Endless Exploits: The Saga of a macOS Vulnerability Exploited Seven Times

Explore a fascinating 25-minute security conference talk that uncovers a persistent logic vulnerability in macOS's PackageKit framework, leading to privilege escalation, TCC circumvention, and SIP bypass. Follow the intriguing cat-and-mouse game between Apple's security team and independent researcher Mickey Jin as he demonstrates how a single vulnerability resulted in seven distinct CVEs (CVE-2022-26688, CVE-2022-32900, CVE-2023-23497, CVE-2023-27962, CVE-2023-38564, CVE-2023-42853, and CVE-2024-23275). Learn about the impact on third-party applications, examine Apple's multiple patching attempts, and understand the technical details of how each patch was bypassed through sophisticated exploit techniques. Presented by an accomplished security researcher with over 180 Apple CVEs to his credit, gain deep insights into vulnerability research, exploit development, and the complexities of securing modern operating systems.