing measure you'll receive my private national security briefings.'…Do you think supporters of the president should be able to pay and receive his private national security briefings?" Ratcliffe: "The Hatch Act would prevent me, in an apolitical role, from engaging in that. I'm not aware that anything like that happened." Kelly: "Director Gabbard, do you have any comment on whether unfiltered updates of private national security briefings should be made to individuals that donate to the president?" Gabbard: "I'm not familiar with that document."

The Bulwark

19,729 views • 4 months ago

🚨 Here's a good wake up call for all of us. Are you listening? U.S. Treasury Secretary Janet Yellen states that "This is not theft. There is no legal issue" in stealing Russian sovereign assets since "the assets generated income for the institution". Using the same logic, interest income earned on an any investment held at a financial institution, or even a savings account, could be taken from you because the "institution" considers it to be its "income", not yours.
0:28

🚨 Here's a good wake up call for all of us. Are you listening? U.S. Treasury Secretary Janet Yellen states that "This is not theft. There is no legal issue" in stealing Russian sovereign assets since "the assets generated income for the institution". Using the same logic, interest income earned on an any investment held at a financial institution, or even a savings account, could be taken from you because the "institution" considers it to be its "income", not yours.

Lena Petrova

443,332 views • 2 years ago

During a recent appearance on Channels TV, Peter Obi remarked, “I have never seen any president in the world using an ambulance in his convoy, except in Nigeria.” This statement, while perhaps intended to highlight perceived excesses or inefficiencies, is factually incorrect and misleading. A simple review of global presidential security protocols shows that having an ambulance in a presidential convoy is not only standard practice, it is a critical security measure. For instance, the convoy of the President of the United States (as seen on this video), arguably the most protected individual in the world, includes an ambulance as a permanent fixture. This is not a sign of extravagance; it is a precautionary measure to ensure immediate medical attention in the event of an emergency, whether it is a health issue, an accident, or an attack. Modern governance requires us to prioritize the safety of national leaders, especially in regions with complex security dynamics like Nigeria. The presence of an ambulance is not wasteful, it is responsible. It ensures that, should the unexpected happen, life-saving medical intervention is seconds away. It is important that leaders who seek to influence public opinion do so based on facts, not assumptions or populist narratives. Leadership must be built on knowledge, truth, and responsibility, not sentiments that distort reality.
1:02

During a recent appearance on Channels TV, Peter Obi remarked, “I have never seen any president in the world using an ambulance in his convoy, except in Nigeria.” This statement, while perhaps intended to highlight perceived excesses or inefficiencies, is factually incorrect and misleading. A simple review of global presidential security protocols shows that having an ambulance in a presidential convoy is not only standard practice, it is a critical security measure. For instance, the convoy of the President of the United States (as seen on this video), arguably the most protected individual in the world, includes an ambulance as a permanent fixture. This is not a sign of extravagance; it is a precautionary measure to ensure immediate medical attention in the event of an emergency, whether it is a health issue, an accident, or an attack. Modern governance requires us to prioritize the safety of national leaders, especially in regions with complex security dynamics like Nigeria. The presence of an ambulance is not wasteful, it is responsible. It ensures that, should the unexpected happen, life-saving medical intervention is seconds away. It is important that leaders who seek to influence public opinion do so based on facts, not assumptions or populist narratives. Leadership must be built on knowledge, truth, and responsibility, not sentiments that distort reality.

SF

55,994 views • 1 year ago

Last year they hosted Chainlink, who had a hackathon, an Arbitrum track, and a track with Ethereum Foundation. It’s important to note that the focus is on open source technology, including but not exclusively Web3. Mario Behling says, “From a technology point of view, we don't distinguish so much because, of course, in the blockchain world, in the web three world, we're using Python, using JavaScript, we're using technologies to build the next generation of the web”
0:57

Last year they hosted Chainlink, who had a hackathon, an Arbitrum track, and a track with Ethereum Foundation. It’s important to note that the focus is on open source technology, including but not exclusively Web3. Mario Behling says, “From a technology point of view, we don't distinguish so much because, of course, in the blockchain world, in the web three world, we're using Python, using JavaScript, we're using technologies to build the next generation of the web”

Bitcoin.com News

17,395 views • 1 year ago

In this simple example, we show that Claude Code can read the iMessage database on the latest version of macOS, even with a leading EDR running on the system, illustrating the impact of an adversary who can remotely control the agent. We do this using Terminator, an internal research tool we built while studying the security implications of computer use agents. In this setup, the terminal application has previously been granted FDA, a subtle misconfiguration that effectively gives the agent access to unexpected context.
1:51

In this simple example, we show that Claude Code can read the iMessage database on the latest version of macOS, even with a leading EDR running on the system, illustrating the impact of an adversary who can remotely control the agent. We do this using Terminator, an internal research tool we built while studying the security implications of computer use agents. In this setup, the terminal application has previously been granted FDA, a subtle misconfiguration that effectively gives the agent access to unexpected context.

Origin

18,004 views • 8 months ago

Kelly: This is a fundraising email from the president—it says as a national security briefing member, you'll receive my private national security briefings. Do you think supporters of the president should be able to pay and receive his private national security briefings? Ratcliffe: It didn’t happen… Kelly: This says unfiltered updates Gabbard: I’m not familiar with that document Kelly: We’ll get you a copy
1:40

Kelly: This is a fundraising email from the president—it says as a national security briefing member, you'll receive my private national security briefings. Do you think supporters of the president should be able to pay and receive his private national security briefings? Ratcliffe: It didn’t happen… Kelly: This says unfiltered updates Gabbard: I’m not familiar with that document Kelly: We’ll get you a copy

Acyn

96,461 views • 4 months ago

The Beholder is a new block that can be crafted with the drops of the Watcher. Using this block, you can remotely view any location within the same dimension - provided you have enough Occult Gems to support this security network...
0:40

The Beholder is a new block that can be crafted with the drops of the Watcher. Using this block, you can remotely view any location within the same dimension - provided you have enough Occult Gems to support this security network...

Alexander Mobiles 🐀🐀🐀

42,095 views • 3 years ago

Happy to release Maia SDR, an open-source FPGA-based SDR project focusing on the ADALM Pluto. This first release can display the waterfall on a web browser using WebGL2 and record in SigMF format, at up to 61.44 Msps. Here is a short demo, and some technical details. 🧵
2:17

Happy to release Maia SDR, an open-source FPGA-based SDR project focusing on the ADALM Pluto. This first release can display the waterfall on a web browser using WebGL2 and record in SigMF format, at up to 61.44 Msps. Here is a short demo, and some technical details. 🧵

Daniel Estévez

85,764 views • 3 years ago

BOUNTYHUNT3RZ Episode 13: w/ 0xSimao riptide (singapore) Bringing out the AUDITOOOR Round 2! 0xSimao "the human fuzzer" discusses being a humble aerospace engineer to getting started in crypto with Three Sigma | Web3 Security and then selected to be a part of Blackthorn, how he approaches audits vs. contests, auditors vs. bountyhunters, approaching bug hunting with the right mindset to locate zee bugs, auditing for clients that do not respect security, bountyhunting is playing the long game, taking the L when you miss a bug as an auditor, red flags in codebases and what to look for and things that are always out of scope during an audit that bug hunters should look at and much, much, more ... podcast, discord, substack ->
1:02

BOUNTYHUNT3RZ Episode 13: w/ 0xSimao riptide (singapore) Bringing out the AUDITOOOR Round 2! 0xSimao "the human fuzzer" discusses being a humble aerospace engineer to getting started in crypto with Three Sigma | Web3 Security and then selected to be a part of Blackthorn, how he approaches audits vs. contests, auditors vs. bountyhunters, approaching bug hunting with the right mindset to locate zee bugs, auditing for clients that do not respect security, bountyhunting is playing the long game, taking the L when you miss a bug as an auditor, red flags in codebases and what to look for and things that are always out of scope during an audit that bug hunters should look at and much, much, more ... podcast, discord, substack ->

bountyhunt3rz podcast

18,302 views • 1 year ago

Putin to NATO Secretary General Mark Rutte: What nonsense is he saying? I'd really like to ask him: Listen, what are you saying about a war with Russia? You can read, right? Then read the new US National Security strategy. The USA is the key player in NATO, the main sponsor of NATO. Russia is not mentioned as an enemy [in the new security strategy]. But NATO Secretary General is getting ready for a war with us. What is that? You can read, can't you? How are you targeting NATO for a war with Russia if the main NATO country does not see us as an adversary and an enemy?
1:25

Putin to NATO Secretary General Mark Rutte: What nonsense is he saying? I'd really like to ask him: Listen, what are you saying about a war with Russia? You can read, right? Then read the new US National Security strategy. The USA is the key player in NATO, the main sponsor of NATO. Russia is not mentioned as an enemy [in the new security strategy]. But NATO Secretary General is getting ready for a war with us. What is that? You can read, can't you? How are you targeting NATO for a war with Russia if the main NATO country does not see us as an adversary and an enemy?

Anton Gerashchenko

532,560 views • 7 months ago

Ford has a security vulnerability that they are internally leaving unfixed so they can sell you the solution Their vehicles are vulnerable to a relay attack, that lets someone with a signal booster trick your vehicle into thinking they have the key fob Ford knows this works and your vehicle can be stolen, but instead of fixing the security issue they are charging customers $7.99 per month, that’s $96 per year to be protected from this hacking The security package even comes with stolen vehicle assist…. So they know that your vehicle can be stolen by this and they’ll assist and get it back… for a price There should be a lawsuit against Ford for this
2:04

Ford has a security vulnerability that they are internally leaving unfixed so they can sell you the solution Their vehicles are vulnerable to a relay attack, that lets someone with a signal booster trick your vehicle into thinking they have the key fob Ford knows this works and your vehicle can be stolen, but instead of fixing the security issue they are charging customers $7.99 per month, that’s $96 per year to be protected from this hacking The security package even comes with stolen vehicle assist…. So they know that your vehicle can be stolen by this and they’ll assist and get it back… for a price There should be a lawsuit against Ford for this

Wall Street Apes

479,413 views • 4 days ago

Guys, I think this is a very important bug to do research into with the rest of the cast. I've tried already with other char's 1,2 , but can't replicate the same as it shows here. It very well may be that a lot of moves have this bug in the game. We just never had an explanation
2:37

Guys, I think this is a very important bug to do research into with the rest of the cast. I've tried already with other char's 1,2 , but can't replicate the same as it shows here. It very well may be that a lot of moves have this bug in the game. We just never had an explanation

FOX | Sin

135,153 views • 2 months ago

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.
5:10

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.

Santiago

33,004 views • 8 months ago

Hey Grok this clip of the Moon was filmed by a civilian using an amateur telescope from his backyard. So why is it that NASA, with unlimited resources, can’t or won’t, deploy a telescope on Artemis II, or any of the 10,000 satellites - to film & zoom in on the Earth from space. It should be so simple and everyone wants to see it, so why won’t NASA do this Grok ?
0:27

Hey Grok this clip of the Moon was filmed by a civilian using an amateur telescope from his backyard. So why is it that NASA, with unlimited resources, can’t or won’t, deploy a telescope on Artemis II, or any of the 10,000 satellites - to film & zoom in on the Earth from space. It should be so simple and everyone wants to see it, so why won’t NASA do this Grok ?

Concerned Citizen

235,502 views • 3 months ago

‼️THIS IS NOT A DRILL‼️ Reunion had an update today!!! It seems to be a bug fix update? No patch notes so we're not sure yet but.. One things for certain 🥰 THEY FIXED THE ISSUE WITH THE BROKEN DIALOGUE/JOURNAL ENTRIES!! NOW YOU CAN GET IT ALL CORRECTLY IN ONE PLAYTHROUGH😇😇
1:59

‼️THIS IS NOT A DRILL‼️ Reunion had an update today!!! It seems to be a bug fix update? No patch notes so we're not sure yet but.. One things for certain 🥰 THEY FIXED THE ISSUE WITH THE BROKEN DIALOGUE/JOURNAL ENTRIES!! NOW YOU CAN GET IT ALL CORRECTLY IN ONE PLAYTHROUGH😇😇

matilda*꩜ ④ | 8 days🦋

31,498 views • 3 months ago

Sen. Kelly: This is a fundraising email from Trump and there's multiple links to donate money. It says, 'as a national security briefing member, you'll receive my private national security briefings.' Do you think the public should be able to pay and receive his private national security briefings? Gabbard: Uh... I'm not... I'm not familiar with that document Kelly: We'll get you a copy
1:25

Sen. Kelly: This is a fundraising email from Trump and there's multiple links to donate money. It says, 'as a national security briefing member, you'll receive my private national security briefings.' Do you think the public should be able to pay and receive his private national security briefings? Gabbard: Uh... I'm not... I'm not familiar with that document Kelly: We'll get you a copy

Headquarters

198,012 views • 4 months ago